clinkx 1.0.0 → 1.1.1

package/dist/context-builder/secrets.js

@@ -22,6 +22,657 @@ const MAX_YAML_SOURCE_CHARS = 5_000_000;
 const MAX_JS_KEY_LOOKBACK = 32_768;
 const MAX_TS_TYPE_CHARS = 4_096;
 const MAX_TS_TYPE_DEPTH = 32;
+/**
+ * Fail-closed provenance for a body whose deterministic scan work exceeded
+ * its budget. The budget is a backstop, not the performance mechanism: the
+ * type-body header scan is a deterministic delimiter-aware linear scan, and
+ * the other index-backed detectors are linear and memoized per text, so
+ * realistic and generated corpora never trip it. Known residuals: the
+ * dense_fields shape stays super-linear but bounded (tracked follow-up), and
+ * the value-span/redaction regexes still have catastrophic-backtracking
+ * shapes (member-call-chain, backslash runs; see the scan-wedge issue doc)
+ * that can wedge inside a single regex match before the budget trips. Work
+ * is charged at real interrupt points (per header candidate, mid index
+ * build), so exhaustion unwinds and fails closed. Revisit the calibration
+ * if a legitimate body ever reports this reason.
+ */
+export const SANITIZE_BUDGET_EXHAUSTED_PROVENANCE = "sanitize_budget_exhausted";
+// Calibrated at >= 20x the linearized realistic-shape cost, with headroom
+// for the dense_fields adversarial shape (measured ~4_000 work units per
+// char at 256 KiB; see tests/context-builder/secrets-perf.test.ts). Larger
+// or denser pathological bodies exhaust it by design and fail closed.
+const SECRET_SCAN_WORK_PER_CHAR = 6_000;
+const SECRET_SCAN_WORK_FLOOR = 4_000_000;
+class SecretScanBudgetExhausted extends Error {
+}
+let activeSecretScanSession;
+let secretScanWorkTotal = 0;
+let secretScanBudgetOverride;
+function chargeWork(units) {
+    secretScanWorkTotal += units;
+    const session = activeSecretScanSession;
+    if (session != null) {
+        session.work += units;
+        if (session.work > session.limit) {
+            throw new SecretScanBudgetExhausted();
+        }
+    }
+}
+/**
+ * Runs one public detector entry point inside a per-body session. Nested
+ * entry points (sanitize -> scan/redact/residual) share the outer budget and
+ * memo; exhaustion unwinds to the outermost entry, which fails closed.
+ */
+function withSecretScanSession(text, work, onExhausted) {
+    if (activeSecretScanSession != null) {
+        return work();
+    }
+    activeSecretScanSession = {
+        limit: secretScanBudgetOverride ??
+            SECRET_SCAN_WORK_FLOOR + SECRET_SCAN_WORK_PER_CHAR * text.length,
+        work: 0,
+        texts: new Map(),
+    };
+    try {
+        return work();
+    }
+    catch (error) {
+        if (error instanceof SecretScanBudgetExhausted) {
+            return onExhausted();
+        }
+        throw error;
+    }
+    finally {
+        activeSecretScanSession = undefined;
+    }
+}
+function analysisFor(text) {
+    const session = activeSecretScanSession;
+    if (session == null) {
+        return undefined;
+    }
+    let analysis = session.texts.get(text);
+    if (analysis == null) {
+        analysis = {};
+        session.texts.set(text, analysis);
+    }
+    return analysis;
+}
+/** Test-only: deterministic work units consumed by `work`. */
+export function measureSecretScanWorkForTests(work) {
+    const before = secretScanWorkTotal;
+    const result = work();
+    return { result, work: secretScanWorkTotal - before };
+}
+/** Test-only: run `work` with a fixed per-body work budget. */
+export function withSecretScanBudgetForTests(limit, work) {
+    const previous = secretScanBudgetOverride;
+    secretScanBudgetOverride = limit;
+    try {
+        return work();
+    }
+    finally {
+        secretScanBudgetOverride = previous;
+    }
+}
+/** Test-only: (start, brace) offset of every type-body header match. */
+export function typeBodyHeaderMatchesForTests(text) {
+    const headers = collectTypeBodyHeaders(text);
+    const pairs = [];
+    for (let slot = 0; slot < headers.starts.length; slot++) {
+        const start = headers.starts[slot];
+        const brace = headers.braces[slot];
+        if (start != null && brace != null) {
+            pairs.push({ start, brace });
+        }
+    }
+    return pairs;
+}
+function budgetExhaustedFinding() {
+    return contentFinding(SANITIZE_BUDGET_EXHAUSTED_PROVENANCE, 1);
+}
+// ---------------------------------------------------------------------------
+// Linear per-text indexes.
+//
+// The detectors below used to rescan a fresh 32 KiB lookback slice per '='
+// (regex matchAll over the window plus a brace scan, per query). Each index is
+// built once per distinct body-level string per scan session, memoized in the
+// SecretTextAnalysis slots, and queried with binary searches / O(1) lookups.
+// Query semantics replicate the legacy slice behavior exactly, including the
+// slice-relative `^`/`\b` window edge (a header or typed field starting
+// exactly at the window start counts) — see the per-query comments.
+// ---------------------------------------------------------------------------
+const TYPED_FIELD_PATTERN = /(?:^|[;{}\r\n])[ \t]*(?:(?:public|private|protected|static|readonly|declare|abstract|override)[ \t]+)*([A-Za-z_$][A-Za-z0-9_$-]*)(?:[?!])?[ \t]*:[ \t]*/g;
+const TYPED_FIELD_MODIFIERS = [
+    "public",
+    "private",
+    "protected",
+    "static",
+    "readonly",
+    "declare",
+    "abstract",
+    "override",
+];
+const MAX_TS_TYPE_ONLY_FIELD_CHARS = 4_096;
+// Same composition as the per-call `new RegExp` the malformed-YAML span walk
+// used to compile for every candidate value start.
+const MALFORMED_YAML_CONTINUES_PATTERN = new RegExp(`^(?:&[A-Za-z0-9_.-]+[ \\t]+|!!?[^ \\t\\r\\n]+[ \\t]+|!<[^>\\r\\n]+>[ \\t]+)*${YAML_BLOCK_HEADER_PATTERN_SOURCE}(?:[ \\t]+#.*)?$`);
+/**
+ * (start, brace) offset of every `class`/`interface`/`type` header, from a
+ * delimiter-aware linear scan equivalent to matchAll of
+ * /\b(?:class|interface|type)\s+[A-Za-z_$][A-Za-z0-9_$]*[^{};]*\{/g (the
+ * pattern's greedy `[^{};]*` backtracks one char at a time per candidate, so
+ * a header succeeds exactly when the first `{`/`}`/`;` after the ident is
+ * `{`; resolving that stopper through an amortized forward scan removed the
+ * quadratic blowup on dense failed-header bodies). Deliberately not
+ * quote-aware: matches inside
+ * strings and comments are golden-pinned semantics. `charge` gates the
+ * budget charges: the whole-text index build charges here, while the bounded
+ * lookback-slice fallback does not (its caller already charges the slice
+ * length, and the slice volume per body is a pre-existing property).
+ */
+function collectTypeBodyHeaders(text, charge = true) {
+    const length = text.length;
+    const starts = [];
+    const braces = [];
+    if (charge) {
+        chargeWork(length);
+    }
+    // Stopper lookup (first `{`/`}`/`;` at or after a cursor) via one amortized
+    // forward scan: region [regionStart, regionStopper) provably holds no
+    // stopper, so every candidate cursor inside it reuses regionStopper — a
+    // dense run of failed candidates pays one scan, not one per candidate.
+    // The absent-stopper sentinel is regionStopper === length, so the
+    // text[stopper] === "{" success test fails naturally at EOF. No index
+    // array is allocated: the lookback-slice fallback below runs thousands of
+    // times per body on the dense shapes, and a per-call Int32Array plus full
+    // backward pass dominated the wall clock there.
+    let regionStart = 0;
+    let regionStopper = -1;
+    const stopperAfter = (from) => {
+        if (regionStart <= from && from <= regionStopper) {
+            return regionStopper;
+        }
+        let index = from;
+        while (index < length) {
+            const code = text.charCodeAt(index);
+            if (code === 0x7b || code === 0x7d || code === 0x3b) {
+                break;
+            }
+            index++;
+        }
+        regionStart = from;
+        regionStopper = index;
+        return index;
+    };
+    // Fresh locator per invocation: literal alternation plus lookahead, no
+    // backtracking structure. The regex \b stays the boundary authority (word
+    // chars are [A-Za-z0-9_], so `$class` matches while `xclass` and `Class`
+    // do not); lastIndex is managed by hand so a successful header can
+    // swallow its span the way matchAll's lastIndex jump did.
+    const locator = /\b(?:class|interface|type)(?=\s)/g;
+    let keyword;
+    while ((keyword = locator.exec(text)) != null) {
+        const start = keyword.index;
+        let cursor = start + keyword[0].length;
+        while (cursor < length && isJsWhitespaceChar(text[cursor] ?? "")) {
+            cursor++;
+        }
+        if (cursor >= length || !isIdentStartCode(text.charCodeAt(cursor))) {
+            if (charge) {
+                chargeWork(8);
+            }
+            continue;
+        }
+        const identStart = cursor;
+        while (cursor < length && isIdentCharCode(text.charCodeAt(cursor))) {
+            cursor++;
+        }
+        if (charge) {
+            chargeWork(8 + (cursor - identStart));
+        }
+        const stopper = stopperAfter(cursor);
+        // Failed candidates never jump the locator: it is already past the
+        // keyword, and the very next keyword may still succeed
+        // (`class A; type B {`). Jumping to the failure-stopper + 1 would also
+        // be safe; this scan commits to no-jump.
+        if (text.charCodeAt(stopper) === 0x7b) {
+            starts.push(start);
+            braces.push(stopper);
+            locator.lastIndex = stopper + 1;
+        }
+    }
+    return { starts, braces };
+}
+function typeBodyIndexFor(text) {
+    const analysis = analysisFor(text);
+    const cached = analysis?.typeBody;
+    if (cached != null) {
+        return cached;
+    }
+    // collectTypeBodyHeaders charges the amortized stopper scan and, per
+    // candidate, 8 + identLength — real work with honest budget interrupt
+    // points between candidates (plain JS checks, not event-loop yields). This
+    // charge covers the stack pass below; mid-enumeration exhaustion unwinds
+    // and fails closed instead of leaving a partial index in the session memo.
+    const headers = collectTypeBodyHeaders(text);
+    chargeWork(text.length);
+    const headerStarts = headers.starts;
+    const headerBraces = headers.braces;
+    const pastEnd = text.length + 1;
+    // Per-position close/exceed facts for every `{`, from one stack pass. The
+    // stack bases are strictly increasing (unique per open frame), so the frame
+    // that newly exceeds MAX_TS_TYPE_DEPTH when depth becomes d is exactly the
+    // one with base d - 33, found by binary search.
+    const closeAt = new Int32Array(text.length);
+    const exceedAt = new Int32Array(text.length);
+    closeAt.fill(pastEnd);
+    exceedAt.fill(pastEnd);
+    const stackPos = [];
+    const stackBase = [];
+    const stackExceed = [];
+    const stackHeaderSlot = [];
+    let depth = 0;
+    const headerSlots = new Map();
+    for (let slot = 0; slot < headerBraces.length; slot++) {
+        headerSlots.set(headerBraces[slot] ?? -1, slot);
+    }
+    for (let index = 0; index < text.length; index++) {
+        const code = text.charCodeAt(index);
+        if (code === 0x7b) {
+            stackPos.push(index);
+            stackBase.push(depth);
+            stackExceed.push(pastEnd);
+            stackHeaderSlot.push(headerSlots.get(index) ?? -1);
+            depth++;
+            const exceedBase = depth - (MAX_TS_TYPE_DEPTH + 1);
+            const frame = binarySearchExact(stackBase, exceedBase);
+            if (frame >= 0 && (stackExceed[frame] ?? pastEnd) === pastEnd) {
+                stackExceed[frame] = index + 1;
+            }
+            continue;
+        }
+        if (code === 0x7d) {
+            const pos = stackPos.pop();
+            const base = stackBase.pop();
+            const exceed = stackExceed.pop();
+            const headerSlot = stackHeaderSlot.pop();
+            depth--;
+            if (pos == null || base == null || exceed == null || headerSlot == null) {
+                continue;
+            }
+            closeAt[pos] = index + 1;
+            exceedAt[pos] = exceed;
+            continue;
+        }
+    }
+    // Frames never popped: closeAt stays pastEnd; keep any recorded exceed.
+    for (let frame = 0; frame < stackPos.length; frame++) {
+        const pos = stackPos[frame];
+        const exceed = stackExceed[frame];
+        if (pos == null || exceed == null) {
+            continue;
+        }
+        exceedAt[pos] = exceed;
+    }
+    const index = {
+        starts: Int32Array.from(headerStarts),
+        braces: Int32Array.from(headerBraces),
+        closeAt,
+        exceedAt,
+        pastEnd,
+    };
+    if (analysis != null) {
+        analysis.typeBody = index;
+    }
+    return index;
+}
+function typedFieldCandidatesFor(text) {
+    const analysis = analysisFor(text);
+    const cached = analysis?.typedFields;
+    if (cached != null) {
+        return cached;
+    }
+    chargeWork(2 * text.length);
+    const matchStarts = [];
+    const keyStarts = [];
+    const keyEnds = [];
+    const typeStarts = [];
+    for (const match of text.matchAll(TYPED_FIELD_PATTERN)) {
+        const rawKey = match[1] ?? "";
+        const matchStart = match.index ?? 0;
+        const keyStart = matchStart + match[0].lastIndexOf(rawKey);
+        matchStarts.push(matchStart);
+        keyStarts.push(keyStart);
+        keyEnds.push(keyStart + rawKey.length);
+        typeStarts.push(matchStart + match[0].length);
+    }
+    const candidates = {
+        matchStarts: Int32Array.from(matchStarts),
+        keyStarts: Int32Array.from(keyStarts),
+        keyEnds: Int32Array.from(keyEnds),
+        typeStarts: Int32Array.from(typeStarts),
+        count: matchStarts.length,
+    };
+    if (analysis != null) {
+        analysis.typedFields = candidates;
+    }
+    return candidates;
+}
+function newlineOffsetsFor(text) {
+    const analysis = analysisFor(text);
+    const cached = analysis?.newlineOffsets;
+    if (cached != null) {
+        return cached;
+    }
+    chargeWork(text.length);
+    const offsets = [];
+    for (let index = 0; index < text.length; index++) {
+        if (text.charCodeAt(index) === 0x0a) {
+            offsets.push(index);
+        }
+    }
+    const result = Int32Array.from(offsets);
+    if (analysis != null) {
+        analysis.newlineOffsets = result;
+    }
+    return result;
+}
+function nextSemicolonFor(text) {
+    const analysis = analysisFor(text);
+    const cached = analysis?.nextSemicolon;
+    if (cached != null) {
+        return cached;
+    }
+    chargeWork(text.length);
+    const result = new Int32Array(text.length + 1);
+    result.fill(-1);
+    for (let index = text.length - 1; index >= 0; index--) {
+        result[index] =
+            text.charCodeAt(index) === 0x3b ? index : result[index + 1] ?? -1;
+    }
+    if (analysis != null) {
+        analysis.nextSemicolon = result;
+    }
+    return result;
+}
+function yamlBlockHeaderIndexFor(text) {
+    const analysis = analysisFor(text);
+    const cached = analysis?.yamlBlockHeaders;
+    if (cached != null) {
+        return cached;
+    }
+    chargeWork(text.length);
+    const starts = [0];
+    for (let index = 0; index < text.length; index++) {
+        if (text.charCodeAt(index) === 0x0a) {
+            starts.push(index + 1);
+        }
+    }
+    const result = { lineStarts: Int32Array.from(starts) };
+    if (analysis != null) {
+        analysis.yamlBlockHeaders = result;
+    }
+    return result;
+}
+/** Rightmost index with values[index] < target (-1 when none). */
+function binarySearchLastLessThan(values, target) {
+    let low = 0;
+    let high = values.length - 1;
+    let result = -1;
+    while (low <= high) {
+        const mid = (low + high) >>> 1;
+        if ((values[mid] ?? 0) < target) {
+            result = mid;
+            low = mid + 1;
+        }
+        else {
+            high = mid - 1;
+        }
+    }
+    return result;
+}
+/** Exact-match index in a sorted-ascending array (-1 when absent). */
+function binarySearchExact(values, target) {
+    let low = 0;
+    let high = values.length - 1;
+    while (low <= high) {
+        const mid = (low + high) >>> 1;
+        const value = values[mid] ?? 0;
+        if (value === target) {
+            return mid;
+        }
+        if (value < target) {
+            low = mid + 1;
+        }
+        else {
+            high = mid - 1;
+        }
+    }
+    return -1;
+}
+function isJsWordCode(code) {
+    return ((code >= 0x30 && code <= 0x39) ||
+        (code >= 0x41 && code <= 0x5a) ||
+        (code >= 0x61 && code <= 0x7a) ||
+        code === 0x5f ||
+        code === 0x24);
+}
+function isIdentStartCode(code) {
+    return ((code >= 0x41 && code <= 0x5a) ||
+        (code >= 0x61 && code <= 0x7a) ||
+        code === 0x5f ||
+        code === 0x24);
+}
+function isIdentCharCode(code) {
+    return isJsWordCode(code);
+}
+function isJsWhitespaceChar(char) {
+    return /\s/.test(char);
+}
+function isLineTerminatorCode(code) {
+    return (code === 0x0a || code === 0x0d || code === 0x2028 || code === 0x2029);
+}
+/**
+ * Brace offset of a `class`/`interface`/`type` header starting exactly at
+ * `start` (the slice-relative `\b` window edge: a header beginning exactly at
+ * the lookback window start counts even when the preceding character would
+ * block the word boundary in the full text). `-1` when no header completes
+ * before `limit`.
+ */
+function typeBodyHeaderBraceAt(text, start, limit) {
+    const keywordLength = text.startsWith("interface", start)
+        ? "interface".length
+        : text.startsWith("class", start)
+            ? "class".length
+            : text.startsWith("type", start)
+                ? "type".length
+                : -1;
+    if (keywordLength < 0) {
+        return -1;
+    }
+    let cursor = start + keywordLength;
+    if (cursor >= limit || !isJsWhitespaceChar(text[cursor] ?? "")) {
+        return -1;
+    }
+    while (cursor < limit && isJsWhitespaceChar(text[cursor] ?? "")) {
+        cursor++;
+    }
+    if (cursor >= limit || !isIdentStartCode(text.charCodeAt(cursor))) {
+        return -1;
+    }
+    cursor++;
+    while (cursor < limit && isIdentCharCode(text.charCodeAt(cursor))) {
+        cursor++;
+    }
+    // `[^{};]*` runs to the first stopper; only `{` can complete the header.
+    while (cursor < limit) {
+        const code = text.charCodeAt(cursor);
+        if (code === 0x7b) {
+            return cursor;
+        }
+        if (code === 0x7d || code === 0x3b) {
+            return -1;
+        }
+        cursor++;
+    }
+    return -1;
+}
+/**
+ * Index-backed equivalent of the legacy isInsideBoundedTypeBody(prefix,
+ * offset) where `prefix` was the caller's window slice starting at
+ * `windowStart` (0 for full-text callers). Falls back to the exact legacy
+ * slice scan when a header match straddles the window start — the one
+ * configuration where slice sub-matches exist that a whole-text matchAll
+ * never records.
+ */
+function isInsideBoundedTypeBodyAt(text, windowStart, offset) {
+    const lo = Math.max(0, windowStart, offset - MAX_JS_KEY_LOOKBACK);
+    if (lo >= offset) {
+        return false;
+    }
+    const index = typeBodyIndexFor(text);
+    chargeWork(8);
+    const straddling = binarySearchLastLessThan(index.starts, lo);
+    if (straddling >= 0 &&
+        (index.braces[straddling] ?? -1) >= lo) {
+        chargeWork(offset - lo);
+        return isInsideBoundedTypeBodyBefore(text.slice(lo, offset));
+    }
+    let brace = -1;
+    const lastVisible = binarySearchLastLessThan(index.braces, offset);
+    if (lastVisible >= 0 &&
+        (index.starts[lastVisible] ?? -1) >= lo) {
+        brace = index.braces[lastVisible] ?? -1;
+    }
+    if (lo > 0 && isJsWordCode(text.charCodeAt(lo - 1))) {
+        const synthetic = typeBodyHeaderBraceAt(text, lo, offset);
+        if (synthetic > brace) {
+            brace = synthetic;
+        }
+    }
+    if (brace < 0) {
+        return false;
+    }
+    return ((index.closeAt[brace] ?? index.pastEnd) > offset &&
+        (index.exceedAt[brace] ?? index.pastEnd) > offset);
+}
+/** Exact legacy scan over an already-sliced lookback `before`. */
+function isInsideBoundedTypeBodyBefore(before) {
+    // Shared header scan on the slice: offset 0 counts as a boundary, exactly
+    // the slice-relative \b semantics the slice's own matchAll had. Only the
+    // last header's brace feeds the depth walk (legacy last-match semantics).
+    // Uncharged: the caller already charges the slice length, and this fallback
+    // runs per straddling lookback query (thousands of 32 KiB slices on the
+    // dense shapes), so double-charging here would exhaust the budget.
+    const classBrace = collectTypeBodyHeaders(before, false).braces.at(-1) ?? -1;
+    if (classBrace < 0) {
+        return false;
+    }
+    let depth = 0;
+    for (let index = classBrace; index < before.length; index++) {
+        if (before[index] === "{") {
+            depth++;
+        }
+        else if (before[index] === "}") {
+            depth--;
+            if (depth === 0) {
+                return false;
+            }
+        }
+        if (depth > MAX_TS_TYPE_DEPTH) {
+            return false;
+        }
+    }
+    return depth > 0;
+}
+/**
+ * Parses `[ \t]*(modifier[ \t]+)*key[?!]?[ \t]*:[ \t]*` starting exactly at
+ * `start` — the typed-field pattern with the boundary alternative elided.
+ * This reproduces the regex's greedy modifier consumption with rightmost
+ * backtracking (e.g. `readonly : T` parses with key `readonly`), which is
+ * what a window slice's slice-relative `^` anchoring would see at position 0.
+ */
+function matchTypedFieldContinuationAt(text, start, limit) {
+    let cursor = start;
+    while (cursor < limit &&
+        (text.charCodeAt(cursor) === 0x20 || text.charCodeAt(cursor) === 0x09)) {
+        cursor++;
+    }
+    const modifierStarts = [];
+    for (;;) {
+        let matched = -1;
+        for (const modifier of TYPED_FIELD_MODIFIERS) {
+            if (text.startsWith(modifier, cursor)) {
+                matched = modifier.length;
+                break;
+            }
+        }
+        if (matched < 0 ||
+            cursor + matched >= limit ||
+            (text.charCodeAt(cursor + matched) !== 0x20 &&
+                text.charCodeAt(cursor + matched) !== 0x09)) {
+            break;
+        }
+        modifierStarts.push(cursor);
+        cursor += matched;
+        while (cursor < limit &&
+            (text.charCodeAt(cursor) === 0x20 || text.charCodeAt(cursor) === 0x09)) {
+            cursor++;
+        }
+    }
+    for (;;) {
+        const keyStart = cursor;
+        if (keyStart < limit && isIdentStartCode(text.charCodeAt(keyStart))) {
+            let keyEnd = keyStart + 1;
+            // The regex key class is [A-Za-z0-9_$-]*: hyphens are legal key
+            // continuations (e.g. `api-key: string;`) even though they are not
+            // word characters.
+            while (keyEnd < limit &&
+                (isIdentCharCode(text.charCodeAt(keyEnd)) ||
+                    text.charCodeAt(keyEnd) === 0x2d)) {
+                keyEnd++;
+            }
+            let afterKey = keyEnd;
+            const maybeOptional = text.charCodeAt(afterKey);
+            if (maybeOptional === 0x3f || maybeOptional === 0x21) {
+                afterKey++;
+            }
+            while (afterKey < limit &&
+                (text.charCodeAt(afterKey) === 0x20 ||
+                    text.charCodeAt(afterKey) === 0x09)) {
+                afterKey++;
+            }
+            if (afterKey < limit && text.charCodeAt(afterKey) === 0x3a) {
+                let typeStart = afterKey + 1;
+                while (typeStart < limit &&
+                    (text.charCodeAt(typeStart) === 0x20 ||
+                        text.charCodeAt(typeStart) === 0x09)) {
+                    typeStart++;
+                }
+                return { keyStart, keyEnd, typeStart };
+            }
+        }
+        if (modifierStarts.length === 0) {
+            return undefined;
+        }
+        cursor = modifierStarts.pop() ?? start;
+    }
+}
+/** Memoized whole-text comment mask; only called on body-level strings. */
+function commentMaskedFor(text) {
+    const analysis = analysisFor(text);
+    const cached = analysis?.commentMasked;
+    if (cached != null) {
+        return cached;
+    }
+    chargeWork(2 * text.length);
+    const masked = maskJsCommentTrivia(text);
+    if (analysis != null) {
+        analysis.commentMasked = masked;
+    }
+    return masked;
+}
 const PLACEHOLDER_VALUES = new Set([
     "changeme",
     "example",
@@ -77,6 +728,9 @@ export function scanSecretPath(rootRelativePath) {
     return dedupeFindings(findings);
 }
 export function scanHighConfidenceSecretContent(text) {
+    return withSecretScanSession(text, () => scanHighConfidenceSecretContentInSession(text), () => [budgetExhaustedFinding()]);
+}
+function scanHighConfidenceSecretContentInSession(text) {
     const findings = [];
     const privateKeyLine = findPatternLine(text, PRIVATE_KEY_BLOCK_PATTERN);
     if (privateKeyLine != null) {
@@ -98,7 +752,14 @@ export function scanHighConfidenceSecretContent(text) {
 export function isBlockingSecretFinding(finding) {
     return finding.provenance !== "assignment_secret";
 }
+/**
+ * Budget exhaustion here fails closed by removing the whole body: a partial
+ * redaction cannot be proven complete.
+ */
 export function redactHighConfidenceAssignmentSecrets(text) {
+    return withSecretScanSession(text, () => redactHighConfidenceAssignmentSecretsInSession(text), () => "");
+}
+function redactHighConfidenceAssignmentSecretsInSession(text) {
     const secretAssignments = [...iterateAssignmentSecrets(text)].filter((assignment) => assignment.confidence === "high").sort((left, right) => left.valueStart - right.valueStart);
     let redacted = text;
     for (let index = secretAssignments.length - 1; index >= 0; index--) {
@@ -116,6 +777,9 @@ export function redactHighConfidenceAssignmentSecrets(text) {
  * content the primary assignment grammar did not classify.
  */
 export function sanitizeHighConfidenceSecretContent(text, residualDetector = hasConservativeResidualSecret) {
+    return withSecretScanSession(text, () => sanitizeHighConfidenceSecretContentInSession(text, residualDetector), () => ({ status: "blocked", content: "", findings: [budgetExhaustedFinding()] }));
+}
+function sanitizeHighConfidenceSecretContentInSession(text, residualDetector) {
     const findings = scanHighConfidenceSecretContent(text);
     if (findings.some(isBlockingSecretFinding)) {
         return { status: "blocked", content: "", findings };
@@ -146,6 +810,10 @@ export function sanitizeHighConfidenceSecretContent(text, residualDetector = has
  * YAML block continuations with a separate, intentionally conservative lexer.
  */
 export function hasConservativeResidualSecret(text) {
+    return withSecretScanSession(text, () => hasConservativeResidualSecretInSession(text), () => true);
+}
+function hasConservativeResidualSecretInSession(text) {
+    chargeWork(text.length * (1 + WELL_KNOWN_TOKEN_PATTERNS.length));
     if (PRIVATE_KEY_BLOCK_PATTERN.test(text)) {
         return true;
     }
@@ -176,7 +844,7 @@ export function hasDisallowedSecretMaterial(text, allowSecrets) {
     if (allowSecrets === true) {
         return false;
     }
-    return hasHighConfidenceSecret(text) || hasConservativeResidualSecret(text);
+    return withSecretScanSession(text, () => hasHighConfidenceSecret(text) || hasConservativeResidualSecret(text), () => true);
 }
 export function assertNoHighConfidenceSecretsInTask(task) {
     if (!hasDisallowedSecretMaterial(task, false)) {
@@ -244,6 +912,7 @@ function isSecretDirectorySegment(segment) {
         segment === "credentials");
 }
 function findPatternLine(text, pattern) {
+    chargeWork(2 * text.length);
     const lines = text.split(/\r?\n/);
     for (let index = 0; index < lines.length; index++) {
         if (pattern.test(lines[index] ?? "")) {
@@ -371,6 +1040,19 @@ function isRedactionMarkerValue(value) {
                 .trim().length === 0));
 }
 function analyzeYamlStructuralSecrets(text) {
+    const analysis = analysisFor(text);
+    const cached = analysis?.yaml;
+    if (cached != null) {
+        return cached;
+    }
+    const result = analyzeYamlStructuralSecretsUncached(text);
+    if (analysis != null) {
+        analysis.yaml = result;
+    }
+    return result;
+}
+function analyzeYamlStructuralSecretsUncached(text) {
+    chargeWork(text.length);
     if (text.length > MAX_YAML_SOURCE_CHARS) {
         return { ...emptyYamlStructuralAnalysis(), recognized: true, exhausted: true };
     }
@@ -415,6 +1097,7 @@ function analyzeYamlStructuralSecrets(text) {
         let current = node;
         const active = new Set();
         for (let depth = 0; depth <= MAX_YAML_DEPTH; depth++) {
+            chargeWork(1);
             if (current == null || ++nodesSeen > MAX_YAML_NODES) {
                 analysis.exhausted = true;
                 return undefined;
@@ -436,6 +1119,7 @@ function analyzeYamlStructuralSecrets(text) {
         if (node == null || analysis.exhausted) {
             return;
         }
+        chargeWork(1);
         nodesSeen++;
         if (nodesSeen > MAX_YAML_NODES || depth > MAX_YAML_DEPTH) {
             analysis.exhausted = true;
@@ -644,6 +1328,12 @@ function emptyYamlStructuralAnalysis() {
     };
 }
 function hasMalformedYamlSensitiveSecret(text) {
+    const analysis = analysisFor(text);
+    const cached = analysis?.malformedYamlSecret;
+    if (cached != null) {
+        return cached;
+    }
+    let result = false;
     // Valid TypeScript class fields are not YAML merely because a nested type
     // property has a sensitive name. Remove only declarations whose bounded RHS
     // is an unambiguous reference; literal/object RHS values remain visible to
@@ -656,37 +1346,48 @@ function hasMalformedYamlSensitiveSecret(text) {
             continue;
         }
         if (spanContainsHighEntropyLiteral(span)) {
-            return true;
+            result = true;
+            break;
         }
     }
-    return false;
+    if (analysis != null) {
+        analysis.malformedYamlSecret = result;
+    }
+    return result;
 }
 function malformedYamlValueSpan(text, valueStart) {
-    const firstLineEnd = lineEndIndex(text, valueStart);
+    const { lineStarts } = yamlBlockHeaderIndexFor(text);
+    const lineSlot = binarySearchLastLessThan(lineStarts, valueStart + 1);
+    let lineIndex = lineSlot < 0 ? 0 : lineSlot;
+    const firstLineEnd = lineEndViaStarts(text, lineStarts, lineIndex);
     const firstLine = text.slice(valueStart, firstLineEnd);
     const firstValue = firstLine.replace(/^[ \t]*/, "");
     const continues = firstValue.length === 0 ||
         firstValue.startsWith("#") ||
-        new RegExp(`^(?:&[A-Za-z0-9_.-]+[ \\t]+|!!?[^ \\t\\r\\n]+[ \\t]+|!<[^>\\r\\n]+>[ \\t]+)*${YAML_BLOCK_HEADER_PATTERN_SOURCE}(?:[ \\t]+#.*)?$`).test(firstValue);
+        MALFORMED_YAML_CONTINUES_PATTERN.test(firstValue);
     if (!continues) {
         return firstLine;
     }
-    const keyLineStart = text.lastIndexOf("\n", valueStart - 1) + 1;
+    const keyLineStart = lineStarts[lineIndex] ?? 0;
     const keyIndent = leadingIndentWidth(text.slice(keyLineStart, valueStart));
     let cursor = firstLineEnd;
     let end = firstLineEnd;
     let lines = 0;
     while (cursor < text.length && lines <= 512 && cursor - valueStart < 32_768) {
-        const newlineLength = text.startsWith("\r\n", cursor)
-            ? 2
-            : text[cursor] === "\n"
-                ? 1
-                : 0;
-        if (newlineLength === 0) {
+        chargeWork(1);
+        if (lineIndex + 1 >= lineStarts.length) {
             break;
         }
-        const lineStart = cursor + newlineLength;
-        const lineEnd = lineEndIndex(text, lineStart);
+        const lineStart = lineStarts[lineIndex + 1] ?? text.length;
+        if (text.charCodeAt(cursor) === 0x0d) {
+            if (text.charCodeAt(cursor + 1) !== 0x0a) {
+                break;
+            }
+        }
+        else if (text.charCodeAt(cursor) !== 0x0a) {
+            break;
+        }
+        const lineEnd = lineEndViaStarts(text, lineStarts, lineIndex + 1);
         const line = text.slice(lineStart, lineEnd);
         if (line.trim().length > 0 && leadingIndentWidth(line) <= keyIndent) {
             break;
@@ -694,25 +1395,89 @@ function malformedYamlValueSpan(text, valueStart) {
         end = lineEnd;
         cursor = lineEnd;
         lines++;
+        lineIndex++;
     }
     return text.slice(valueStart, end);
 }
+/** End offset (exclusive of the line terminator) of line `lineIndex`. */
+function lineEndViaStarts(text, lineStarts, lineIndex) {
+    if (lineIndex + 1 >= lineStarts.length) {
+        return text.length;
+    }
+    const nextStart = lineStarts[lineIndex + 1] ?? text.length;
+    const newline = nextStart - 1;
+    return newline > 0 && text.charCodeAt(newline - 1) === 0x0d
+        ? newline - 1
+        : newline;
+}
 function maskConfidentlySafeTypeOnlyFields(text) {
-    const typeOnlyField = /(^|[;{}\r\n])([ \t]*(?:(?:public|private|protected|static|readonly|declare|abstract|override)[ \t]+)*[A-Za-z_$][A-Za-z0-9_$-]*(?:[?!])?[ \t]*:[ \t]*)([\s\S]{1,4096}?);/gm;
-    return text.replace(typeOnlyField, (whole, boundary, _prefix, type, offset) => {
-        if (!isInsideBoundedTypeBody(text, offset + boundary.length) ||
-            !looksLikeTsTypeExpression(type, true)) {
-            return whole;
+    // Manual linear scan reproducing
+    // /(^|[;{}\r\n])(prefix)([\s\S]{1,4096}?);/gm.replace semantics exactly:
+    // `^` only at line starts, `;`-terminated lazy type bodies resolved through
+    // the next-semicolon index, and the scan resuming after each match's `;`
+    // whether or not the match was rewritten.
+    const nextSemicolon = nextSemicolonFor(text);
+    const isTypeBodyBoundaryChar = (code) => code === 0x3b ||
+        code === 0x7b ||
+        code === 0x7d ||
+        code === 0x0d ||
+        code === 0x0a;
+    let output = "";
+    let copied = 0;
+    let position = 0;
+    while (position < text.length) {
+        chargeWork(1);
+        const atLineStart = position === 0 || isLineTerminatorCode(text.charCodeAt(position - 1));
+        let boundaryLength = -1;
+        let continuation;
+        if (atLineStart) {
+            continuation = matchTypedFieldContinuationAt(text, position, text.length);
+            if (continuation != null) {
+                boundaryLength = 0;
+            }
         }
-        return `${boundary}${whole.slice(boundary.length).replace(/[^\r\n]/g, " ")}`;
-    });
+        if (boundaryLength < 0 && isTypeBodyBoundaryChar(text.charCodeAt(position))) {
+            const afterBoundary = matchTypedFieldContinuationAt(text, position + 1, text.length);
+            if (afterBoundary != null) {
+                boundaryLength = 1;
+                continuation = afterBoundary;
+            }
+        }
+        if (boundaryLength < 0 || continuation == null) {
+            position++;
+            continue;
+        }
+        const typeStart = continuation.typeStart;
+        const terminator = typeStart + 1 <= text.length ? nextSemicolon[typeStart + 1] ?? -1 : -1;
+        if (terminator < 0 || terminator - typeStart > MAX_TS_TYPE_ONLY_FIELD_CHARS) {
+            // The lazy group cannot reach a `;` in range. Prefix backtracking never
+            // rescues the match: a shorter modifier run leaves a keyword followed by
+            // whitespace, which the key production cannot re-parse.
+            position++;
+            continue;
+        }
+        const type = text.slice(typeStart, terminator);
+        if (isInsideBoundedTypeBodyAt(text, 0, position + boundaryLength) &&
+            looksLikeTsTypeExpression(type, true)) {
+            output += text.slice(copied, position);
+            output += text.slice(position, position + boundaryLength);
+            for (let index = position + boundaryLength; index <= terminator; index++) {
+                const code = text.charCodeAt(index);
+                output += code === 0x0a || code === 0x0d ? text[index] ?? "" : " ";
+            }
+            copied = terminator + 1;
+        }
+        position = terminator + 1;
+    }
+    return output + text.slice(copied);
 }
 function maskConfidentlySafeTypedFields(text) {
-    const masked = maskJsCommentTrivia(text);
+    const masked = commentMaskedFor(text);
     const safeSpans = [];
     let quote;
     let escaped = false;
     for (let equalsAt = 0; equalsAt < masked.length; equalsAt++) {
+        chargeWork(1);
         const character = masked[equalsAt] ?? "";
         if (quote != null) {
             if (!escaped && character === quote) {
@@ -731,8 +1496,9 @@ function maskConfidentlySafeTypedFields(text) {
             /[=>]/.test(masked[equalsAt + 1] ?? "")) {
             continue;
         }
+        chargeWork(32);
         const windowStart = Math.max(0, equalsAt - MAX_JS_KEY_LOOKBACK);
-        const field = findBoundedTypedField(masked.slice(windowStart, equalsAt), windowStart);
+        const field = findBoundedTypedField(masked, windowStart, equalsAt);
         if (field == null || field === "exhausted") {
             continue;
         }
@@ -773,6 +1539,7 @@ function isSafeTypedFieldReference(source, value) {
                 /^keyof\s+typeof\s+[A-Za-z_$][A-Za-z0-9_$]*(?:(?:\.|::)[A-Za-z_$][A-Za-z0-9_$]*)*$/.test(expression))));
 }
 function malformedYamlSensitiveValueStarts(text) {
+    chargeWork(4 * text.length);
     const starts = [];
     const keyToken = String.raw `[A-Za-z_$][A-Za-z0-9_$-]*(?:\.[A-Za-z_$][A-Za-z0-9_$-]*)*`;
     for (const match of text.matchAll(/^[ \t]*(["'])((?:\\.|(?!\1)[^\r\n])*)\1[ \t]*:/gm)) {
@@ -827,22 +1594,31 @@ function redactYamlScalarSource(source) {
     return redactYamlBlockPayload(source);
 }
 function lineNumberAtOffset(text, offset) {
-    let line = 1;
-    for (let index = 0; index < offset; index++) {
-        if (text[index] === "\n") {
-            line++;
-        }
-    }
-    return line;
+    const newlineOffsets = newlineOffsetsFor(text);
+    return 1 + binarySearchLastLessThan(newlineOffsets, offset) + 1;
 }
 function analyzeJsStructuralSecrets(text, primaryRedaction = true) {
-    const masked = maskJsCommentTrivia(text);
+    const analysis = analysisFor(text);
+    const slot = primaryRedaction ? "jsPrimary" : "jsResidual";
+    const cached = analysis?.[slot];
+    if (cached != null) {
+        return cached;
+    }
+    const result = analyzeJsStructuralSecretsUncached(text, primaryRedaction);
+    if (analysis != null) {
+        analysis[slot] = result;
+    }
+    return result;
+}
+function analyzeJsStructuralSecretsUncached(text, primaryRedaction) {
+    const masked = commentMaskedFor(text);
     const matches = [];
     let unsafeSensitiveContext = false;
     let quote;
     let escaped = false;
     let scanned = 0;
     for (let cursor = 0; cursor < masked.length; cursor++) {
+        chargeWork(1);
         if (++scanned > 1_000_000) {
             return { exhausted: true, unsafeSensitiveContext, matches };
         }
@@ -864,6 +1640,7 @@ function analyzeJsStructuralSecrets(text, primaryRedaction = true) {
             /[=>]/.test(masked[cursor + 1] ?? "")) {
             continue;
         }
+        chargeWork(32);
         const key = sensitiveJsKeyBefore(text, masked, cursor);
         if (key === "exhausted") {
             const span = residualJsValueSpan(text, masked, cursor + 1);
@@ -899,7 +1676,7 @@ function analyzeJsStructuralSecrets(text, primaryRedaction = true) {
             continue;
         }
         const typedFieldWindowStart = Math.max(0, cursor - MAX_JS_KEY_LOOKBACK);
-        const typedField = findBoundedTypedField(masked.slice(typedFieldWindowStart, cursor), typedFieldWindowStart);
+        const typedField = findBoundedTypedField(masked, typedFieldWindowStart, cursor);
         const safeTypedReference = typedField != null &&
             typedField !== "exhausted" &&
             reconstructed != null &&
@@ -993,11 +1770,11 @@ function spanContainsHighEntropyLiteral(span) {
 }
 function sensitiveJsKeyBefore(text, masked, equalsAt) {
     const windowStart = Math.max(0, equalsAt - MAX_JS_KEY_LOOKBACK);
-    const prefix = masked.slice(windowStart, equalsAt);
-    const typedField = findSensitiveTypedField(prefix, windowStart);
+    const typedField = findSensitiveTypedField(masked, windowStart, equalsAt);
     if (typedField != null) {
         return typedField;
     }
+    const prefix = masked.slice(windowStart, equalsAt);
     const bracket = /\[\s*(["'])((?:\\.|(?!\1)[^\r\n])*)\1\s*\]\s*$/.exec(prefix);
     if (bracket != null) {
         const encoded = bracket[2] ?? "";
@@ -1079,8 +1856,8 @@ function classifyTsTypeAnnotation(value) {
     }
     return stack.length === 0 ? "valid" : "unclassifiable";
 }
-function findSensitiveTypedField(prefix, absoluteStart) {
-    const field = findBoundedTypedField(prefix, absoluteStart);
+function findSensitiveTypedField(source, windowStart, windowEnd) {
+    const field = findBoundedTypedField(source, windowStart, windowEnd);
     if (field === "exhausted" || field == null || field.sensitive) {
         return field === "exhausted" || field == null
             ? field
@@ -1088,23 +1865,30 @@ function findSensitiveTypedField(prefix, absoluteStart) {
     }
     return undefined;
 }
-function findBoundedTypedField(prefix, absoluteStart) {
-    const pattern = /(?:^|[;{}\r\n])[ \t]*(?:(?:public|private|protected|static|readonly|declare|abstract|override)[ \t]+)*([A-Za-z_$][A-Za-z0-9_$-]*)(?:[?!])?[ \t]*:[ \t]*/g;
-    for (const match of prefix.matchAll(pattern)) {
-        const rawKey = match[1] ?? "";
-        const keyOffset = match[0].lastIndexOf(rawKey);
-        const relativeKeyStart = (match.index ?? 0) + keyOffset;
-        if (!isInsideBoundedTypeBody(prefix, relativeKeyStart)) {
-            continue;
-        }
-        const typeStart = (match.index ?? 0) + match[0].length;
-        const type = prefix.slice(typeStart).trim();
+function findBoundedTypedField(source, windowStart, windowEnd) {
+    // Index-backed enumeration. A window slice's matchAll could additionally
+    // match at position 0 through the `^` alternative (no boundary character
+    // consumed) — including continuations of a declaration whose boundary sits
+    // just before the window and mid-identifier splits. That candidate comes
+    // first in slice scan order; precomputed matches starting inside it would
+    // have been consumed by the slice scan, so iteration resumes from its end.
+    const candidates = typedFieldCandidatesFor(source);
+    chargeWork(8);
+    const synthetic = matchTypedFieldContinuationAt(source, windowStart, windowEnd);
+    const evaluate = (keyStart, keyEnd, typeStart) => {
+        const rawKey = source.slice(keyStart, keyEnd);
+        if (!isInsideBoundedTypeBodyAt(source, windowStart, keyStart)) {
+            return "continue";
+        }
+        // The legacy window ended at windowEnd, so the type annotation under
+        // examination is bounded by it exactly as the slice was.
+        const type = source.slice(typeStart, windowEnd).trim();
         const classification = classifyTsTypeAnnotation(type);
         if (classification === "member_boundary") {
-            continue;
+            return "continue";
         }
         if (classification === "nested_candidate") {
-            continue;
+            return "continue";
         }
         if (classification === "unclassifiable") {
             return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(rawKey) &&
@@ -1114,41 +1898,34 @@ function findBoundedTypedField(prefix, absoluteStart) {
         }
         // The first candidate whose entire suffix is a balanced type annotation is
         // the outer field. Nested object-type properties leave unmatched closers.
-        const start = absoluteStart + relativeKeyStart;
         return {
-            start,
-            end: start + rawKey.length,
+            start: keyStart,
+            end: keyEnd,
             sensitive: isSensitiveDecodedKey(rawKey),
         };
-    }
-    return undefined;
-}
-function isInsideBoundedTypeBody(prefix, offset) {
-    const start = Math.max(0, offset - MAX_JS_KEY_LOOKBACK);
-    const before = prefix.slice(start, offset);
-    let classBrace = -1;
-    for (const match of before.matchAll(/\b(?:class|interface|type)\s+[A-Za-z_$][A-Za-z0-9_$]*[^{};]*\{/g)) {
-        classBrace = (match.index ?? 0) + match[0].length - 1;
-    }
-    if (classBrace < 0) {
-        return false;
-    }
-    let depth = 0;
-    for (let index = classBrace; index < before.length; index++) {
-        if (before[index] === "{") {
-            depth++;
-        }
-        else if (before[index] === "}") {
-            depth--;
-            if (depth === 0) {
-                return false;
-            }
+    };
+    if (synthetic != null) {
+        chargeWork(4);
+        const outcome = evaluate(synthetic.keyStart, synthetic.keyEnd, synthetic.typeStart);
+        if (outcome !== "continue") {
+            return outcome;
+        }
+    }
+    const resumeFrom = synthetic != null ? synthetic.typeStart : windowStart;
+    let slot = binarySearchLastLessThan(candidates.matchStarts, resumeFrom) + 1;
+    while (slot < candidates.count) {
+        chargeWork(4);
+        const typeStart = candidates.typeStarts[slot] ?? 0;
+        if (typeStart > windowEnd) {
+            break;
         }
-        if (depth > MAX_TS_TYPE_DEPTH) {
-            return false;
+        const outcome = evaluate(candidates.keyStarts[slot] ?? typeStart, candidates.keyEnds[slot] ?? typeStart, typeStart);
+        if (outcome !== "continue") {
+            return outcome;
         }
+        slot++;
     }
-    return depth > 0;
+    return undefined;
 }
 function findTsFieldAssignmentEquals(text, start, end) {
     for (let index = start; index < end; index++) {
@@ -1253,12 +2030,15 @@ function* iterateAssignmentSecrets(text) {
     if (!js.exhausted) {
         yield* js.matches;
     }
-    const commentMasked = maskJsCommentTrivia(text);
+    const commentMasked = commentMaskedFor(text);
+    const nextSemicolon = nextSemicolonFor(commentMasked);
+    chargeWork(2 * text.length);
     let line = 1;
     let lineCursor = 0;
     const keyPattern = new RegExp(ASSIGNMENT_KEY_PATTERN.source, ASSIGNMENT_KEY_PATTERN.flags);
     let match;
     while ((match = keyPattern.exec(commentMasked)) != null) {
+        chargeWork(16);
         const matchStart = match.index;
         for (let index = lineCursor; index < matchStart; index++) {
             if (text[index] === "\n") {
@@ -1293,19 +2073,21 @@ function* iterateAssignmentSecrets(text) {
         if (delimiter === ":") {
             const declarationStart = text.lastIndexOf("\n", matchStart - 1) + 1;
             const declarationEnd = lineEndIndex(text, cursor);
-            const typeTerminator = commentMasked.indexOf(";", cursor + 1);
+            const typeTerminator = cursor + 1 <= commentMasked.length
+                ? nextSemicolon[cursor + 1] ?? -1
+                : -1;
             const typeOnlyDeclaration = typeTerminator >= 0 &&
                 typeTerminator <= declarationEnd
                 ? commentMasked.slice(cursor + 1, typeTerminator).trim()
                 : "";
             if (typeOnlyDeclaration.length > 0 &&
-                isInsideBoundedTypeBody(commentMasked, keyStart) &&
+                isInsideBoundedTypeBodyAt(commentMasked, 0, keyStart) &&
                 looksLikeTsTypeExpression(typeOnlyDeclaration, true)) {
                 continue;
             }
             const assignmentEquals = findTsFieldAssignmentEquals(commentMasked, cursor + 1, declarationEnd);
             if (assignmentEquals != null) {
-                const typedField = findBoundedTypedField(commentMasked.slice(declarationStart, assignmentEquals), declarationStart);
+                const typedField = findBoundedTypedField(commentMasked, declarationStart, assignmentEquals);
                 if (typedField != null) {
                     continue;
                 }
@@ -1373,7 +2155,7 @@ function* iterateAssignmentSecrets(text) {
             const tailStart = skipHorizontalWhitespace(text, valueEnd + 1);
             if (text[tailStart] === "+") {
                 valueStart = cursor;
-                const logicalSpan = residualJsValueSpan(text, maskJsCommentTrivia(text), cursor);
+                const logicalSpan = residualJsValueSpan(text, commentMaskedFor(text), cursor);
                 valueEnd = cursor + logicalSpan.content.length;
             }
         }
@@ -1577,8 +2359,11 @@ function residualJsValueSpan(text, commentMasked, valueStart) {
             (cursor - valueStart >= 32_768 || lineCount >= 64),
     };
 }
+// Returns `text` itself when nothing is masked: callers key memo Maps by the
+// result, and Node 24's V8 compares a distinct-but-equal string per lookup.
 function maskJsCommentTrivia(text) {
     const output = text.split("");
+    let changed = false;
     let quote;
     let escaped = false;
     for (let index = 0; index < text.length; index++) {
@@ -1595,6 +2380,7 @@ function maskJsCommentTrivia(text) {
             continue;
         }
         if (character === "/" && text[index + 1] === "*") {
+            changed = true;
             output[index] = " ";
             output[index + 1] = " ";
             index += 2;
@@ -1613,6 +2399,7 @@ function maskJsCommentTrivia(text) {
             continue;
         }
         if (character === "/" && text[index + 1] === "/") {
+            changed = true;
             output[index] = " ";
             output[index + 1] = " ";
             index += 2;
@@ -1623,7 +2410,7 @@ function maskJsCommentTrivia(text) {
             index--;
         }
     }
-    return output.join("");
+    return changed ? output.join("") : text;
 }
 function shannonEntropy(value) {
     const counts = new Map();