clinkx 0.3.0 → 1.0.0

package/dist/context-builder/secrets.js

@@ -1,5 +1,6 @@
 import { InvalidParamsError } from "../errors.js";
-const PRIVATE_KEY_BLOCK_PATTERN = /-----BEGIN [A-Z0-9][A-Z0-9 ]{0,48}PRIVATE KEY-----/;
+import { isAlias, isMap, isScalar, isSeq, parseAllDocuments, } from "yaml";
+const PRIVATE_KEY_BLOCK_PATTERN = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----/;
 const WELL_KNOWN_TOKEN_PATTERNS = [
     { provenance: "aws_access_key_id", pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/ },
     { provenance: "github_token", pattern: /\bgh[opusr]_[A-Za-z0-9_]{30,}\b/ },
@@ -10,7 +11,17 @@ const WELL_KNOWN_TOKEN_PATTERNS = [
     { provenance: "npm_token", pattern: /\bnpm_[A-Za-z0-9]{30,}\b/ },
     { provenance: "slack_token", pattern: /\bxox[baprs]-[A-Za-z0-9-]{20,}\b/ },
 ];
-const ASSIGNMENT_PATTERN = /\b(password|passwd|api[_-]?key|secret|token|access[_-]?token|private[_-]?key|client[_-]?secret)\b\s*[:=]\s*(['"]?)([^'"\s;,#]{8,})\2/i;
+const ASSIGNMENT_KEY_PATTERN = /(?<![A-Za-z0-9_$-])(?:(["'])([A-Za-z_][A-Za-z0-9_-]*)\1|((?:[A-Za-z_$][A-Za-z0-9_$]*(?:[ \t]*(?:\.|::)[ \t]*[A-Za-z_$][A-Za-z0-9_$]*)*[ \t]*)?\[[ \t]*(["'])([A-Za-z_][A-Za-z0-9_-]*)\4[ \t]*\])|([A-Za-z_$][A-Za-z0-9_$-]*(?:[ \t]*(?:\.|::)[ \t]*[A-Za-z_$][A-Za-z0-9_$-]*)*))(?=[ \t]*[:=])/gi;
+const SENSITIVE_ASSIGNMENT_KEY_PATTERN = /(?:^|[_-])(?:password|passwd|api[_-]?key|secret|token|access[_-]?token|private[_-]?key|client[_-]?secret)$/i;
+const REDACTION_MARKER = "[redacted-sensitive]";
+const YAML_BLOCK_HEADER_PATTERN_SOURCE = String.raw `(?:(?:&[A-Za-z_][A-Za-z0-9_.-]*|!<[^>\r\n]+>|!!?[A-Za-z_][A-Za-z0-9_.:/-]*)[ \t]+)*[|>](?:[+-][1-9]?|[1-9][+-]?)?`;
+const MAX_YAML_DOCUMENTS = 32;
+const MAX_YAML_NODES = 20_000;
+const MAX_YAML_DEPTH = 128;
+const MAX_YAML_SOURCE_CHARS = 5_000_000;
+const MAX_JS_KEY_LOOKBACK = 32_768;
+const MAX_TS_TYPE_CHARS = 4_096;
+const MAX_TS_TYPE_DEPTH = 32;
 const PLACEHOLDER_VALUES = new Set([
     "changeme",
     "example",
@@ -77,20 +88,9 @@ export function scanHighConfidenceSecretContent(text) {
             findings.push(contentFinding(provenance, line));
         }
     }
-    const lines = text.split(/\r?\n/);
-    for (let index = 0; index < lines.length; index++) {
-        const match = ASSIGNMENT_PATTERN.exec(lines[index] ?? "");
-        if (match == null) {
-            continue;
-        }
-        const value = match[3] ?? "";
-        const quote = match[2] ?? "";
-        if (quote.length === 0 && looksLikeCodeExpression(value)) {
-            continue;
-        }
-        if (isHighConfidenceAssignedSecret(value)) {
-            findings.push(contentFinding("assignment_secret", index + 1));
-            break;
+    for (const assignment of iterateAssignmentSecrets(text)) {
+        if (assignment.confidence === "high") {
+            findings.push(contentFinding("assignment_secret", assignment.line));
         }
     }
     return dedupeFindings(findings);
@@ -99,24 +99,120 @@ export function isBlockingSecretFinding(finding) {
     return finding.provenance !== "assignment_secret";
 }
 export function redactHighConfidenceAssignmentSecrets(text) {
-    return text
-        .split(/(\r?\n)/)
-        .map((part) => {
-        if (part === "\n" || part === "\r\n") {
-            return part;
+    const secretAssignments = [...iterateAssignmentSecrets(text)].filter((assignment) => assignment.confidence === "high").sort((left, right) => left.valueStart - right.valueStart);
+    let redacted = text;
+    for (let index = secretAssignments.length - 1; index >= 0; index--) {
+        const assignment = secretAssignments[index];
+        if (assignment == null) {
+            continue;
         }
-        return redactAssignmentSecretLine(part);
-    })
-        .join("");
+        redacted = `${redacted.slice(0, assignment.valueStart)}${assignment.replacement ?? REDACTION_MARKER}${redacted.slice(assignment.valueEnd)}`;
+    }
+    return redacted;
 }
-export function assertNoHighConfidenceSecretsInTask(task) {
-    const findings = scanHighConfidenceSecretContent(task);
+/**
+ * Sanitizes one bounded text body. The residual callback is deliberately a
+ * separate lexical detector and runs for every opt-out sanitization, including
+ * content the primary assignment grammar did not classify.
+ */
+export function sanitizeHighConfidenceSecretContent(text, residualDetector = hasConservativeResidualSecret) {
+    const findings = scanHighConfidenceSecretContent(text);
+    if (findings.some(isBlockingSecretFinding)) {
+        return { status: "blocked", content: "", findings };
+    }
     if (findings.length === 0) {
+        if (residualDetector(text)) {
+            return {
+                status: "blocked",
+                content: "",
+                findings: [contentFinding("residual_secret", 1)],
+            };
+        }
+        return { status: "unchanged", content: text, findings };
+    }
+    const content = redactHighConfidenceAssignmentSecrets(text);
+    if (residualDetector(content)) {
+        return {
+            status: "blocked",
+            content: "",
+            findings: [contentFinding("residual_secret", 1)],
+        };
+    }
+    return { status: "redacted", content, findings };
+}
+/**
+ * Independent fail-closed backstop for every opt-out content body. This does
+ * not call the assignment iterator: it recognizes sensitive key contexts and
+ * YAML block continuations with a separate, intentionally conservative lexer.
+ */
+export function hasConservativeResidualSecret(text) {
+    if (PRIVATE_KEY_BLOCK_PATTERN.test(text)) {
+        return true;
+    }
+    for (const { pattern } of WELL_KNOWN_TOKEN_PATTERNS) {
+        pattern.lastIndex = 0;
+        if (pattern.test(text)) {
+            return true;
+        }
+    }
+    const yaml = analyzeYamlStructuralSecrets(text);
+    if (yaml.unsafeSecretRange) {
+        return true;
+    }
+    if (yaml.parseFailed && hasMalformedYamlSensitiveSecret(text)) {
+        return true;
+    }
+    if (yaml.recognized) {
+        return yaml.matches.some((match) => match.confidence === "high");
+    }
+    const js = analyzeJsStructuralSecrets(text, false);
+    if (js.unsafeSensitiveContext ||
+        js.matches.some((match) => match.confidence === "high")) {
+        return true;
+    }
+    return [...iterateAssignmentSecrets(text)].some((match) => match.confidence === "high");
+}
+export function hasDisallowedSecretMaterial(text, allowSecrets) {
+    if (allowSecrets === true) {
+        return false;
+    }
+    return hasHighConfidenceSecret(text) || hasConservativeResidualSecret(text);
+}
+export function assertNoHighConfidenceSecretsInTask(task) {
+    if (!hasDisallowedSecretMaterial(task, false)) {
         return;
     }
-    const provenances = findings.map((finding) => finding.provenance).join(", ");
+    const findings = scanHighConfidenceSecretContent(task);
+    const provenances = findings.length === 0
+        ? "residual_secret"
+        : findings.map((finding) => finding.provenance).join(", ");
     throw new InvalidParamsError(`context_builder task contains high-confidence secret material (${provenances})`);
 }
+export function assertTaskSecretsGated(task, allowSecrets) {
+    if (hasDisallowedSecretMaterial(task, allowSecrets)) {
+        assertNoHighConfidenceSecretsInTask(task);
+    }
+}
+export function resolveAllowSecrets(explicit) {
+    if (typeof explicit === "boolean") {
+        return explicit;
+    }
+    const raw = process.env.CLINKX_CONTEXT_ALLOW_SECRETS;
+    if (raw == null) {
+        return true;
+    }
+    const value = raw.trim().toLowerCase();
+    if (value === "") {
+        return true;
+    }
+    if (value === "false" || value === "0" || value === "no" || value === "off") {
+        return false;
+    }
+    if (value === "true" || value === "1" || value === "yes" || value === "on") {
+        return true;
+    }
+    throw new InvalidParamsError("CLINKX_CONTEXT_ALLOW_SECRETS must be one of true/false/1/0/yes/no/on/off (case-insensitive)");
+}
 export function hasHighConfidenceSecret(text) {
     return scanHighConfidenceSecretContent(text).length > 0;
 }
@@ -157,9 +253,86 @@ function findPatternLine(text, pattern) {
     return undefined;
 }
 function looksLikeCodeExpression(value) {
-    return (/^[A-Za-z_][A-Za-z0-9_:.]*\([^"'`]*\)$/.test(value) ||
-        /^[A-Za-z_][A-Za-z0-9_]*\.[A-Za-z_][A-Za-z0-9_.]*$/.test(value) ||
-        /^[A-Za-z_][A-Za-z0-9_]*_[A-Za-z0-9_]*$/.test(value));
+    const expression = unwrapReferenceExpression(value);
+    const plainReference = /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(expression);
+    const explicitlyNamedReference = /(?:reference|ref|source|provider)[0-9]*$/i.test(expression);
+    const memberReference = /^[A-Za-z_$][A-Za-z0-9_$]*(?:(?:::|\.)[A-Za-z_$][A-Za-z0-9_$]*)+$/.test(expression);
+    return (looksLikeTsTypeExpression(expression) ||
+        /^[A-Za-z_$][A-Za-z0-9_$]*(?:(?:::|\.)[A-Za-z_$][A-Za-z0-9_$]*)*\([^"'`\r\n]*\)$/.test(expression) ||
+        (plainReference &&
+            !SENSITIVE_ASSIGNMENT_KEY_PATTERN.test(expression) &&
+            (explicitlyNamedReference ||
+                !isHighConfidenceAssignedSecret(expression))) ||
+        (memberReference && !looksLikeCredentialShapedDottedLiteral(expression)) ||
+        (/^[A-Za-z_$][A-Za-z0-9_$]*(?:(?:\?\.|\.)[A-Za-z_$][A-Za-z0-9_$]*(?:\([^"'`\r\n]*\))?|\[[A-Za-z_$][A-Za-z0-9_$]*\])+(?:\?\.[A-Za-z_$][A-Za-z0-9_$]*\([^"'`\r\n]*\))*$/.test(expression) && !looksLikeCredentialShapedDottedLiteral(expression)) ||
+        /^[A-Za-z_$][A-Za-z0-9_$]*(?:(?:\?\.|\.)[A-Za-z_$][A-Za-z0-9_$]*(?:\([^"'`\r\n]*\))?|\[[A-Za-z_$][A-Za-z0-9_$]*\])*(?:\?\.[A-Za-z_$][A-Za-z0-9_$]*\([^"'`\r\n]*\))*\s*(?:\?\?|\|\|)\s*(?:["']{2}|undefined|null);?$/.test(expression) ||
+        /^(?:\$\{[A-Za-z_][A-Za-z0-9_]*(?::-[^}\r\n]*)?\}|\$[A-Za-z_][A-Za-z0-9_]*)$/.test(expression));
+}
+function looksLikeTsTypeExpression(value, allowNamedType = false) {
+    const type = value.trim().replace(/;\s*$/, "").trim();
+    if (type.length === 0 ||
+        /["'`=]/.test(type) ||
+        classifyTsTypeAnnotation(type) !== "valid") {
+        return false;
+    }
+    return (/\b(?:any|bigint|boolean|never|null|number|object|string|symbol|undefined|unknown|void)\b/.test(type) ||
+        /\b(?:keyof|readonly|typeof)\b/.test(type) ||
+        /[<>{}\[\]|&?]/.test(type) ||
+        (allowNamedType &&
+            /^[A-Za-z_$][A-Za-z0-9_$]*(?:(?:\.|::)[A-Za-z_$][A-Za-z0-9_$]*)*$/.test(type)));
+}
+function unwrapReferenceExpression(value) {
+    let expression = value.trim();
+    for (let count = 0; count < 16; count++) {
+        const before = expression;
+        expression = expression
+            .replace(/\s+(?:as|satisfies)\s+(?:const|[A-Za-z_$][A-Za-z0-9_$]*(?:\s*<[^<>\r\n]+>)?)$/, "")
+            .trim();
+        if (hasBalancedOuterParentheses(expression)) {
+            expression = expression.slice(1, -1).trim();
+        }
+        expression = expression
+            .replace(/^<[A-Za-z_$][A-Za-z0-9_$]*(?:<[^<>\r\n]+>)?>\s*/, "")
+            .trim();
+        if (expression === before) {
+            break;
+        }
+    }
+    return expression;
+}
+function hasBalancedOuterParentheses(value) {
+    if (!value.startsWith("(") || !value.endsWith(")")) {
+        return false;
+    }
+    let depth = 0;
+    for (let index = 0; index < value.length; index++) {
+        if (value[index] === "(") {
+            depth++;
+        }
+        else if (value[index] === ")") {
+            depth--;
+            if (depth === 0 && index < value.length - 1) {
+                return false;
+            }
+            if (depth < 0) {
+                return false;
+            }
+        }
+    }
+    return depth === 0;
+}
+function looksLikeCredentialShapedDottedLiteral(value) {
+    const segments = value.split(".");
+    if (segments.length < 2) {
+        return false;
+    }
+    if (/^(?:sk|pk|rk|pat)$/i.test(segments[0] ?? "")) {
+        return true;
+    }
+    const terminal = segments.at(-1) ?? "";
+    return (terminal.length >= 16 &&
+        !terminal.includes("_") &&
+        isHighConfidenceAssignedSecret(terminal));
 }
 function isHighConfidenceAssignedSecret(value) {
     const normalized = value.trim().toLowerCase();
@@ -169,6 +342,12 @@ function isHighConfidenceAssignedSecret(value) {
     if (PLACEHOLDER_VALUES.has(normalized)) {
         return false;
     }
+    if (normalized === REDACTION_MARKER) {
+        return false;
+    }
+    if (normalized === REDACTION_MARKER.slice(1, -1)) {
+        return false;
+    }
     if (/^(?:x+|\*+|0+|1+|a+)$/.test(normalized)) {
         return false;
     }
@@ -177,24 +356,1274 @@ function isHighConfidenceAssignedSecret(value) {
     }
     return shannonEntropy(value) >= 3;
 }
-function redactAssignmentSecretLine(line) {
-    const match = ASSIGNMENT_PATTERN.exec(line);
-    if (match == null) {
-        return line;
+function isSensitiveDecodedKey(value) {
+    const key = value.trim();
+    const terminal = key.split(".").at(-1) ?? key;
+    return [key, terminal].some((candidate) => /^[A-Za-z_$][A-Za-z0-9_$-]*$/.test(candidate) &&
+        SENSITIVE_ASSIGNMENT_KEY_PATTERN.test(candidate));
+}
+function isRedactionMarkerValue(value) {
+    const normalized = value.trim();
+    return (normalized.length > 0 &&
+        (normalized.replaceAll(REDACTION_MARKER, "").trim().length === 0 ||
+            normalized
+                .replaceAll(REDACTION_MARKER.slice(1, -1), "")
+                .trim().length === 0));
+}
+function analyzeYamlStructuralSecrets(text) {
+    if (text.length > MAX_YAML_SOURCE_CHARS) {
+        return { ...emptyYamlStructuralAnalysis(), recognized: true, exhausted: true };
+    }
+    let documents;
+    try {
+        documents = parseAllDocuments(text, {
+            prettyErrors: false,
+            strict: false,
+            uniqueKeys: false,
+        });
     }
-    const value = match[3] ?? "";
-    const quote = match[2] ?? "";
-    if (quote.length === 0 && looksLikeCodeExpression(value)) {
-        return line;
+    catch {
+        return { ...emptyYamlStructuralAnalysis(), parseFailed: true };
     }
-    if (!isHighConfidenceAssignedSecret(value)) {
-        return line;
+    if (documents.some((document) => document.errors.length > 0)) {
+        return {
+            ...emptyYamlStructuralAnalysis(),
+            parseFailed: true,
+        };
     }
-    const valueStart = match.index + match[0].lastIndexOf(value);
-    if (valueStart < match.index) {
-        return line;
+    if (documents.length === 0 || documents.length > MAX_YAML_DOCUMENTS) {
+        return {
+            ...emptyYamlStructuralAnalysis(),
+            exhausted: documents.length > MAX_YAML_DOCUMENTS,
+        };
+    }
+    const collectionDocument = documents.some((document) => isMap(document.contents) || isSeq(document.contents));
+    if (!collectionDocument) {
+        return emptyYamlStructuralAnalysis();
+    }
+    const analysis = {
+        recognized: false,
+        exhausted: false,
+        unsafeSecretRange: false,
+        parseFailed: false,
+        matches: [],
+    };
+    let hasSensitiveKey = false;
+    let nodesSeen = 0;
+    let currentDocument = documents[0];
+    const resolveMappingKeyScalar = (node) => {
+        let current = node;
+        const active = new Set();
+        for (let depth = 0; depth <= MAX_YAML_DEPTH; depth++) {
+            if (current == null || ++nodesSeen > MAX_YAML_NODES) {
+                analysis.exhausted = true;
+                return undefined;
+            }
+            if (isScalar(current)) {
+                return current;
+            }
+            if (!isAlias(current) || active.has(current) || currentDocument == null) {
+                analysis.exhausted = true;
+                return undefined;
+            }
+            active.add(current);
+            current = current.resolve(currentDocument);
+        }
+        analysis.exhausted = true;
+        return undefined;
+    };
+    const visit = (node, sensitiveAncestor, depth, unsafeScalarRange) => {
+        if (node == null || analysis.exhausted) {
+            return;
+        }
+        nodesSeen++;
+        if (nodesSeen > MAX_YAML_NODES || depth > MAX_YAML_DEPTH) {
+            analysis.exhausted = true;
+            return;
+        }
+        if (isMap(node)) {
+            for (const pair of node.items) {
+                const pairKey = pair.key;
+                if (sensitiveAncestor) {
+                    visit(pairKey, true, depth + 1, false);
+                }
+                const keyNode = isScalar(pairKey)
+                    ? pairKey
+                    : isAlias(pairKey)
+                        ? resolveMappingKeyScalar(pairKey)
+                        : undefined;
+                if (isAlias(pairKey) && keyNode == null) {
+                    return;
+                }
+                const decodedKey = isScalar(keyNode)
+                    ? String(keyNode.value ?? "")
+                    : undefined;
+                const sensitiveKey = decodedKey != null && isSensitiveDecodedKey(decodedKey);
+                hasSensitiveKey ||= sensitiveKey;
+                const pairValue = pair.value;
+                const keyEnd = pairKey?.range?.[1];
+                const valueStart = pairValue?.range?.[0];
+                const valueGap = keyEnd == null || valueStart == null
+                    ? ""
+                    : text.slice(keyEnd, valueStart);
+                if (sensitiveKey &&
+                    (valueGap.match(/\n/g)?.length ?? 0) > 256) {
+                    if (isScalar(pairValue)) {
+                        visit(pairValue, true, depth + 1, true);
+                    }
+                    analysis.exhausted = true;
+                    return;
+                }
+                visit(pairValue, sensitiveAncestor || sensitiveKey, depth + 1, sensitiveKey &&
+                    isScalar(pairValue) &&
+                    pairValue.type === "PLAIN" &&
+                    /\r|\n/.test(valueGap));
+            }
+            return;
+        }
+        if (isSeq(node)) {
+            for (const item of node.items) {
+                visit(item, sensitiveAncestor, depth + 1, false);
+            }
+            return;
+        }
+        if (!sensitiveAncestor) {
+            return;
+        }
+        if (isAlias(node)) {
+            if (currentDocument == null) {
+                analysis.exhausted = true;
+                return;
+            }
+            const referenceStatus = yamlReferenceTreeStatus(node, currentDocument);
+            if (referenceStatus === "safe") {
+                return;
+            }
+            if (referenceStatus === "secret") {
+                analysis.unsafeSecretRange = true;
+            }
+            else {
+                analysis.exhausted = true;
+            }
+            return;
+        }
+        if (!isScalar(node)) {
+            return;
+        }
+        let value;
+        if (typeof node.value === "string") {
+            value = node.value;
+        }
+        else if (node.value instanceof Uint8Array) {
+            const decoded = new TextDecoder("utf-8", { fatal: false }).decode(node.value);
+            const encoded = typeof node.source === "string" ? node.source : "";
+            value = isHighConfidenceAssignedSecret(decoded) ? decoded : encoded;
+        }
+        else if (node.value == null ||
+            typeof node.value === "number" ||
+            typeof node.value === "boolean") {
+            return;
+        }
+        else {
+            analysis.exhausted = true;
+            return;
+        }
+        if (isRedactionMarkerValue(value) ||
+            (node.type === "PLAIN" && looksLikeCodeExpression(value.trim())) ||
+            !isHighConfidenceAssignedSecret(value)) {
+            return;
+        }
+        const range = node.range;
+        const valueStart = range?.[0];
+        const valueEnd = range?.[1];
+        if (valueStart == null ||
+            valueEnd == null ||
+            valueStart < 0 ||
+            valueEnd <= valueStart ||
+            valueEnd > text.length) {
+            analysis.unsafeSecretRange = true;
+            return;
+        }
+        if (unsafeScalarRange) {
+            analysis.unsafeSecretRange = true;
+            return;
+        }
+        analysis.matches.push({
+            keyStart: valueStart,
+            keyEnd: valueStart,
+            valueStart,
+            valueEnd,
+            line: lineNumberAtOffset(text, valueStart),
+            confidence: "high",
+            replacement: redactYamlScalarSource(text.slice(valueStart, valueEnd)),
+        });
+    };
+    for (const document of documents) {
+        currentDocument = document;
+        visit(document.contents, false, 0, false);
+    }
+    analysis.recognized = hasSensitiveKey;
+    return analysis;
+}
+function yamlReferenceTreeStatus(node, document) {
+    const active = new Set();
+    const memoizedSafe = new Set();
+    let remaining = MAX_YAML_NODES;
+    const visit = (current, depth) => {
+        if (current == null || depth > MAX_YAML_DEPTH) {
+            return "incomplete";
+        }
+        if (memoizedSafe.has(current)) {
+            return "safe";
+        }
+        if (--remaining < 0 || active.has(current)) {
+            return "incomplete";
+        }
+        active.add(current);
+        let status;
+        if (isAlias(current)) {
+            const resolved = current.resolve(document);
+            status = visit(resolved, depth + 1);
+        }
+        else if (isSeq(current)) {
+            status = combineYamlReferenceStatuses(current.items.map((item) => visit(item, depth + 1)));
+        }
+        else if (isMap(current)) {
+            status = combineYamlReferenceStatuses(current.items.flatMap((pair) => [
+                visit(pair.key, depth + 1),
+                visit(pair.value, depth + 1),
+            ]));
+        }
+        else if (!isScalar(current)) {
+            status = "incomplete";
+        }
+        else if (current.value == null ||
+            typeof current.value === "number" ||
+            typeof current.value === "boolean") {
+            status = "safe";
+        }
+        else if (current.value instanceof Uint8Array) {
+            const decoded = new TextDecoder("utf-8", { fatal: false }).decode(current.value);
+            const encoded = typeof current.source === "string" ? current.source : "";
+            status = isHighConfidenceAssignedSecret(decoded) ||
+                isHighConfidenceAssignedSecret(encoded)
+                ? "secret"
+                : "safe";
+        }
+        else if (typeof current.value !== "string") {
+            status = "incomplete";
+        }
+        else {
+            const safe = isRedactionMarkerValue(current.value) ||
+                !isHighConfidenceAssignedSecret(current.value) ||
+                (current.type === "PLAIN" &&
+                    looksLikeCodeExpression(current.value.trim()));
+            status = safe ? "safe" : "secret";
+        }
+        active.delete(current);
+        if (status === "safe") {
+            memoizedSafe.add(current);
+        }
+        return status;
+    };
+    return visit(node, 0);
+}
+function combineYamlReferenceStatuses(statuses) {
+    if (statuses.includes("secret")) {
+        return "secret";
+    }
+    return statuses.includes("incomplete") ? "incomplete" : "safe";
+}
+function emptyYamlStructuralAnalysis() {
+    return {
+        recognized: false,
+        exhausted: false,
+        parseFailed: false,
+        unsafeSecretRange: false,
+        matches: [],
+    };
+}
+function hasMalformedYamlSensitiveSecret(text) {
+    // Valid TypeScript class fields are not YAML merely because a nested type
+    // property has a sensitive name. Remove only declarations whose bounded RHS
+    // is an unambiguous reference; literal/object RHS values remain visible to
+    // the fail-closed malformed-content check below.
+    const withoutSafeTypedFields = maskConfidentlySafeTypeOnlyFields(maskConfidentlySafeTypedFields(text));
+    for (const valueStart of malformedYamlSensitiveValueStarts(withoutSafeTypedFields)) {
+        const span = malformedYamlValueSpan(withoutSafeTypedFields, valueStart);
+        const expression = span.trim().replace(/,$/, "").trim();
+        if (looksLikeCodeExpression(expression)) {
+            continue;
+        }
+        if (spanContainsHighEntropyLiteral(span)) {
+            return true;
+        }
+    }
+    return false;
+}
+function malformedYamlValueSpan(text, valueStart) {
+    const firstLineEnd = lineEndIndex(text, valueStart);
+    const firstLine = text.slice(valueStart, firstLineEnd);
+    const firstValue = firstLine.replace(/^[ \t]*/, "");
+    const continues = firstValue.length === 0 ||
+        firstValue.startsWith("#") ||
+        new RegExp(`^(?:&[A-Za-z0-9_.-]+[ \\t]+|!!?[^ \\t\\r\\n]+[ \\t]+|!<[^>\\r\\n]+>[ \\t]+)*${YAML_BLOCK_HEADER_PATTERN_SOURCE}(?:[ \\t]+#.*)?$`).test(firstValue);
+    if (!continues) {
+        return firstLine;
+    }
+    const keyLineStart = text.lastIndexOf("\n", valueStart - 1) + 1;
+    const keyIndent = leadingIndentWidth(text.slice(keyLineStart, valueStart));
+    let cursor = firstLineEnd;
+    let end = firstLineEnd;
+    let lines = 0;
+    while (cursor < text.length && lines <= 512 && cursor - valueStart < 32_768) {
+        const newlineLength = text.startsWith("\r\n", cursor)
+            ? 2
+            : text[cursor] === "\n"
+                ? 1
+                : 0;
+        if (newlineLength === 0) {
+            break;
+        }
+        const lineStart = cursor + newlineLength;
+        const lineEnd = lineEndIndex(text, lineStart);
+        const line = text.slice(lineStart, lineEnd);
+        if (line.trim().length > 0 && leadingIndentWidth(line) <= keyIndent) {
+            break;
+        }
+        end = lineEnd;
+        cursor = lineEnd;
+        lines++;
+    }
+    return text.slice(valueStart, end);
+}
+function maskConfidentlySafeTypeOnlyFields(text) {
+    const typeOnlyField = /(^|[;{}\r\n])([ \t]*(?:(?:public|private|protected|static|readonly|declare|abstract|override)[ \t]+)*[A-Za-z_$][A-Za-z0-9_$-]*(?:[?!])?[ \t]*:[ \t]*)([\s\S]{1,4096}?);/gm;
+    return text.replace(typeOnlyField, (whole, boundary, _prefix, type, offset) => {
+        if (!isInsideBoundedTypeBody(text, offset + boundary.length) ||
+            !looksLikeTsTypeExpression(type, true)) {
+            return whole;
+        }
+        return `${boundary}${whole.slice(boundary.length).replace(/[^\r\n]/g, " ")}`;
+    });
+}
+function maskConfidentlySafeTypedFields(text) {
+    const masked = maskJsCommentTrivia(text);
+    const safeSpans = [];
+    let quote;
+    let escaped = false;
+    for (let equalsAt = 0; equalsAt < masked.length; equalsAt++) {
+        const character = masked[equalsAt] ?? "";
+        if (quote != null) {
+            if (!escaped && character === quote) {
+                quote = undefined;
+            }
+            escaped = !escaped && character === "\\";
+            continue;
+        }
+        if (character === '"' || character === "'" || character === "`") {
+            quote = character;
+            escaped = false;
+            continue;
+        }
+        if (character !== "=" ||
+            /[=!<>]/.test(masked[equalsAt - 1] ?? "") ||
+            /[=>]/.test(masked[equalsAt + 1] ?? "")) {
+            continue;
+        }
+        const windowStart = Math.max(0, equalsAt - MAX_JS_KEY_LOOKBACK);
+        const field = findBoundedTypedField(masked.slice(windowStart, equalsAt), windowStart);
+        if (field == null || field === "exhausted") {
+            continue;
+        }
+        const rhs = residualJsValueSpan(text, masked, equalsAt + 1);
+        if (rhs.exhausted) {
+            continue;
+        }
+        const value = reconstructStaticJsValue(rhs.content)?.trim();
+        if (value == null || !isSafeTypedFieldReference(rhs.content, value)) {
+            continue;
+        }
+        safeSpans.push({
+            start: field.start,
+            end: equalsAt + 1 + rhs.content.length,
+        });
+    }
+    if (safeSpans.length === 0) {
+        return text;
+    }
+    // Parser/lexer ranges are UTF-16 offsets, so preserve code-unit indexing.
+    const characters = text.split("");
+    for (const span of safeSpans) {
+        for (let index = span.start; index < span.end; index++) {
+            if (characters[index] !== "\n" && characters[index] !== "\r") {
+                characters[index] = " ";
+            }
+        }
+    }
+    return characters.join("");
+}
+function isSafeTypedFieldReference(source, value) {
+    const expression = unwrapReferenceExpression(value);
+    const sourceExpression = unwrapReferenceExpression(maskJsCommentTrivia(source));
+    const staticEnvReference = /^(?:process\.env\[["'][A-Za-z_][A-Za-z0-9_]*["']\]|Deno\.env\.get\(["'][A-Za-z_][A-Za-z0-9_]*["']\))$/.test(sourceExpression);
+    return (staticEnvReference ||
+        (!/["'`]/.test(maskJsCommentTrivia(source)) &&
+            (looksLikeCodeExpression(expression) ||
+                /^keyof\s+typeof\s+[A-Za-z_$][A-Za-z0-9_$]*(?:(?:\.|::)[A-Za-z_$][A-Za-z0-9_$]*)*$/.test(expression))));
+}
+function malformedYamlSensitiveValueStarts(text) {
+    const starts = [];
+    const keyToken = String.raw `[A-Za-z_$][A-Za-z0-9_$-]*(?:\.[A-Za-z_$][A-Za-z0-9_$-]*)*`;
+    for (const match of text.matchAll(/^[ \t]*(["'])((?:\\.|(?!\1)[^\r\n])*)\1[ \t]*:/gm)) {
+        const decoded = match[1] === '"'
+            ? decodeJsString(match[2] ?? "")
+            : (match[2] ?? "").replaceAll("''", "'");
+        if (decoded != null && isSensitiveDecodedKey(decoded)) {
+            starts.push((match.index ?? 0) + match[0].length);
+        }
+    }
+    for (const match of text.matchAll(new RegExp(String.raw `^[ \t]*(${keyToken})[ \t]*:`, "gm"))) {
+        if (isSensitiveDecodedKey(match[1] ?? "")) {
+            starts.push((match.index ?? 0) + match[0].length);
+        }
+    }
+    const sensitiveAliases = new Set();
+    for (const match of text.matchAll(new RegExp(String.raw `&([A-Za-z0-9_.-]+)(?:[ \t]+(?:!!?[^ \t\r\n]+|!<[^>\r\n]+>))*[ \t]+(${keyToken})`, "g"))) {
+        if (isSensitiveDecodedKey(match[2] ?? "")) {
+            sensitiveAliases.add(match[1] ?? "");
+        }
+    }
+    const explicitKey = new RegExp(String.raw `^[ \t]*\?[ \t]+(?:(${keyToken})|\*([A-Za-z0-9_.-]+))[ \t]*(?:\r?\n)[ \t]*:`, "gm");
+    for (const match of text.matchAll(explicitKey)) {
+        if (isSensitiveDecodedKey(match[1] ?? "") ||
+            sensitiveAliases.has(match[2] ?? "")) {
+            starts.push((match.index ?? 0) + match[0].length);
+        }
+    }
+    return starts;
+}
+function redactYamlScalarSource(source) {
+    if (!/\r|\n/.test(source)) {
+        const leading = /^[ \t]*/.exec(source)?.[0] ?? "";
+        const trailing = /[ \t]*$/.exec(source)?.[0] ?? "";
+        const body = source.slice(leading.length, source.length - trailing.length);
+        const quote = body[0] === '"' || body[0] === "'" ? body[0] : undefined;
+        return `${leading}${quote ?? ""}${REDACTION_MARKER}${quote ?? ""}${trailing}`;
+    }
+    const firstLineEnd = lineEndIndex(source, 0);
+    const firstLine = source.slice(0, firstLineEnd);
+    if (new RegExp(`^[ \\t]*${YAML_BLOCK_HEADER_PATTERN_SOURCE}(?:[ \\t]+#.*)?$`).test(firstLine)) {
+        const newlineLength = source.startsWith("\r\n", firstLineEnd) ? 2 : 1;
+        return `${source.slice(0, firstLineEnd + newlineLength)}${redactYamlBlockPayload(source.slice(firstLineEnd + newlineLength))}`;
+    }
+    const trimmed = source.trim();
+    const quote = trimmed[0] === '"' || trimmed[0] === "'" ? trimmed[0] : undefined;
+    if (quote != null && trimmed.endsWith(quote)) {
+        const leading = /^[ \t]*/.exec(source)?.[0] ?? "";
+        const lineBreaks = source.match(/\r\n|\n/g) ?? [];
+        return `${leading}${quote}${REDACTION_MARKER}${quote}${lineBreaks.join("")}`;
+    }
+    return redactYamlBlockPayload(source);
+}
+function lineNumberAtOffset(text, offset) {
+    let line = 1;
+    for (let index = 0; index < offset; index++) {
+        if (text[index] === "\n") {
+            line++;
+        }
+    }
+    return line;
+}
+function analyzeJsStructuralSecrets(text, primaryRedaction = true) {
+    const masked = maskJsCommentTrivia(text);
+    const matches = [];
+    let unsafeSensitiveContext = false;
+    let quote;
+    let escaped = false;
+    let scanned = 0;
+    for (let cursor = 0; cursor < masked.length; cursor++) {
+        if (++scanned > 1_000_000) {
+            return { exhausted: true, unsafeSensitiveContext, matches };
+        }
+        const character = masked[cursor] ?? "";
+        if (quote != null) {
+            if (!escaped && character === quote) {
+                quote = undefined;
+            }
+            escaped = !escaped && character === "\\";
+            continue;
+        }
+        if (character === '"' || character === "'" || character === "`") {
+            quote = character;
+            escaped = false;
+            continue;
+        }
+        if (character !== "=" ||
+            /[=!<>]/.test(masked[cursor - 1] ?? "") ||
+            /[=>]/.test(masked[cursor + 1] ?? "")) {
+            continue;
+        }
+        const key = sensitiveJsKeyBefore(text, masked, cursor);
+        if (key === "exhausted") {
+            const span = residualJsValueSpan(text, masked, cursor + 1);
+            unsafeSensitiveContext ||=
+                hasExhaustedSensitiveJsKeyEvidence(masked, cursor) &&
+                    spanContainsHighEntropyLiteral(text.slice(cursor + 1));
+            return { exhausted: true, unsafeSensitiveContext, matches };
+        }
+        if (key == null) {
+            if (hasUnclassifiableSensitiveJsKey(text, masked, cursor)) {
+                const span = residualJsValueSpan(text, masked, cursor + 1);
+                if (span.exhausted) {
+                    unsafeSensitiveContext ||= spanContainsHighEntropyLiteral(text.slice(cursor + 1));
+                    return { exhausted: true, unsafeSensitiveContext, matches };
+                }
+                const unsafe = spanContainsHighEntropyLiteral(span.content);
+                unsafeSensitiveContext ||= unsafe;
+            }
+            continue;
+        }
+        if (primaryRedaction &&
+            /\/\*|\/\/|\r|\n/.test(text.slice(key.end, cursor))) {
+            continue;
+        }
+        const span = residualJsValueSpan(text, masked, cursor + 1);
+        if (span.exhausted) {
+            unsafeSensitiveContext ||= spanContainsHighEntropyLiteral(text.slice(cursor + 1));
+            return { exhausted: true, unsafeSensitiveContext, matches };
+        }
+        const reconstructed = reconstructStaticJsValue(span.content);
+        const containsLiteral = /["'`]/.test(maskJsCommentTrivia(span.content));
+        if (looksLikeCodeExpression(span.content.trim())) {
+            continue;
+        }
+        const typedFieldWindowStart = Math.max(0, cursor - MAX_JS_KEY_LOOKBACK);
+        const typedField = findBoundedTypedField(masked.slice(typedFieldWindowStart, cursor), typedFieldWindowStart);
+        const safeTypedReference = typedField != null &&
+            typedField !== "exhausted" &&
+            reconstructed != null &&
+            isSafeTypedFieldReference(span.content, reconstructed.trim());
+        if (safeTypedReference) {
+            continue;
+        }
+        if (reconstructed == null) {
+            const unsafe = spanContainsHighEntropyLiteral(span.content);
+            unsafeSensitiveContext ||= unsafe;
+            continue;
+        }
+        if ((!containsLiteral && looksLikeCodeExpression(reconstructed.trim())) ||
+            !isHighConfidenceAssignedSecret(reconstructed)) {
+            continue;
+        }
+        const valueStart = cursor + 1;
+        const valueEnd = valueStart + span.content.length;
+        matches.push({
+            keyStart: key.start,
+            keyEnd: key.end,
+            valueStart,
+            valueEnd,
+            line: lineNumberAtOffset(text, key.start),
+            confidence: "high",
+            replacement: redactJsExpressionSource(span.content),
+        });
+        cursor = Math.max(cursor, valueEnd - 1);
+    }
+    return { exhausted: false, unsafeSensitiveContext, matches };
+}
+function hasExhaustedSensitiveJsKeyEvidence(masked, equalsAt) {
+    const prefix = masked.slice(0, equalsAt);
+    const keyPattern = /(?:^|[;{}])[ \t\r\n]*(?:(?:public|private|protected|static|readonly|declare|abstract|override)[ \t\r\n]+)*(?:password|passwd|api[_-]?key|secret|token|access[_-]?token|private[_-]?key|client[_-]?secret)\b/gi;
+    let lastMatch = null;
+    for (const match of prefix.matchAll(keyPattern)) {
+        lastMatch = match;
+    }
+    if (lastMatch == null) {
+        return false;
+    }
+    const suffix = prefix.slice((lastMatch.index ?? 0) + lastMatch[0].length);
+    return !suffix.includes(";");
+}
+function hasUnclassifiableSensitiveJsKey(text, masked, equalsAt) {
+    const start = Math.max(0, equalsAt - 2_048);
+    const prefix = text.slice(start, equalsAt);
+    const maskedPrefix = masked.slice(start, equalsAt);
+    const bracket = /\[[^\]\r\n]{0,384}\]\s*(?:\|\||\?\?|\+)?\s*$/.exec(maskedPrefix);
+    if (bracket != null) {
+        const rawBracket = prefix.slice(bracket.index ?? 0);
+        for (const match of rawBracket.matchAll(/(["'])((?:\\.|(?!\1)[^\r\n])*)\1/g)) {
+            const decoded = decodeJsString(match[2] ?? "");
+            if (decoded != null && isSensitiveDecodedKey(decoded)) {
+                return true;
+            }
+        }
+    }
+    return new RegExp(String.raw `(?:^|[;\r\n])[ \t]*(?:const|let|var)?[ \t]*(?:password|passwd|api[_-]?key|secret|token|access[_-]?token|private[_-]?key|client[_-]?secret)[ \t]*(?:\|\||\?\?|\+)[ \t]*$`, "i").test(maskedPrefix);
+}
+function spanContainsHighEntropyLiteral(span) {
+    for (const match of span.matchAll(/(["'`])((?:\\.|(?!\1)[\s\S])*)\1/g)) {
+        const encoded = match[2] ?? "";
+        const literal = match[1] === "`" ? encoded : decodeJsString(encoded) ?? encoded;
+        if (isHighConfidenceAssignedSecret(literal) ||
+            [...literal.matchAll(/[A-Za-z0-9_./+=-]{16,}/g)].some((part) => isHighConfidenceAssignedSecret(part[0]))) {
+            return true;
+        }
+    }
+    const withoutComments = maskJsCommentTrivia(span)
+        .split(/\r?\n/)
+        .map((line) => line.replace(/(?:^|[ \t])#.*$/, ""))
+        .join("\n");
+    for (const line of withoutComments.split(/\r?\n/)) {
+        const candidate = line
+            .trim()
+            .replace(/^:[ \t]*/, "")
+            .replace(/^["']/, "")
+            .replace(/["']$/, "")
+            .trim();
+        if (!isRedactionMarkerValue(candidate) &&
+            !candidate.includes(REDACTION_MARKER) &&
+            !new RegExp(String.raw `:\s*${YAML_BLOCK_HEADER_PATTERN_SOURCE}(?:\s+#.*)?$`).test(candidate) &&
+            !looksLikeCodeExpression(candidate) &&
+            isHighConfidenceAssignedSecret(candidate)) {
+            return true;
+        }
+    }
+    return [...withoutComments.matchAll(/[A-Za-z0-9_./+=-]{16,}/g)].some((match) => !looksLikeCodeExpression(match[0]) &&
+        isHighConfidenceAssignedSecret(match[0]));
+}
+function sensitiveJsKeyBefore(text, masked, equalsAt) {
+    const windowStart = Math.max(0, equalsAt - MAX_JS_KEY_LOOKBACK);
+    const prefix = masked.slice(windowStart, equalsAt);
+    const typedField = findSensitiveTypedField(prefix, windowStart);
+    if (typedField != null) {
+        return typedField;
+    }
+    const bracket = /\[\s*(["'])((?:\\.|(?!\1)[^\r\n])*)\1\s*\]\s*$/.exec(prefix);
+    if (bracket != null) {
+        const encoded = bracket[2] ?? "";
+        const decoded = decodeJsString(encoded);
+        if (decoded != null && isSensitiveDecodedKey(decoded)) {
+            const encodedOffset = bracket[0].indexOf(encoded);
+            const start = windowStart + (bracket.index ?? 0) + encodedOffset;
+            return { start, end: start + encoded.length };
+        }
+    }
+    const quoted = /(["'])((?:\\.|(?!\1)[^\r\n])*)\1\s*$/.exec(prefix);
+    if (quoted != null) {
+        const encoded = quoted[2] ?? "";
+        const decoded = decodeJsString(encoded);
+        if (decoded != null && isSensitiveDecodedKey(decoded)) {
+            const encodedOffset = quoted[0].indexOf(encoded);
+            const start = windowStart + (quoted.index ?? 0) + encodedOffset;
+            return { start, end: start + encoded.length };
+        }
+    }
+    const bare = /([A-Za-z_$][A-Za-z0-9_$-]*)\s*$/.exec(prefix);
+    const rawKey = bare?.[1];
+    if (rawKey == null) {
+        if (windowStart > 0) {
+            return "exhausted";
+        }
+        return undefined;
+    }
+    if (!isSensitiveDecodedKey(rawKey)) {
+        if (windowStart > 0) {
+            const beforeKey = prefix
+                .slice(0, bare?.index ?? 0)
+                .trimEnd()
+                .at(-1);
+            if (beforeKey != null && !/[;{}\r\n]/.test(beforeKey)) {
+                return "exhausted";
+            }
+        }
+        return undefined;
+    }
+    const start = windowStart + (bare?.index ?? 0);
+    return { start, end: start + rawKey.length };
+}
+function classifyTsTypeAnnotation(value) {
+    const type = value.trim();
+    if (type.length === 0) {
+        return "unclassifiable";
+    }
+    const pairs = {
+        "<": ">",
+        "[": "]",
+        "{": "}",
+        "(": ")",
+    };
+    const closers = new Set(Object.values(pairs));
+    const stack = [];
+    for (let index = 0; index < type.length; index++) {
+        const character = type[index] ?? "";
+        if (character === ";" && stack.length === 0) {
+            return "member_boundary";
+        }
+        if (index >= MAX_TS_TYPE_CHARS ||
+            !/[A-Za-z0-9_$.,;<>\[\]{}()|&?:='" \t\r\n-]/.test(character)) {
+            return "unclassifiable";
+        }
+        if (character === ">" && type[index - 1] === "=") {
+            continue;
+        }
+        const closer = pairs[character];
+        if (closer != null) {
+            if (stack.length >= MAX_TS_TYPE_DEPTH) {
+                return "unclassifiable";
+            }
+            stack.push(closer);
+        }
+        else if (closers.has(character) && stack.pop() !== character) {
+            return "nested_candidate";
+        }
+    }
+    return stack.length === 0 ? "valid" : "unclassifiable";
+}
+function findSensitiveTypedField(prefix, absoluteStart) {
+    const field = findBoundedTypedField(prefix, absoluteStart);
+    if (field === "exhausted" || field == null || field.sensitive) {
+        return field === "exhausted" || field == null
+            ? field
+            : { start: field.start, end: field.end };
+    }
+    return undefined;
+}
+function findBoundedTypedField(prefix, absoluteStart) {
+    const pattern = /(?:^|[;{}\r\n])[ \t]*(?:(?:public|private|protected|static|readonly|declare|abstract|override)[ \t]+)*([A-Za-z_$][A-Za-z0-9_$-]*)(?:[?!])?[ \t]*:[ \t]*/g;
+    for (const match of prefix.matchAll(pattern)) {
+        const rawKey = match[1] ?? "";
+        const keyOffset = match[0].lastIndexOf(rawKey);
+        const relativeKeyStart = (match.index ?? 0) + keyOffset;
+        if (!isInsideBoundedTypeBody(prefix, relativeKeyStart)) {
+            continue;
+        }
+        const typeStart = (match.index ?? 0) + match[0].length;
+        const type = prefix.slice(typeStart).trim();
+        const classification = classifyTsTypeAnnotation(type);
+        if (classification === "member_boundary") {
+            continue;
+        }
+        if (classification === "nested_candidate") {
+            continue;
+        }
+        if (classification === "unclassifiable") {
+            return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(rawKey) &&
+                isSensitiveDecodedKey(rawKey)
+                ? "exhausted"
+                : undefined;
+        }
+        // The first candidate whose entire suffix is a balanced type annotation is
+        // the outer field. Nested object-type properties leave unmatched closers.
+        const start = absoluteStart + relativeKeyStart;
+        return {
+            start,
+            end: start + rawKey.length,
+            sensitive: isSensitiveDecodedKey(rawKey),
+        };
+    }
+    return undefined;
+}
+function isInsideBoundedTypeBody(prefix, offset) {
+    const start = Math.max(0, offset - MAX_JS_KEY_LOOKBACK);
+    const before = prefix.slice(start, offset);
+    let classBrace = -1;
+    for (const match of before.matchAll(/\b(?:class|interface|type)\s+[A-Za-z_$][A-Za-z0-9_$]*[^{};]*\{/g)) {
+        classBrace = (match.index ?? 0) + match[0].length - 1;
+    }
+    if (classBrace < 0) {
+        return false;
+    }
+    let depth = 0;
+    for (let index = classBrace; index < before.length; index++) {
+        if (before[index] === "{") {
+            depth++;
+        }
+        else if (before[index] === "}") {
+            depth--;
+            if (depth === 0) {
+                return false;
+            }
+        }
+        if (depth > MAX_TS_TYPE_DEPTH) {
+            return false;
+        }
+    }
+    return depth > 0;
+}
+function findTsFieldAssignmentEquals(text, start, end) {
+    for (let index = start; index < end; index++) {
+        if (text[index] === "=" &&
+            text[index + 1] !== ">" &&
+            !/[=!<>]/.test(text[index - 1] ?? "")) {
+            return index;
+        }
+    }
+    return undefined;
+}
+function decodeJsString(value) {
+    try {
+        return value.replace(/\\(?:u\{([0-9A-Fa-f]{1,6})\}|u([0-9A-Fa-f]{4})|x([0-9A-Fa-f]{2})|([\\"'bfnrtv0]))/g, (_whole, braced, unicode, hex, simple) => {
+            if (braced != null || unicode != null || hex != null) {
+                const point = Number.parseInt(braced ?? unicode ?? hex, 16);
+                return String.fromCodePoint(point);
+            }
+            const escapes = {
+                "\\": "\\",
+                '"': '"',
+                "'": "'",
+                b: "\b",
+                f: "\f",
+                n: "\n",
+                r: "\r",
+                t: "\t",
+                v: "\v",
+                "0": "\0",
+            };
+            return escapes[simple] ?? simple;
+        });
+    }
+    catch {
+        return undefined;
+    }
+}
+function reconstructStaticJsValue(source) {
+    const masked = maskJsCommentTrivia(source);
+    if (!/["'`]/.test(masked)) {
+        return masked.trim();
+    }
+    let cursor = 0;
+    let value = "";
+    let fragments = 0;
+    while (cursor < masked.length) {
+        while (cursor < masked.length && /[\s()+]/.test(masked[cursor] ?? "")) {
+            cursor++;
+        }
+        if (cursor >= masked.length) {
+            break;
+        }
+        const quote = masked[cursor];
+        if (quote !== '"' && quote !== "'" && quote !== "`") {
+            const bare = masked.slice(cursor).trim();
+            return fragments === 0 ? bare : undefined;
+        }
+        cursor++;
+        let encoded = "";
+        let escaped = false;
+        let dynamicTemplate = false;
+        while (cursor < masked.length) {
+            const character = masked[cursor] ?? "";
+            if (!escaped && character === quote) {
+                break;
+            }
+            if (quote === "`" && !escaped && character === "$" && masked[cursor + 1] === "{") {
+                dynamicTemplate = true;
+            }
+            encoded += source[cursor] ?? "";
+            escaped = !escaped && character === "\\";
+            cursor++;
+        }
+        if (masked[cursor] !== quote || dynamicTemplate) {
+            return undefined;
+        }
+        const decoded = decodeJsString(encoded);
+        if (decoded == null) {
+            return undefined;
+        }
+        value += decoded;
+        fragments++;
+        cursor++;
+    }
+    return fragments > 0 ? value : undefined;
+}
+function redactJsExpressionSource(source) {
+    const leading = /^[ \t]*/.exec(source)?.[0] ?? "";
+    const trailing = /[ \t]*$/.exec(source)?.[0] ?? "";
+    const trimmed = source.trim();
+    const single = /^(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')$/.test(trimmed);
+    const quote = single ? trimmed[0] : "";
+    const lineBreaks = source.match(/\r\n|\n/g) ?? [];
+    return `${leading}${quote}${REDACTION_MARKER}${quote}${lineBreaks.join("")}${trailing}`;
+}
+function* iterateAssignmentSecrets(text) {
+    const yaml = analyzeYamlStructuralSecrets(text);
+    if (yaml.recognized && !yaml.exhausted) {
+        yield* yaml.matches;
+    }
+    const js = analyzeJsStructuralSecrets(text, true);
+    if (!js.exhausted) {
+        yield* js.matches;
+    }
+    const commentMasked = maskJsCommentTrivia(text);
+    let line = 1;
+    let lineCursor = 0;
+    const keyPattern = new RegExp(ASSIGNMENT_KEY_PATTERN.source, ASSIGNMENT_KEY_PATTERN.flags);
+    let match;
+    while ((match = keyPattern.exec(commentMasked)) != null) {
+        const matchStart = match.index;
+        for (let index = lineCursor; index < matchStart; index++) {
+            if (text[index] === "\n") {
+                line++;
+            }
+        }
+        lineCursor = matchStart;
+        const bracketKey = match[5];
+        const memberChain = match[6];
+        const key = match[2] ?? bracketKey ?? memberChain?.split(/\s*(?:\.|::)\s*/).at(-1);
+        if (key == null || !SENSITIVE_ASSIGNMENT_KEY_PATTERN.test(key)) {
+            continue;
+        }
+        const quotedKey = match[1] != null;
+        const keyOffset = match[0].lastIndexOf(key);
+        const keyStart = matchStart + (quotedKey ? 1 : keyOffset);
+        const keyEnd = keyStart + key.length;
+        let cursor = matchStart + match[0].length;
+        while (commentMasked[cursor] === " " || commentMasked[cursor] === "\t") {
+            cursor++;
+        }
+        if (commentMasked[cursor] !== ":" && commentMasked[cursor] !== "=") {
+            continue;
+        }
+        const delimiter = commentMasked[cursor];
+        if (delimiter === "=" && !js.exhausted) {
+            continue;
+        }
+        if (delimiter === ":" && yaml.recognized && !yaml.exhausted) {
+            continue;
+        }
+        if (delimiter === ":") {
+            const declarationStart = text.lastIndexOf("\n", matchStart - 1) + 1;
+            const declarationEnd = lineEndIndex(text, cursor);
+            const typeTerminator = commentMasked.indexOf(";", cursor + 1);
+            const typeOnlyDeclaration = typeTerminator >= 0 &&
+                typeTerminator <= declarationEnd
+                ? commentMasked.slice(cursor + 1, typeTerminator).trim()
+                : "";
+            if (typeOnlyDeclaration.length > 0 &&
+                isInsideBoundedTypeBody(commentMasked, keyStart) &&
+                looksLikeTsTypeExpression(typeOnlyDeclaration, true)) {
+                continue;
+            }
+            const assignmentEquals = findTsFieldAssignmentEquals(commentMasked, cursor + 1, declarationEnd);
+            if (assignmentEquals != null) {
+                const typedField = findBoundedTypedField(commentMasked.slice(declarationStart, assignmentEquals), declarationStart);
+                if (typedField != null) {
+                    continue;
+                }
+            }
+        }
+        cursor++;
+        while (commentMasked[cursor] === " " || commentMasked[cursor] === "\t") {
+            cursor++;
+        }
+        const blockIndicator = delimiter === ":"
+            ? new RegExp(`^(${YAML_BLOCK_HEADER_PATTERN_SOURCE})(?=[ \\t]*(?:#|\\r?$))`, "m").exec(text.slice(cursor))
+            : null;
+        if (blockIndicator != null) {
+            const block = parseYamlBlockScalar(text, matchStart, cursor, blockIndicator[1] ?? "");
+            if (block == null) {
+                continue;
+            }
+            keyPattern.lastIndex = block.valueEnd;
+            const value = text.slice(block.valueStart, block.valueEnd);
+            yield {
+                keyStart,
+                keyEnd,
+                valueStart: block.valueStart,
+                valueEnd: block.valueEnd,
+                line,
+                confidence: isHighConfidenceAssignedSecret(value.trim()) ? "high" : "none",
+                replacement: redactYamlBlockPayload(value),
+            };
+            continue;
+        }
+        const quote = text[cursor] === '"' || text[cursor] === "'" ? text[cursor] : undefined;
+        let valueStart = quote == null ? cursor : cursor + 1;
+        let valueEnd = valueStart;
+        if (quote == null) {
+            if (delimiter === ":") {
+                valueEnd = logicalYamlValueEnd(text, valueStart);
+            }
+            else {
+                while (valueEnd < text.length && !/[\s;,#]/.test(text[valueEnd] ?? "")) {
+                    valueEnd++;
+                }
+            }
+        }
+        else {
+            let escaped = false;
+            while (valueEnd < text.length) {
+                const character = text[valueEnd];
+                if (character === "\r" || character === "\n") {
+                    break;
+                }
+                if (!escaped && character === quote) {
+                    break;
+                }
+                if (!escaped && character === "\\") {
+                    escaped = true;
+                }
+                else {
+                    escaped = false;
+                }
+                valueEnd++;
+            }
+            if (text[valueEnd] !== quote) {
+                continue;
+            }
+            const tailStart = skipHorizontalWhitespace(text, valueEnd + 1);
+            if (text[tailStart] === "+") {
+                valueStart = cursor;
+                const logicalSpan = residualJsValueSpan(text, maskJsCommentTrivia(text), cursor);
+                valueEnd = cursor + logicalSpan.content.length;
+            }
+        }
+        keyPattern.lastIndex =
+            valueEnd + (quote != null && valueStart !== cursor ? 1 : 0);
+        const value = text.slice(valueStart, valueEnd);
+        const confidence = (quote != null || !looksLikeCodeExpression(value)) &&
+            isHighConfidenceAssignedSecret(value)
+            ? "high"
+            : "none";
+        yield {
+            keyStart,
+            keyEnd,
+            valueStart,
+            valueEnd,
+            line,
+            confidence,
+            ...(/\r|\n/.test(value)
+                ? { replacement: redactYamlBlockPayload(value) }
+                : {}),
+        };
+    }
+}
+function logicalYamlValueEnd(text, valueStart) {
+    let end = valueStart;
+    const delimiters = [];
+    let quote;
+    let escaped = false;
+    while (end < text.length) {
+        const character = text[end] ?? "";
+        if (quote != null) {
+            if (!escaped && character === quote) {
+                quote = undefined;
+            }
+            escaped = !escaped && character === "\\";
+            end++;
+            continue;
+        }
+        if (character === '"' || character === "'" || character === "`") {
+            quote = character;
+            escaped = false;
+            end++;
+            continue;
+        }
+        if (character === "/" && text[end + 1] === "*") {
+            if (delimiters.length === 0) {
+                break;
+            }
+            const commentEnd = text.indexOf("*/", end + 2);
+            if (commentEnd < 0) {
+                break;
+            }
+            end = commentEnd + 2;
+            continue;
+        }
+        if (character === "(" || character === "[" || character === "{") {
+            delimiters.push(character);
+            end++;
+            continue;
+        }
+        if (character === ")" || character === "]" || character === "}") {
+            const opener = character === ")" ? "(" : character === "]" ? "[" : "{";
+            if (delimiters.at(-1) !== opener) {
+                break;
+            }
+            delimiters.pop();
+            end++;
+            continue;
+        }
+        if (delimiters.length === 0 && (character === "\r" || character === "\n" || character === ";" || character === ",")) {
+            break;
+        }
+        if (delimiters.length === 0 &&
+            ((character === "#" &&
+                (end === valueStart || /[ \t]/.test(text[end - 1] ?? ""))))) {
+            break;
+        }
+        end++;
+    }
+    while (end > valueStart && /[ \t]/.test(text[end - 1] ?? "")) {
+        end--;
+    }
+    return end;
+}
+function skipHorizontalWhitespace(text, start) {
+    let cursor = start;
+    while (text[cursor] === " " || text[cursor] === "\t") {
+        cursor++;
+    }
+    return cursor;
+}
+function parseYamlBlockScalar(text, keyStart, valueCursor, indicator) {
+    const headerEnd = lineEndIndex(text, valueCursor + indicator.length);
+    const newlineLength = text.startsWith("\r\n", headerEnd) ? 2 : text[headerEnd] === "\n" ? 1 : 0;
+    if (newlineLength === 0) {
+        return undefined;
+    }
+    const lineStart = text.lastIndexOf("\n", keyStart - 1) + 1;
+    const keyIndent = leadingIndentWidth(text.slice(lineStart, keyStart));
+    const valueStart = headerEnd + newlineLength;
+    let cursor = valueStart;
+    let valueEnd = valueStart;
+    while (cursor < text.length) {
+        const end = lineEndIndex(text, cursor);
+        const lineText = text.slice(cursor, end);
+        if (lineText.trim().length > 0 && leadingIndentWidth(lineText) <= keyIndent) {
+            break;
+        }
+        const lineBreakLength = text.startsWith("\r\n", end) ? 2 : text[end] === "\n" ? 1 : 0;
+        valueEnd = end + lineBreakLength;
+        cursor = valueEnd;
+        if (lineBreakLength === 0) {
+            break;
+        }
+    }
+    return { valueStart, valueEnd };
+}
+function redactYamlBlockPayload(value) {
+    return value.replace(/([^\r\n]*)(\r\n|\n|$)/g, (whole, line, newline) => {
+        if (whole.length === 0) {
+            return whole;
+        }
+        const indent = /^[ \t]*/.exec(line)?.[0] ?? "";
+        return line.trim().length === 0 ? `${line}${newline}` : `${indent}${REDACTION_MARKER}${newline}`;
+    });
+}
+function lineEndIndex(text, start) {
+    const newline = text.indexOf("\n", start);
+    if (newline < 0) {
+        return text.length;
+    }
+    return newline > 0 && text[newline - 1] === "\r" ? newline - 1 : newline;
+}
+function leadingIndentWidth(value) {
+    return /^[ \t]*/.exec(value)?.[0].length ?? 0;
+}
+function residualJsValueSpan(text, commentMasked, valueStart) {
+    let cursor = valueStart;
+    let quote;
+    let escaped = false;
+    let nesting = 0;
+    let lineCount = 0;
+    let valueSeenOnLine = false;
+    while (cursor < text.length && cursor - valueStart < 32_768 && lineCount < 64) {
+        const character = commentMasked[cursor] ?? "";
+        if (quote != null) {
+            if (!escaped && character === quote) {
+                quote = undefined;
+            }
+            escaped = !escaped && character === "\\";
+            if (character !== "\r" && character !== "\n" && !/\s/.test(character)) {
+                valueSeenOnLine = true;
+            }
+            cursor++;
+            continue;
+        }
+        if (character === '"' || character === "'" || character === "`") {
+            quote = character;
+            valueSeenOnLine = true;
+            cursor++;
+            continue;
+        }
+        if (character === "(" || character === "[" || character === "{") {
+            nesting++;
+        }
+        else if (character === ")" || character === "]" || character === "}") {
+            nesting = Math.max(0, nesting - 1);
+        }
+        else if ((character === ";" || character === ",") && nesting === 0) {
+            break;
+        }
+        if (character === "\r" || character === "\n") {
+            const before = commentMasked.slice(valueStart, cursor).trimEnd();
+            const afterNewline = commentMasked
+                .slice(character === "\r" && commentMasked[cursor + 1] === "\n" ? cursor + 2 : cursor + 1)
+                .trimStart();
+            const continuation = before.endsWith("+") ||
+                before.endsWith("=") ||
+                afterNewline.startsWith("+") ||
+                nesting > 0 ||
+                quote === "`";
+            if (valueSeenOnLine && !continuation) {
+                break;
+            }
+            if (character === "\r" && commentMasked[cursor + 1] === "\n") {
+                cursor++;
+            }
+            lineCount++;
+            valueSeenOnLine = false;
+            cursor++;
+            continue;
+        }
+        if (!/\s/.test(character)) {
+            valueSeenOnLine = true;
+        }
+        cursor++;
+    }
+    return {
+        content: text.slice(valueStart, cursor),
+        exhausted: cursor < text.length &&
+            (cursor - valueStart >= 32_768 || lineCount >= 64),
+    };
+}
+function maskJsCommentTrivia(text) {
+    const output = text.split("");
+    let quote;
+    let escaped = false;
+    for (let index = 0; index < text.length; index++) {
+        const character = text[index] ?? "";
+        if (quote != null) {
+            if (!escaped && character === quote) {
+                quote = undefined;
+            }
+            escaped = !escaped && character === "\\";
+            continue;
+        }
+        if (character === '"' || character === "'" || character === "`") {
+            quote = character;
+            continue;
+        }
+        if (character === "/" && text[index + 1] === "*") {
+            output[index] = " ";
+            output[index + 1] = " ";
+            index += 2;
+            while (index < text.length) {
+                if (text[index] === "*" && text[index + 1] === "/") {
+                    output[index] = " ";
+                    output[index + 1] = " ";
+                    index++;
+                    break;
+                }
+                if (text[index] !== "\r" && text[index] !== "\n") {
+                    output[index] = " ";
+                }
+                index++;
+            }
+            continue;
+        }
+        if (character === "/" && text[index + 1] === "/") {
+            output[index] = " ";
+            output[index + 1] = " ";
+            index += 2;
+            while (index < text.length && text[index] !== "\r" && text[index] !== "\n") {
+                output[index] = " ";
+                index++;
+            }
+            index--;
+        }
     }
-    return `${line.slice(0, valueStart)}[redacted-sensitive]${line.slice(valueStart + value.length)}`;
+    return output.join("");
 }
 function shannonEntropy(value) {
     const counts = new Map();