@sema-agent/client-core 0.101.0 → 0.102.0

package/dist/displayUntrusted.js

@@ -11,7 +11,7 @@ function isMarker(v) {
     return core === RETIRED_MARKER || MARKER_RE.test(core);
 }
 const VIEW_SEPARATOR = '\ufeff';
-function pushEdit(edits, src, start, end, text) {
+function pushEdit(edits, src, start, end, text, phases) {
     let a = start;
     let b = end;
     while (a < b && src[a] === VIEW_SEPARATOR)
@@ -22,7 +22,7 @@ function pushEdit(edits, src, start, end, text) {
         a = b = start;
     if (src.slice(a, b) === text)
         return;
-    edits.push({ start: a, end: b, text });
+    edits.push(phases === undefined ? { start: a, end: b, text } : { start: a, end: b, text, phases });
 }
 const UNIT_NONE = 0;
 const UNIT_SEQUENCE = 1;
@@ -220,7 +220,7 @@ const isHostChar = (c) => (c >= 0x30 && c <= 0x39) || (c >= 0x41 && c <= 0x5a) |
 const isIpv6Char = (c) => (c >= 0x30 && c <= 0x3a) || (c >= 0x41 && c <= 0x46) || (c >= 0x61 && c <= 0x66) || c === 0x2e;
 const endsSchemelessHost = (c) => Number.isNaN(c) || c === 0x2f || c === 0x3f || c === 0x23 || c === 0x22 || c === 0x3c || c === 0x3e || c === 0x60 ||
     c === 0x7c || c === 0x5c || c === 0x5e || c === 0x7b || c === 0x7d || isRegexSpace(c);
-function schemelessHostEnd(text, from) {
+function schemelessHostEnd(text, from, wide = false) {
     let k = from;
     if (text.charCodeAt(k) === 0x5b) {
         k++;
@@ -238,14 +238,25 @@ function schemelessHostEnd(text, from) {
     }
     if (text.charCodeAt(k) === 0x3a) {
         let d = k + 1;
-        while (d < text.length && text.charCodeAt(d) >= 0x30 && text.charCodeAt(d) <= 0x39)
-            d++;
-        if (d > k + 1)
+        if (wide) {
+            while (d < text.length && isSchemelessPortChar(text.charCodeAt(d)))
+                d++;
             k = d;
+        }
+        else {
+            while (d < text.length && text.charCodeAt(d) >= 0x30 && text.charCodeAt(d) <= 0x39)
+                d++;
+            if (d > k + 1)
+                k = d;
+        }
     }
     const c = text.charCodeAt(k);
-    return endsSchemelessHost(c) || c === 0x27 ? k : -1;
+    return endsSchemelessHost(c) || c === 0x27 || (wide && endsSchemelessHostInProse(c)) ? k : -1;
 }
+const isSchemelessPortChar = (c) => (c >= 0x30 && c <= 0x39) || (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a) || c === 0x2e || c === 0x5f || c === 0x7e || c === 0x25 || c === 0x2d;
+const endsSchemelessHostInProse = (c) => c === 0x29 || c === 0x2c || c === 0x3b || c === 0x21 || c === 0x5d;
+const SCHEMELESS_USERINFO_WIDE_SPAN = 64 + 1 + 256;
+const isUserinfoWideDelimiter = (ch) => ch === '?' || ch === '#' || ch === '@';
 const MAX_PORT = 65535;
 function authorityIsHostPort(text, from, to) {
     if (to <= from || schemelessHostEnd(text.slice(0, to), from) !== to)
@@ -282,32 +293,32 @@ function queryCandidates(src, base, query, edits, soft, byShape = false) {
             const eq = part.indexOf('=');
             if (eq === -1) {
                 const at = pos;
-                if (!slotIsWholeMarker(part, soft && ((i) => soft(at + i))) && (!byShape || queryPartCarriesCredential(null, part, relax)))
-                    pushEdit(edits, src, pos, pos + part.length, REDACTED_QUERY);
+                if (!slotIsWholeMarker(part, soft && ((i) => soft(at + i)))) {
+                    const phases = byShape ? queryPartPhases(null, part, relax) : phaseRange(0, scanUpto);
+                    if (phases !== 0)
+                        pushEdit(edits, src, pos, pos + part.length, REDACTED_QUERY, phasesOrAll(phases));
+                }
             }
             else {
                 const value = part.slice(eq + 1);
                 const at = pos + eq + 1;
-                if (value.length > 0 && !slotIsWholeMarker(value, soft && ((i) => soft(at + i))) && (!byShape || queryPartCarriesCredential(part.slice(0, eq), value, relax))) {
-                    pushEdit(edits, src, pos + eq + 1, pos + part.length, REDACTED_QUERY);
+                if (value.length > 0 && !slotIsWholeMarker(value, soft && ((i) => soft(at + i)))) {
+                    const phases = byShape ? queryPartPhases(part.slice(0, eq), value, relax) : phaseRange(0, scanUpto);
+                    if (phases !== 0)
+                        pushEdit(edits, src, pos + eq + 1, pos + part.length, REDACTED_QUERY, phasesOrAll(phases));
                 }
             }
         }
         pos += part.length + 1;
     }
 }
-function pathCandidates(src, base, path, opaqueSegments, edits, soft) {
+function pathCandidates(src, base, path, opaqueSegments, edits, soft, whole = false) {
     let pos = base;
     for (const segment of path.split('/')) {
         const semi = segment.indexOf(';');
         const head = semi === -1 ? segment : segment.slice(0, semi);
         if (opaqueSegments) {
-            let a = 0;
-            let b = head.length;
-            while (a < b && !isKeyWordChar(head.charCodeAt(a)) && !(head.charCodeAt(a) === 0x25 && hasNonAsciiPercentEscape(head.slice(a, a + 3))))
-                a++;
-            while (b > a && !isKeyWordChar(head.charCodeAt(b - 1)))
-                b--;
+            const [a, b] = markerAtomicCut(head, ...segmentWordCut(head));
             if (isKnownSecretSegment(head)) {
                 if (b > a)
                     pushEdit(edits, src, pos + a, pos + b, REDACTED_SECRET);
@@ -317,6 +328,10 @@ function pathCandidates(src, base, path, opaqueSegments, edits, soft) {
                 if (glued > 0)
                     pushEdit(edits, src, pos + a + glued, pos + b, REDACTED_SECRET);
             }
+            if (whole && b > a) {
+                const at = pos;
+                emitRow('path-slot', (phases) => pathSlotEdits(src, at, head, a, b, phases, edits, soft));
+            }
         }
         if (semi !== -1) {
             let ppos = pos + semi + 1;
@@ -334,9 +349,76 @@ function pathCandidates(src, base, path, opaqueSegments, edits, soft) {
         pos += segment.length + 1;
     }
 }
-function addressCandidates(src, from, end, opaqueSegments, edits, regions, soft, byShape = false, whole = false, hostRegion = whole) {
+function segmentWordCut(head) {
+    let a = 0;
+    let b = head.length;
+    while (a < b && !isKeyWordChar(head.charCodeAt(a)) && !(head.charCodeAt(a) === 0x25 && hasNonAsciiPercentEscape(head.slice(a, a + 3))))
+        a++;
+    while (b > a && !isKeyWordChar(head.charCodeAt(b - 1)))
+        b--;
+    return [a, b];
+}
+function markerAtomicCut(head, a, b) {
+    if (!head.includes(REDACTION_MARKER_PREFIX))
+        return [a, b];
+    let s = a;
+    let e = b;
+    const re = new RegExp(MARKER_ANYWHERE.source, MARKER_ANYWHERE.flags);
+    for (let m = re.exec(head); m !== null; m = re.exec(head)) {
+        const ms = m.index;
+        const me = ms + m[0].length;
+        if (ms < s && s < me)
+            s = ms;
+        if (ms < e && e < me)
+            e = me;
+    }
+    return [s, e];
+}
+function pathSlotEdits(src, pos, head, a, b, rowPhases, edits, soft) {
+    const softFrom = (at) => (soft === undefined ? undefined : (i) => soft(pos + at + i));
+    const eq = head.indexOf('=', a);
+    let named = 0;
+    if (eq > a && eq < b) {
+        const name = head.slice(a, eq);
+        if (!slotIsWholeMarker(name, softFrom(a))) {
+            named = queryPartPhases(null, name, false) & rowPhases;
+            if (named !== 0)
+                pushEdit(edits, src, pos + a, pos + b, REDACTED_SECRET, named);
+            if (named === rowPhases)
+                return;
+        }
+    }
+    const [s, e] = markerAtomicCut(head, eq !== -1 && eq < b ? eq + 1 : a, b);
+    if (s >= e)
+        return;
+    const slot = head.slice(s, e);
+    if (slotIsWholeMarker(slot, softFrom(s)))
+        return;
+    const valued = queryPartPhases(null, slot, false) & rowPhases & ~named;
+    if (valued !== 0)
+        pushEdit(edits, src, pos + s, pos + e, REDACTED_SECRET, valued);
+}
+const anchoredFormPattern = (form) => new RegExp(`(?:https?:\/\/)?${form.host.split('.').join('\\.')}${form.trailingDot ? '\\.?' : ''}\/(?:${form.pathKinds.join('|')})\/((?:[${form.tailClass}]|${MARKER_ANYWHERE.source})+)`, 'gi');
+function anchoredFormCandidates(text, out) {
+    for (const { id, form, probe, pattern } of ANCHORED_FORM_ROWS) {
+        if (!probe.test(text))
+            continue;
+        emitRow(id, (phases) => {
+            const re = new RegExp(pattern.source, pattern.flags);
+            for (let m = re.exec(text); m !== null; m = re.exec(text)) {
+                const tail = m[1] ?? '';
+                const end = m.index + m[0].length;
+                if (tail.length > 0 && (tail.includes(REDACTION_MARKER_PREFIX) || tail.length >= form.minTailLength))
+                    out.push({ a: end - tail.length, b: end, kind: 'secret', cls: 'url', te: -1, phases });
+                if (m[0].length === 0)
+                    re.lastIndex++;
+            }
+        });
+    }
+}
+function addressCandidates(src, from, end, opaqueSegments, edits, regions, soft, byShape = false, whole = false, hostRegion = whole, pathOnly = false) {
     const rest = src.slice(from, end);
-    const authorityEnd = rest.search(/[/?#]/);
+    const authorityEnd = pathOnly ? 0 : rest.search(/[/?#]/);
     const authority = authorityEnd === -1 ? rest : rest.slice(0, authorityEnd);
     const tailStart = from + authority.length;
     const tail = src.slice(tailStart, end);
@@ -347,7 +429,7 @@ function addressCandidates(src, from, end, opaqueSegments, edits, regions, soft,
     const beforeHash = hash === -1 ? tail : tail.slice(0, hash);
     const question = beforeHash.indexOf('?');
     const path = question === -1 ? beforeHash : beforeHash.slice(0, question);
-    pathCandidates(src, tailStart, path, opaqueSegments, edits, soft);
+    pathCandidates(src, tailStart, path, opaqueSegments, edits, soft, whole);
     if (whole) {
         const cut = pathCutAfterFirstLabel(path, true);
         if (cut !== -1 && fragmentTerminatorFrom(path, cut))
@@ -376,7 +458,8 @@ function relativeAddressCandidates(text, out, regions, unitPos, soft, hostRegion
     while (p0 < text.length && (isWhitespaceOrControl(text.charAt(p0)) || text.charAt(p0) === VIEW_SEPARATOR))
         p0++;
     const c0 = text.charAt(p0);
-    if (c0 !== '/' && c0 !== '?' && c0 !== '#')
+    const pathOnly = c0 !== '/' && c0 !== '?' && c0 !== '#' && isRelativeRequestAt(text, p0);
+    if (c0 !== '/' && c0 !== '?' && c0 !== '#' && !pathOnly)
         return false;
     let end = text.length;
     while (end > p0 && (text.charAt(end - 1) === VIEW_SEPARATOR || isWhitespaceOrControl(text.charAt(end - 1)) || isUnicodeBlank(text.charCodeAt(end - 1))))
@@ -384,10 +467,19 @@ function relativeAddressCandidates(text, out, regions, unitPos, soft, hostRegion
     end = trailingCloserEnd(text, p0, p0 + 1, end, unitPos);
     const from = text.startsWith('//', p0) ? p0 + 2 : p0;
     const tokenEdits = [];
-    addressCandidates(text, from, end, true, tokenEdits, regions, soft, false, true, hostRegion);
+    addressCandidates(text, from, end, true, tokenEdits, regions, soft, false, true, hostRegion, pathOnly);
     editsToCandidates(tokenEdits, 'url', out, end);
     return true;
 }
+function isRelativeRequestAt(text, p0) {
+    const rest = text.slice(p0);
+    if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(rest))
+        return false;
+    const q = rest.search(/[?#]/);
+    if (q <= 0)
+        return false;
+    return !/[\s=\ufeff]/.test(rest.slice(0, q)) && rest.indexOf('=', q + 1) !== -1;
+}
 function urlCandidates(text, out, regions, unitPos = () => false, soft, byShape = false, whole = false, hostRegion = whole) {
     if (whole && relativeAddressCandidates(text, out, regions, unitPos, soft, hostRegion))
         return;
@@ -457,6 +549,8 @@ function urlCandidates(text, out, regions, unitPos = () => false, soft, byShape
             end = runStart;
         end = trailingCloserEnd(text, start, mark + 3, end, unitPos);
         const tokenEdits = [];
+        if (userinfoBoundaryAmbiguous(text.slice(start, end)))
+            pushEdit(tokenEdits, text, start, end, REDACTED_SECRET);
         addressCandidates(text, mark + 3, end, !/^file:/i.test(text.slice(start, mark + 3)), tokenEdits, regions, soft, byShape, whole, hostRegion);
         editsToCandidates(tokenEdits, 'url', out, end);
         mark = text.indexOf('://', end > mark + 3 ? end : mark + 3);
@@ -635,13 +729,7 @@ function userinfoCandidates(S, out, words = true) {
         return nextBareStop(from) >= at;
     };
     let floor = 0;
-    for (let at = text.indexOf('@'); at !== -1; at = text.indexOf('@', at + 1)) {
-        let hostEnd = schemelessHostEnd(text, at + 1);
-        const hidden = hostEnd === -1;
-        if (hidden)
-            hostEnd = hiddenHostEnd(text, at + 1, unitAt);
-        if (hostEnd === -1)
-            continue;
+    const readAt = (at, hostEnd, hidden, runStartIn) => {
         let shaped = null;
         const hostShaped = () => {
             if (shaped === null) {
@@ -673,9 +761,7 @@ function userinfoCandidates(S, out, words = true) {
             return hostShaped() ? 'bare' : null;
         };
         const refused = [];
-        let runStart = at;
-        while (runStart > floor && (!breaksUserinfo(text.charCodeAt(runStart - 1)) || (hidden && unitAt(runStart - 1) !== UNIT_NONE)))
-            runStart--;
+        let runStart = runStartIn;
         if (text.charCodeAt(runStart) === 0x3a && runStart > floor && text[runStart - 1] === VIEW_SEPARATOR) {
             while (runStart > floor && text[runStart - 1] === VIEW_SEPARATOR)
                 runStart--;
@@ -723,7 +809,7 @@ function userinfoCandidates(S, out, words = true) {
                     continue;
                 }
             }
-            if (USERNAME_DELIMITERS.has(ch)) {
+            if (USERNAME_DELIMITERS.has(ch) || isUserinfoWideDelimiter(ch)) {
                 lo = colon + 1;
                 continue;
             }
@@ -791,10 +877,50 @@ function userinfoCandidates(S, out, words = true) {
                 }
             }
         }
-        if (found === -1)
-            continue;
-        out.push({ a: found, b: at, kind: 'userinfo', cls: hidden ? 'userinfo-hidden' : 'structural', te: hostEnd });
-        floor = hostEnd;
+        return found;
+    };
+    const walkFrom = (at, hidden) => {
+        let r = at;
+        while (r > floor && (!breaksUserinfo(text.charCodeAt(r - 1)) || (hidden && unitAt(r - 1) !== UNIT_NONE)))
+            r--;
+        return r;
+    };
+    const widen = (at, r) => {
+        const wideFloor = Math.max(floor, at - SCHEMELESS_USERINFO_WIDE_SPAN);
+        let w = r;
+        while (w > wideFloor && isUserinfoWideDelimiter(text.charAt(w - 1))) {
+            w--;
+            while (w > wideFloor && !breaksUserinfo(text.charCodeAt(w - 1)))
+                w--;
+        }
+        return w;
+    };
+    for (let at = text.indexOf('@'); at !== -1; at = text.indexOf('@', at + 1)) {
+        let hostEnd = schemelessHostEnd(text, at + 1);
+        const hidden = hostEnd === -1;
+        if (hidden)
+            hostEnd = hiddenHostEnd(text, at + 1, unitAt);
+        const cursor = markerFrom;
+        const runStart = hostEnd === -1 ? -1 : walkFrom(at, hidden);
+        const found = runStart === -1 ? -1 : readAt(at, hostEnd, hidden, runStart);
+        if (found !== -1)
+            out.push({ a: found, b: at, kind: 'userinfo', cls: hidden ? 'userinfo-hidden' : 'structural', te: hostEnd });
+        const wideEnd = schemelessHostEnd(text, at + 1, true);
+        const wHidden = wideEnd === -1 ? hidden : false;
+        const wHostEnd = wideEnd === -1 ? hostEnd : wideEnd;
+        if (wHostEnd !== -1) {
+            const wRunStart = widen(at, wHostEnd === hostEnd && wHidden === hidden && runStart !== -1 ? runStart : walkFrom(at, wHidden));
+            if (wHostEnd !== hostEnd || wHidden !== hidden || wRunStart !== runStart) {
+                const after = markerFrom;
+                markerFrom = cursor;
+                const wFound = readAt(at, wHostEnd, wHidden, wRunStart);
+                markerFrom = Math.max(after, markerFrom);
+                if (wFound !== -1 && (wFound !== found || wHostEnd !== hostEnd))
+                    out.push({ a: wFound, b: at, kind: 'userinfo', cls: wHidden ? 'userinfo-hidden' : 'structural', te: wHostEnd });
+            }
+        }
+        if (found !== -1)
+            floor = hostEnd;
     }
 }
 function labelWashedBefore(text, a, floor) {
@@ -4040,7 +4166,7 @@ function editsToCandidates(edits, cls, out, te = -1) {
         const kind = KIND_BY_TEXT.get(e.text);
         if (kind === undefined || e.end <= e.start)
             continue;
-        out.push({ a: e.start, b: e.end, kind, cls, te });
+        out.push(e.phases === undefined ? { a: e.start, b: e.end, kind, cls, te } : { a: e.start, b: e.end, kind, cls, te, phases: e.phases });
     }
 }
 function pemRegions(recognized) {
@@ -4258,7 +4384,8 @@ function toRaw(S, c) {
     if (a >= b)
         return null;
     const te = c.te > b ? S.rawEnd(c.te - 1) : S.rawEnd(b - 1);
-    return { start: S.rawStart(a), end: S.rawEnd(b - 1), kind: c.kind, cls: c.cls, tokenEnd: te };
+    const r = { start: S.rawStart(a), end: S.rawEnd(b - 1), kind: c.kind, cls: c.cls, tokenEnd: te };
+    return c.phases === undefined ? r : { ...r, phases: c.phases };
 }
 function runLabelPasses(S, regions, cands, blocks) {
     labelCandidates(S, 'scheme', regions, cands, blocks);
@@ -4307,6 +4434,7 @@ function collectCandidates(text, o, nested) {
                 if (r[2] === 'host')
                     regions.push(r);
         }
+        anchoredFormCandidates(S.text, cands);
         if (o.words) {
             editsToCandidates(pemEdits(S, (blk) => { if (S === regionSurface)
                 pemBlocksSeen.push(pemBlockToRaw(S, blk)); }), 'pem', cands);
@@ -4327,26 +4455,100 @@ function collectCandidates(text, o, nested) {
         for (const [a, b] of V.contents) {
             const sub = text.slice(a, b);
             const inner = collectCandidates(sub, o, true);
-            for (const iv of resolveCandidates(sub, inner.cands, inner.rawUnit, inner.rawDot, o.words ? pemRegions(inner.pemBlocksSeen) : [], inner.rawSoft, inner.rawPlain)) {
-                raw.push({ start: a + iv.start, end: a + iv.end, kind: iv.kind, cls: 'nested', tokenEnd: a + iv.end, pretrimmed: true });
+            for (const [iv, phases] of resolveEachPhase(sub, inner, o)) {
+                const c = { start: a + iv.start, end: a + iv.end, kind: iv.kind, cls: 'nested', tokenEnd: a + iv.end, pretrimmed: true };
+                raw.push(phases === undefined ? c : { ...c, phases });
             }
         }
         for (const c of [...screen.contents, ...decodedContents]) {
             const inner = collectCandidates(c.sub, o, true);
-            for (const iv of resolveCandidates(c.sub, inner.cands, inner.rawUnit, inner.rawDot, o.words ? pemRegions(inner.pemBlocksSeen) : [], inner.rawSoft, inner.rawPlain)) {
+            for (const [iv, phases] of resolveEachPhase(c.sub, inner, o)) {
                 const start = c.rawAt(iv.start);
                 const end = c.rawEndAt(iv.end - 1);
-                if (end > start)
-                    raw.push({ start, end, kind: iv.kind, cls: 'nested', tokenEnd: end, pretrimmed: true });
+                if (end <= start)
+                    continue;
+                const r = { start, end, kind: iv.kind, cls: 'nested', tokenEnd: end, pretrimmed: true };
+                raw.push(phases === undefined ? r : { ...r, phases });
             }
         }
     }
     return { cands: raw, rawUnit: V.rawUnit, rawDot: screen.surfaces[0]?.rawDot ?? null, rawSoft: screen.rawSoft, rawPlain: screen.rawPlain, pemBlocksSeen };
 }
-function scanOnce(text, o, trace) {
-    const { cands, rawUnit, rawDot, rawSoft, rawPlain, pemBlocksSeen } = collectCandidates(text, o, false);
-    const intervals = resolveCandidates(text, cands, rawUnit, rawDot, o.words ? pemRegions(pemBlocksSeen) : [], rawSoft, rawPlain);
-    return materialize(text, intervals, trace);
+const RULES_BY_VERSION = {
+    '0.102.0': [
+        { id: 'path-slot', ticket: 'CC-849', kind: 'generator' },
+        {
+            id: 'anchored-form:slack-webhook-url',
+            ticket: 'CC-849',
+            kind: 'generator',
+            form: { host: 'hooks.slack.com', trailingDot: true, pathKinds: ['services', 'workflows', 'triggers'], tailClass: 'A-Za-z0-9+/_-', minTailLength: 40 },
+        },
+    ],
+};
+const RULE_ROWS_ARE_GENERATORS = true;
+void RULE_ROWS_ARE_GENERATORS;
+function rowPhaseTable() {
+    const m = new Map();
+    const keys = Object.keys(RULES_BY_VERSION);
+    keys.forEach((k, j) => {
+        for (const row of RULES_BY_VERSION[k])
+            m.set(row.id, j + 1);
+    });
+    return m;
+}
+const ROW_PHASE = rowPhaseTable();
+const LAST_PHASE = Object.keys(RULES_BY_VERSION).length;
+const ANCHORED_FORM_ROWS = Object.values(RULES_BY_VERSION)
+    .flatMap((rows) => rows.filter((r) => 'form' in r))
+    .map((r) => ({ id: r.id, form: r.form, probe: new RegExp(r.form.host.split('.').join('\\.'), 'i'), pattern: anchoredFormPattern(r.form) }));
+let scanUpto = LAST_PHASE;
+const phaseRange = (from, to) => (to < from ? 0 : ((1 << (to + 1)) - 1) & ~((1 << from) - 1));
+const phasesOrAll = (mask) => (mask === phaseRange(0, scanUpto) ? undefined : mask);
+const inPhase = (phases, k) => phases === undefined || ((phases >> k) & 1) === 1;
+function emitRow(rowId, emit) {
+    const p = ROW_PHASE.get(rowId) ?? Number.POSITIVE_INFINITY;
+    if (p > scanUpto)
+        return;
+    emit(phaseRange(p, scanUpto));
+}
+function resolveEachPhase(text, c, o) {
+    const pems = o.words ? pemRegions(c.pemBlocksSeen) : [];
+    const run = (cs) => resolveCandidates(text, cs, c.rawUnit, c.rawDot, pems, c.rawSoft, c.rawPlain);
+    if (!c.cands.some((x) => x.phases !== undefined))
+        return run(c.cands).map((iv) => [iv, undefined]);
+    const per = [];
+    for (let k = 0; k <= scanUpto; k++)
+        per.push(run(c.cands.filter((x) => inPhase(x.phases, k))));
+    const key = (ivs) => ivs.map((iv) => `${iv.start}:${iv.end}:${iv.kind}`).join(',');
+    const k0 = key(per[0] ?? []);
+    if (per.every((ivs) => key(ivs) === k0))
+        return (per[0] ?? []).map((iv) => [iv, undefined]);
+    const out = [];
+    per.forEach((ivs, k) => {
+        for (const iv of ivs)
+            out.push([iv, 1 << k]);
+    });
+    return out;
+}
+function scanPhases(text, o, trace, upto) {
+    const saved = scanUpto;
+    scanUpto = upto;
+    try {
+        const c = collectCandidates(text, o, false);
+        const pems = o.words ? pemRegions(c.pemBlocksSeen) : [];
+        const run = (cs) => materialize(text, resolveCandidates(text, cs, c.rawUnit, c.rawDot, pems, c.rawSoft, c.rawPlain), trace);
+        if (!c.cands.some((x) => x.phases !== undefined)) {
+            const one = run(c.cands);
+            return Array.from({ length: upto + 1 }, () => one);
+        }
+        const outs = [];
+        for (let k = 0; k <= upto; k++)
+            outs.push(run(c.cands.filter((x) => inPhase(x.phases, k))));
+        return outs;
+    }
+    finally {
+        scanUpto = saved;
+    }
 }
 const MAX_WASH_REWRITES = 8;
 function composeOrigin(first, second) {
@@ -4361,36 +4563,76 @@ function composeOrigin(first, second) {
     }
     return out;
 }
-function scanAndMask(text, o, trace, stats) {
+function scanAndMask(text, o, trace, stats, phaseOut) {
     if (!o.urls && !o.words) {
         if (stats !== undefined) {
             stats.passes = 0;
             stats.capped = false;
+            stats.collections = 0;
         }
+        phaseOut?.push({ text });
         return { text };
     }
-    let cur = scanOnce(text, o, trace);
-    let passes = 1;
+    const upto = scanUpto;
+    let memoText = null;
+    let memo = [];
+    let collections = 0;
+    let passes = 0;
+    const op = (t, k) => {
+        if (t !== memoText) {
+            memo = scanPhases(t, o, trace, upto);
+            memoText = t;
+            collections++;
+        }
+        passes++;
+        return memo[k] ?? { text: t };
+    };
+    const advance = (cur, next) => {
+        const origin = trace ? composeOrigin(cur.origin, next.origin) : undefined;
+        return origin === undefined ? { text: next.text } : { text: next.text, origin };
+    };
+    let cur = op(text, 0);
     let rewrites = cur.text !== text ? 1 : 0;
     let changed = rewrites > 0;
     while (changed && rewrites < MAX_WASH_REWRITES) {
-        const next = scanOnce(cur.text, o, trace);
-        passes++;
+        const next = op(cur.text, 0);
         changed = next.text !== cur.text;
         if (!changed)
             break;
         rewrites++;
-        const origin = trace ? composeOrigin(cur.origin, next.origin) : undefined;
-        cur = origin === undefined ? { text: next.text } : { text: next.text, origin };
+        cur = advance(cur, next);
+    }
+    const stable = [!changed];
+    phaseOut?.push(cur);
+    for (let j = 1; j <= upto; j++) {
+        stable.push(false);
+        let rw = 0;
+        let k = j;
+        while (rw < MAX_WASH_REWRITES && !stable.every(Boolean)) {
+            if (stable[k] === true) {
+                k = (k + j) % (j + 1);
+                continue;
+            }
+            const next = op(cur.text, k);
+            if (next.text === cur.text)
+                stable[k] = true;
+            else {
+                rw++;
+                cur = advance(cur, next);
+                stable.fill(false);
+            }
+            k = (k + j) % (j + 1);
+        }
+        phaseOut?.push(cur);
     }
     if (stats !== undefined) {
         let capped = false;
-        if (changed) {
-            passes++;
-            capped = scanOnce(cur.text, o, false).text !== cur.text;
-        }
+        for (let k = 0; k < stable.length; k++)
+            if (stable[k] !== true && op(cur.text, k).text !== cur.text)
+                capped = true;
         stats.passes = passes;
         stats.capped = capped;
+        stats.collections = collections;
     }
     return cur;
 }
@@ -4789,14 +5031,28 @@ function scanOptionsOf(o, face, queryByShape = false, wholeAddress = false) {
     };
 }
 export function credentialWashPasses(text, opts = {}) {
-    const input = typeof text === 'string' ? text : String(text ?? '');
-    const stats = { passes: 0, capped: false };
+    const input = displayInputText(text);
+    const stats = { passes: 0, capped: false, collections: 0 };
     const scan = opts === null ? WASH_OPTIONS : scanOptionsOf(opts, publicFace(opts));
     scanAndMask(input, scan, false, stats);
-    return { passes: stats.passes, capped: stats.capped };
+    return { collections: stats.collections, passes: stats.passes, capped: stats.capped };
+}
+function displayInputText(text) {
+    switch (typeof text) {
+        case 'string':
+            return text;
+        case 'number':
+        case 'bigint':
+        case 'boolean':
+            return String(text);
+        case 'undefined':
+            return '';
+        default:
+            return text === null ? '' : REDACTED_SECRET;
+    }
 }
 function renderUntrusted(text, opts, ledger, queryByShape = false, wholeAddress = false) {
-    const input = typeof text === 'string' ? text : String(text ?? '');
+    const input = displayInputText(text);
     const o = opts ?? {};
     const face = publicFace(o);
     const scan = scanOptionsOf(o, face, queryByShape, wholeAddress);
@@ -4995,51 +5251,74 @@ function hasOpaquePiece(text) {
     }
     return false;
 }
-function carriesCredentialStructure(value) {
-    const netChanges = (v) => {
-        if (washCredentials(v) !== v || hasOpaquePiece(v))
-            return true;
-        if (!v.includes('+'))
-            return false;
-        const spaced = v.split('+').join(' ');
-        return washCredentials(spaced) !== spaced;
+function carriesCredentialStructurePhases(value) {
+    const all = phaseRange(0, scanUpto);
+    let hit = 0;
+    const net = (v) => {
+        if (hasOpaquePiece(v)) {
+            hit = all;
+            return;
+        }
+        hit |= washChangesPhases(v);
+        if (hit === all || !v.includes('+'))
+            return;
+        hit |= washChangesPhases(v.split('+').join(' '));
     };
     let view = value;
     for (let layer = 0; layer < MAX_PERCENT_VIEW_LAYERS; layer++) {
-        if (netChanges(view))
-            return true;
+        net(view);
+        if (hit === all)
+            return all;
         const next = percentDecodeForMatching(view).decoded;
         if (next === view)
-            return false;
+            return hit;
         view = next;
     }
-    if (netChanges(view))
-        return true;
-    return percentDecodeForMatching(view).decoded !== view;
+    net(view);
+    if (hit === all)
+        return all;
+    return percentDecodeForMatching(view).decoded !== view ? all : hit;
+}
+function washChangesPhases(v) {
+    const ends = [];
+    scanAndMask(v, WASH_OPTIONS, false, undefined, ends);
+    let mask = 0;
+    ends.forEach((t, k) => {
+        if (t.text !== v)
+            mask |= 1 << k;
+    });
+    return mask;
 }
-function queryPartCarriesCredential(key, value, relax) {
+function queryPartPhases(key, value, relax) {
+    const all = phaseRange(0, scanUpto);
     if (value.length === 0 || isMarker(value))
-        return false;
+        return 0;
     if (key !== null) {
         if (isCredentialLabelName(key))
-            return true;
+            return all;
         if (relax && isNonSecretFieldName(key) && isReadableWordChain(value))
-            return isKnownSecretSegment(value);
+            return isKnownSecretSegment(value) ? all : 0;
     }
-    if (isOpaqueSecretValue(value) || carriesCredentialStructure(value))
-        return true;
+    if (isOpaqueSecretValue(value))
+        return all;
+    let hit = carriesCredentialStructurePhases(value);
+    if (hit === all)
+        return all;
     let from = 0;
     for (let i = 0; i <= value.length; i++) {
         if (i < value.length && !endsUrlFragmentAt(value, i))
             continue;
         if (i > from && (from > 0 || i < value.length)) {
             const chunk = value.slice(from, i);
-            if (isOpaqueSecretValue(chunk) || carriesCredentialStructure(chunk))
-                return true;
+            if (isOpaqueSecretValue(chunk))
+                return all;
+            hit |= carriesCredentialStructurePhases(chunk);
+            if (hit === all)
+                return all;
         }
         from = i + 1;
     }
-    return false;
+    return hit;
 }
 const UPLOAD_PROBE_PREFIX = 'https://q.invalid/?';
 const UPLOAD_SCAN_OPTIONS = Object.freeze({ urls: true, queryByShape: 'strict', wholeAddress: true, words: true, blanks: false, fold: false, face: null, escapeSpaces: null });
@@ -5047,27 +5326,421 @@ export function queryCarriesCredential(query) {
     if (typeof query !== 'string' || query.length === 0)
         return false;
     const probe = `${UPLOAD_PROBE_PREFIX}${query}`;
-    return scanOnce(probe, UPLOAD_SCAN_OPTIONS, false).text !== probe;
+    return scanAndMask(probe, UPLOAD_SCAN_OPTIONS, false).text !== probe;
 }
 export function displayConfiguredUrl(url, opts = {}) {
-    const out = renderUntrusted(typeof url === 'string' ? configuredUrlScannable(url) : url, opts, null, 'relaxed', true);
+    const reading = typeof url === 'string' ? configuredAddressReading(url) : null;
+    const out = renderUntrusted(reading === null ? url : reading.withheld ? REDACTED_SECRET : reading.text, opts, null, 'relaxed', true);
     return typeof out === 'string' ? out : out.text;
 }
-function configuredUrlScannable(url) {
-    const view = url.replace(/[\t\n\r]/g, '').replace(/^[\u0000-\u0020]+/, '');
-    if (/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(view) || !/^[A-Za-z][A-Za-z0-9+.-]*:/.test(view))
-        return url;
+function parserViewOf(url) {
+    return url.replace(/[\t\n\r]/g, '').replace(/^[\u0000-\u0020]+/, '');
+}
+const AMBIGUOUS_USERINFO_BOUNDARY = /^(?:[A-Za-z][A-Za-z0-9+.-]*:\/\/|(?:https?|wss?|ftp):[\\/]*)[^/\\?#@]*[?#][^@]*@/i;
+function userinfoBoundaryAmbiguous(view) {
+    return AMBIGUOUS_USERINFO_BOUNDARY.test(view);
+}
+function authorityHasBackslash(view) {
+    const scheme = /^(?:https?|wss?|ftp|file):\/\//i.exec(view);
+    if (scheme === null)
+        return false;
+    const from = scheme[0].length;
+    let end = from;
+    while (end < view.length && !'/?#'.includes(view.charAt(end)))
+        end++;
+    const marks = markerSpans(view);
+    for (let s = 0; s < marks.length; s += 2)
+        if ((marks[s] ?? end) >= from && (marks[s] ?? end) < end)
+            return false;
+    let backslash = false;
+    for (let k = from; k < end; k++) {
+        if (view.charAt(k) !== '\\')
+            continue;
+        if (outletAtomEnd(view, k) > k)
+            return false;
+        backslash = true;
+    }
+    return backslash;
+}
+function outletAtomEnd(text, at) {
+    return escapeTokenAt(text, at)?.end ?? (nameBlankTokenAt(text, at) !== -1 ? at + 6 : -1);
+}
+function rebuiltAddress(url) {
     let u;
     try {
         u = new URL(url);
     }
     catch {
-        return url;
+        return null;
     }
     if (u.host === '')
-        return url;
+        return null;
     const userinfo = u.username !== '' || u.password !== '' ? `${u.username}${u.password !== '' ? `:${u.password}` : ''}@` : '';
-    return `${u.protocol}//${userinfo}${u.host}${u.pathname}${u.search}${u.hash}`;
+    const text = `${u.protocol}//${userinfo}${u.host}${u.pathname}${u.search}${u.hash}`;
+    const fwdA = new Int32Array(url.length).fill(-2);
+    const fwdB = new Int32Array(url.length).fill(-2);
+    const backA = new Int32Array(text.length).fill(-2);
+    const backB = new Int32Array(text.length).fill(-2);
+    const parts = new Int8Array(url.length);
+    const out = { text, toRebuilt: [fwdA, fwdB], toOriginal: [backA, backB], parts };
+    const encoder = new TextEncoder();
+    const at = [];
+    for (let i = 0; i < url.length; i++) {
+        const c = url.charCodeAt(i);
+        if (c === 0x09 || c === 0x0a || c === 0x0d)
+            fwdA[i] = -1;
+        else
+            at.push(i);
+    }
+    let a = 0;
+    let b = at.length;
+    while (a < b && url.charCodeAt(at[a] ?? 0) <= 0x20)
+        fwdA[at[a++] ?? 0] = -1;
+    while (b > a && url.charCodeAt(at[b - 1] ?? 0) <= 0x20)
+        fwdA[at[--b] ?? 0] = -1;
+    const ch = (k) => url.charAt(at[k] ?? -1);
+    let e = a;
+    while (e < b && ch(e) !== ':')
+        e++;
+    const scheme = at.slice(a, e).map((i) => url.charAt(i)).join('');
+    if (e === b || !/^(?:https?|wss?|ftp)$/i.test(scheme))
+        return out;
+    const align = (from, to, rFrom, rTo, mode, part) => {
+        const pairs = [];
+        let r = rFrom;
+        for (let k = from; k < to;) {
+            const i = at[k] ?? -1;
+            const cp = url.codePointAt(i) ?? 0;
+            const wide = cp > 0xffff && k + 1 < to && at[k + 1] === i + 1;
+            const c = wide ? String.fromCodePoint(cp) : url.charAt(i);
+            const step = c.length;
+            let len = -1;
+            if (text.startsWith(c, r))
+                len = c.length;
+            else if (mode === 'fold' && c.length === 1 && /[A-Z]/.test(c) && text.charAt(r) === c.toLowerCase())
+                len = 1;
+            else if (mode === 'path' && c === '\\' && text.charAt(r) === '/')
+                len = 1;
+            else if (mode === 'encoded' || mode === 'path') {
+                const enc = [...encoder.encode(c)].map((x) => `%${x.toString(16).toUpperCase().padStart(2, '0')}`).join('');
+                if (text.startsWith(enc, r))
+                    len = enc.length;
+            }
+            if (len < 0 || r + len > rTo)
+                return;
+            pairs.push(i, step, r, r + len);
+            r += len;
+            k += step;
+        }
+        if (r !== rTo)
+            return;
+        for (let p = 0; p < pairs.length; p += 4) {
+            const i = pairs[p] ?? -1;
+            const n = pairs[p + 1] ?? 1;
+            const s = pairs[p + 2] ?? 0;
+            const t = pairs[p + 3] ?? 0;
+            for (let j = i; j < i + n; j++) {
+                fwdA[j] = s;
+                fwdB[j] = t;
+                parts[j] = part;
+            }
+            backA.fill(i, s, t);
+            backB.fill(i + n, s, t);
+        }
+    };
+    const drop = (from, to) => {
+        for (let k = from; k < to; k++)
+            fwdA[at[k] ?? -1] = -1;
+    };
+    const insert = (rFrom, rTo) => {
+        backA.fill(-1, rFrom, rTo);
+    };
+    align(a, e + 1, 0, u.protocol.length, 'fold', 1);
+    let k = e + 1;
+    while (k < b && (ch(k) === '/' || ch(k) === '\\'))
+        k++;
+    drop(e + 1, k);
+    insert(u.protocol.length, u.protocol.length + 2);
+    let r = u.protocol.length + 2;
+    let end = k;
+    while (end < b && !'/\\?#'.includes(ch(end)))
+        end++;
+    let lastAt = -1;
+    for (let j = k; j < end; j++)
+        if (ch(j) === '@')
+            lastAt = j;
+    if (lastAt >= 0) {
+        let colon = lastAt;
+        for (let j = k; j < lastAt; j++)
+            if (ch(j) === ':') {
+                colon = j;
+                break;
+            }
+        align(k, colon, r, r + u.username.length, 'encoded', 2);
+        r += u.username.length;
+        if (colon < lastAt) {
+            if (u.password !== '') {
+                align(colon, colon + 1, r, r + 1, 'exact', 2);
+                r += 1;
+            }
+            else
+                drop(colon, colon + 1);
+            align(colon + 1, lastAt, r, r + u.password.length, 'encoded', 2);
+            r += u.password.length;
+        }
+        if (userinfo !== '') {
+            align(lastAt, lastAt + 1, r, r + 1, 'exact', 3);
+            r += 1;
+        }
+        else
+            drop(lastAt, lastAt + 1);
+        k = lastAt + 1;
+    }
+    let portColon = end;
+    let bracket = false;
+    for (let j = k; j < end; j++) {
+        const c = ch(j);
+        if (c === '[')
+            bracket = true;
+        else if (c === ']')
+            bracket = false;
+        else if (c === ':' && !bracket) {
+            portColon = j;
+            break;
+        }
+    }
+    align(k, portColon, r, r + u.hostname.length, 'fold', 4);
+    r += u.hostname.length;
+    if (portColon < end) {
+        if (u.port !== '') {
+            align(portColon, end, r, r + 1 + u.port.length, 'exact', 5);
+            r += 1 + u.port.length;
+        }
+        else
+            drop(portColon, end);
+    }
+    let q = end;
+    if (q < b && (ch(q) === '/' || ch(q) === '\\'))
+        while (q < b && ch(q) !== '?' && ch(q) !== '#')
+            q++;
+    if (q === end)
+        insert(r, r + u.pathname.length);
+    else
+        align(end, q, r, r + u.pathname.length, 'path', 6);
+    r += u.pathname.length;
+    let h = q;
+    if (h < b && ch(h) === '?')
+        while (h < b && ch(h) !== '#')
+            h++;
+    if (h - q === 1)
+        drop(q, h);
+    else if (h > q)
+        align(q, h, r, r + u.search.length, 'encoded', 7);
+    r += u.search.length;
+    if (b - h === 1)
+        drop(h, b);
+    else if (b > h)
+        align(h, b, r, r + u.hash.length, 'encoded', 8);
+    return out;
+}
+function restoreAtoms(url, c) {
+    const atoms = [];
+    const marks = markerSpans(url);
+    for (let s = 0; s + 1 < marks.length; s += 2)
+        atoms.push([marks[s] ?? 0, marks[s + 1] ?? 0]);
+    for (let i = url.indexOf('\\'); i >= 0; i = url.indexOf('\\', i + 1)) {
+        const end = outletAtomEnd(url, i);
+        if (end > i)
+            atoms.push([i, end]);
+    }
+    atoms.sort((x, y) => x[0] - y[0]);
+    const [fwdA, fwdB] = c.toRebuilt;
+    const [backA, backB] = c.toOriginal;
+    const swaps = [];
+    for (const [from, to] of atoms) {
+        let ok = (fwdA[from] ?? -1) >= 0;
+        for (let i = from; ok && i + 1 < to; i++)
+            ok = (fwdA[i + 1] ?? -1) >= 0 && fwdB[i] === fwdA[i + 1];
+        if (ok)
+            swaps.push(fwdA[from] ?? 0, fwdB[to - 1] ?? 0, from, to);
+    }
+    if (swaps.length === 0)
+        return c;
+    const old = c.text;
+    const shift = new Int32Array(old.length + 1);
+    let text = '';
+    const nA = [];
+    const nB = [];
+    let w = 0;
+    for (let k = 0; k <= old.length;) {
+        if (w < swaps.length && k === swaps[w]) {
+            const rTo = swaps[w + 1] ?? k;
+            const from = swaps[w + 2] ?? 0;
+            const to = swaps[w + 3] ?? 0;
+            shift[k] = text.length;
+            for (let j = k + 1; j < rTo; j++)
+                shift[j] = -1;
+            for (let i = from; i < to; i++) {
+                fwdA[i] = text.length;
+                fwdB[i] = text.length + 1;
+                nA.push(i);
+                nB.push(i + 1);
+                text += url.charAt(i);
+            }
+            w += 4;
+            k = rTo;
+            continue;
+        }
+        shift[k] = text.length;
+        if (k < old.length) {
+            nA.push(backA[k] ?? -2);
+            nB.push(backB[k] ?? -2);
+            text += old.charAt(k);
+        }
+        k++;
+    }
+    const inSwap = new Uint8Array(url.length);
+    for (let s = 0; s < swaps.length; s += 4)
+        inSwap.fill(1, swaps[s + 2], swaps[s + 3]);
+    for (let i = 0; i < url.length; i++) {
+        if (inSwap[i] === 1 || (fwdA[i] ?? -2) < 0)
+            continue;
+        fwdA[i] = shift[fwdA[i] ?? 0] ?? -2;
+        fwdB[i] = shift[fwdB[i] ?? 0] ?? -2;
+    }
+    return { text, toRebuilt: [fwdA, fwdB], toOriginal: [Int32Array.from(nA), Int32Array.from(nB)], parts: c.parts };
+}
+function hiddenUnits(text, queryByShape) {
+    const r = scanAndMask(text, scanOptionsOf({}, publicFace({}), queryByShape, true), true);
+    const hidden = new Uint8Array(text.length);
+    if (r.text !== text) {
+        if (r.origin === undefined)
+            return null;
+        hidden.fill(1);
+        for (const k of r.origin)
+            if (k >= 0)
+                hidden[k] = 0;
+    }
+    return hidden;
+}
+function coversHidden(from, to, image) {
+    for (let i = 0; i < from.length; i++) {
+        if (from[i] !== 1)
+            continue;
+        const s = image[0][i] ?? -2;
+        if (s === -1)
+            continue;
+        if (s === -2)
+            return false;
+        for (let k = s; k < (image[1][i] ?? s); k++)
+            if (to[k] !== 1)
+                return false;
+    }
+    return true;
+}
+const CONFIGURED_ADDRESS_WITHHELD = Object.freeze({ withheld: true });
+function rebuiltKeepsRuns(url, rebuilt, hidden) {
+    const [fwdA, fwdB] = rebuilt.toRebuilt;
+    for (let i = 0; i < url.length;) {
+        if (hidden[i] !== 1) {
+            i++;
+            continue;
+        }
+        let j = i;
+        while (j < url.length && hidden[j] === 1)
+            j++;
+        const s = fwdA[i] ?? -2;
+        const t = fwdB[j - 1] ?? -2;
+        if (s < 0 || t - s !== j - i || rebuilt.text.slice(s, t) !== url.slice(i, j))
+            return false;
+        for (let k = i; k < j; k++)
+            if (rebuilt.parts[k] !== rebuilt.parts[i])
+                return false;
+        i = j;
+    }
+    return true;
+}
+function readingOf(url, rebuilt, n1) {
+    if (!n1) {
+        const hidden = hiddenUnits(url, 'strict');
+        return hidden !== null && rebuiltKeepsRuns(url, rebuilt, hidden) ? { withheld: false, text: rebuilt.text } : CONFIGURED_ADDRESS_WITHHELD;
+    }
+    let original = true;
+    let viaRebuilt = true;
+    for (const mode of ['relaxed', 'strict']) {
+        const hiddenOriginal = hiddenUnits(url, mode);
+        const hiddenRebuilt = hiddenUnits(rebuilt.text, mode);
+        if (hiddenOriginal === null || hiddenRebuilt === null)
+            return CONFIGURED_ADDRESS_WITHHELD;
+        original &&= coversHidden(hiddenRebuilt, hiddenOriginal, rebuilt.toOriginal);
+        viaRebuilt &&= coversHidden(hiddenOriginal, hiddenRebuilt, rebuilt.toRebuilt);
+    }
+    return original ? { withheld: false, text: url } : viaRebuilt ? { withheld: false, text: rebuilt.text } : CONFIGURED_ADDRESS_WITHHELD;
+}
+function configuredAddressReading(url) {
+    const view = parserViewOf(url);
+    if (userinfoBoundaryAmbiguous(view))
+        return CONFIGURED_ADDRESS_WITHHELD;
+    if (!/^[A-Za-z][A-Za-z0-9+.-]*:/.test(view))
+        return { withheld: false, text: url };
+    if (/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(view)) {
+        const n1 = authorityHasBackslash(view) ? rebuiltAddress(url) : null;
+        return n1 === null ? { withheld: false, text: url } : readingOf(url, restoreAtoms(url, n1), true);
+    }
+    const rebuilt = rebuiltAddress(url);
+    if (rebuilt !== null)
+        return readingOf(url, rebuilt, false);
+    if (/^(?:https?|wss?|ftp):/i.test(view) && /[@?#]/.test(view) && !schemelessUserinfoLeads(view))
+        return CONFIGURED_ADDRESS_WITHHELD;
+    return { withheld: false, text: url };
+}
+function schemelessUserinfoLeads(view) {
+    const V = buildScanView(view, WASH_OPTIONS);
+    const S = separatedSurface(view, V);
+    const out = [];
+    userinfoCandidates(S, out, true);
+    return out.some((c) => c.kind === 'userinfo' && S.rawStart(c.a) === 0);
+}
+export function configuredValueCarriesCredential(value) {
+    if (typeof value !== 'string' || value.length === 0)
+        return false;
+    const reading = configuredAddressReading(value);
+    if (reading.withheld)
+        return true;
+    const text = reading.text;
+    const r = scanAndMask(text, scanOptionsOf({}, publicFace({}), 'strict', true), true);
+    const origin = r.origin;
+    if (r.text === text || origin === undefined)
+        return false;
+    let prevVisible = -1;
+    for (let k = 0; k < r.text.length;) {
+        const o = origin[k] ?? -1;
+        if (o >= 0) {
+            prevVisible = o;
+            k++;
+            continue;
+        }
+        let e = k;
+        while (e < r.text.length && (origin[e] ?? -1) < 0)
+            e++;
+        const hiddenStart = prevVisible + 1;
+        const hiddenEnd = e < r.text.length ? (origin[e] ?? text.length) : text.length;
+        const shown = r.text.slice(k, e);
+        const re = new RegExp(MARKER_ANYWHERE.source, MARKER_ANYWHERE.flags);
+        for (let m = re.exec(shown); m !== null; m = re.exec(shown)) {
+            const kind = KIND_BY_TEXT.get(m[0]);
+            if (kind === 'userinfo' || kind === 'query' || kind === 'secret')
+                return true;
+            if (kind === 'fragment') {
+                if (hiddenStart === 0 || text[hiddenStart - 1] !== '#')
+                    return true;
+                if (queryCarriesCredential(text.slice(hiddenStart, hiddenEnd)))
+                    return true;
+            }
+        }
+        k = e;
+    }
+    return false;
 }
 export function quoteUntrustedForSentence(text, max) {
     const shown = displayUntrusted(text, { max, blanks: true, escapeBackslashes: true });