@sema-agent/client-core 0.82.7 → 0.83.1

package/dist/displayUntrusted.js

@@ -0,0 +1,1437 @@
+export const REDACTION_MARKER_PREFIX = '\u00abredacted';
+const MARKER_RE = /^\u00abredacted(?::[a-z-]{1,16}){0,2}\u00bb$/;
+const REDACTED_USERINFO = '\u00abredacted:userinfo\u00bb';
+const REDACTED_QUERY = '\u00abredacted:query\u00bb';
+const REDACTED_FRAGMENT = '\u00abredacted:fragment\u00bb';
+const REDACTED_SECRET = '\u00abredacted:secret\u00bb';
+const RETIRED_MARKER = '***';
+function isMarker(v) {
+    const core = v.includes(VIEW_SEPARATOR) ? v.split(VIEW_SEPARATOR).join('') : v;
+    return core === RETIRED_MARKER || MARKER_RE.test(core);
+}
+const VIEW_SEPARATOR = '\ufeff';
+function pushEdit(edits, src, start, end, text) {
+    let a = start;
+    let b = end;
+    while (a < b && src[a] === VIEW_SEPARATOR)
+        a++;
+    while (b > a && src[b - 1] === VIEW_SEPARATOR)
+        b--;
+    if (a === b && b !== end)
+        a = b = start;
+    if (src.slice(a, b) === text)
+        return;
+    edits.push({ start: a, end: b, text });
+}
+function applyEdits(text, edits) {
+    if (edits.length === 0)
+        return text;
+    const parts = [];
+    let cursor = 0;
+    for (const e of edits) {
+        parts.push(text.slice(cursor, e.start), e.text);
+        cursor = e.end;
+    }
+    parts.push(text.slice(cursor));
+    return parts.join('');
+}
+class PlainTarget {
+    text;
+    constructor(text) {
+        this.text = text;
+    }
+    apply(edits) {
+        this.text = applyEdits(this.text, edits);
+    }
+}
+class TrackedTarget {
+    text;
+    src;
+    spans = [];
+    viewLength;
+    constructor(text, viewLength) {
+        this.text = text;
+        this.viewLength = viewLength;
+        this.src = new Int32Array(text.length);
+        for (let k = 0; k < text.length; k++)
+            this.src[k] = k;
+    }
+    rangeStart(k) {
+        const s = this.src[k] ?? 0;
+        return s >= 0 ? s : (this.spans[2 * (-1 - s)] ?? 0);
+    }
+    rangeEnd(k) {
+        const s = this.src[k] ?? 0;
+        return s >= 0 ? s + 1 : (this.spans[2 * (-1 - s) + 1] ?? 0);
+    }
+    apply(edits) {
+        if (edits.length === 0)
+            return;
+        let length = this.text.length;
+        for (const e of edits)
+            length += e.text.length - (e.end - e.start);
+        const src = new Int32Array(length);
+        const parts = [];
+        let cursor = 0;
+        let w = 0;
+        for (const e of edits) {
+            src.set(this.src.subarray(cursor, e.start), w);
+            w += e.start - cursor;
+            parts.push(this.text.slice(cursor, e.start), e.text);
+            let a;
+            let b;
+            if (e.start === e.end) {
+                a = e.start < this.text.length ? this.rangeStart(e.start) : this.viewLength;
+                b = a;
+            }
+            else {
+                a = this.rangeStart(e.start);
+                b = this.rangeEnd(e.start);
+                for (let k = e.start + 1; k < e.end; k++) {
+                    a = Math.min(a, this.rangeStart(k));
+                    b = Math.max(b, this.rangeEnd(k));
+                }
+            }
+            const id = this.spans.length / 2;
+            this.spans.push(a, b);
+            src.fill(-1 - id, w, w + e.text.length);
+            w += e.text.length;
+            cursor = e.end;
+        }
+        src.set(this.src.subarray(cursor), w);
+        parts.push(this.text.slice(cursor));
+        this.text = parts.join('');
+        this.src = src;
+    }
+}
+const SECRET_LITERAL_RE = /^(sk-|gh[opus]_|github_pat_|xox[baprse]-|xapp-|bearer\s|basic\s|eyJ[A-Za-z0-9_-]{10,}\.|AKIA[0-9A-Z]{12,}|AIza[0-9A-Za-z_-]{20,}|-----BEGIN[A-Z0-9 ]*PRIVATE KEY)/i;
+const SCHEME_TOKEN_RE = /(?:^|[^A-Za-z0-9_-])(?:bearer|basic)[ \t]+\S{8,4096}/i;
+const JWT_RE = /(?:^|[^A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{8,2048}\.[A-Za-z0-9_-]{8,2048}\.[A-Za-z0-9_-]{4,2048}/i;
+function scanForSecretLiteral(s) {
+    if (SECRET_LITERAL_RE.test(s) || SCHEME_TOKEN_RE.test(s) || JWT_RE.test(s))
+        return true;
+    return s.split(/[^A-Za-z0-9_-]+/).some(tok => tok !== '' && SECRET_LITERAL_RE.test(tok));
+}
+function decodeAsciiEscapes(s) {
+    return s.replace(/%[0-9A-Fa-f]{2}/g, esc => {
+        const code = Number.parseInt(esc.slice(1), 16);
+        return code < 0x80 ? String.fromCharCode(code) : esc;
+    });
+}
+export function looksLikeKnownSecret(s) {
+    let cur = s;
+    for (let layer = 0; layer < 4; layer++) {
+        if (scanForSecretLiteral(cur))
+            return true;
+        const next = decodeAsciiEscapes(cur);
+        if (next === cur)
+            break;
+        cur = next;
+    }
+    return false;
+}
+const TOKEN_STOP = new Set(['"', '<', '>', '`', '|', '\\', '^', '{', '}']);
+const TRAILING_PUNCTUATION = new Set(['.', ',', ';', ':', '!', '?', "'"]);
+const VALUE_BOUNDARY_TAIL = /[?#&=;]$/;
+const isWhitespaceOrControl = (ch) => {
+    const c = ch.charCodeAt(0);
+    return c <= 0x20 || c === 0x7f;
+};
+const isSchemeChar = (ch) => (ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z') || (ch >= '0' && ch <= '9') || ch === '+' || ch === '.' || ch === '-';
+const isAlpha = (ch) => (ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z');
+const isHexDigit = (ch) => (ch >= '0' && ch <= '9') || (ch >= 'a' && ch <= 'f') || (ch >= 'A' && ch <= 'F');
+function isRegexSpace(c) {
+    return ((c >= 0x09 && c <= 0x0d) || c === 0x20 || c === 0xa0 || c === 0x1680 || (c >= 0x2000 && c <= 0x200a) ||
+        c === 0x2028 || c === 0x2029 || c === 0x202f || c === 0x205f || c === 0x3000 || c === 0xfeff);
+}
+const breaksUserinfo = (c) => c === 0x40 || c === 0x2f || c === 0x3f || c === 0x23 || isRegexSpace(c);
+const blocksUserinfoStart = (c) => (c >= 0x30 && c <= 0x39) || (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a) ||
+    c === 0x2b || c === 0x2e || c === 0x2d || c === 0x40 || c === 0x3a;
+const isHostChar = (c) => (c >= 0x30 && c <= 0x39) || (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a) ||
+    c === 0x2d || c === 0x2e || c === 0x5f || c === 0x7e || c === 0x25;
+const isIpv6Char = (c) => (c >= 0x30 && c <= 0x3a) || (c >= 0x41 && c <= 0x46) || (c >= 0x61 && c <= 0x66) || c === 0x2e;
+const endsSchemelessHost = (c) => Number.isNaN(c) || c === 0x2f || c === 0x3f || c === 0x23 || c === 0x22 || c === 0x3c || c === 0x3e || c === 0x60 ||
+    c === 0x7c || c === 0x5c || c === 0x5e || c === 0x7b || c === 0x7d || isRegexSpace(c);
+function schemelessHostEnd(text, from) {
+    let k = from;
+    if (text.charCodeAt(k) === 0x5b) {
+        k++;
+        while (k < text.length && isIpv6Char(text.charCodeAt(k)))
+            k++;
+        if (k - from - 1 < 2 || text.charCodeAt(k) !== 0x5d)
+            return -1;
+        k++;
+    }
+    else {
+        while (k < text.length && isHostChar(text.charCodeAt(k)))
+            k++;
+        if (k === from)
+            return -1;
+    }
+    if (text.charCodeAt(k) === 0x3a) {
+        let d = k + 1;
+        while (d < text.length && text.charCodeAt(d) >= 0x30 && text.charCodeAt(d) <= 0x39)
+            d++;
+        if (d > k + 1)
+            k = d;
+    }
+    return endsSchemelessHost(text.charCodeAt(k)) ? k : -1;
+}
+function valueCoreForJudging(value) {
+    if (value.length === 0 || isMarker(value))
+        return '';
+    let end = value.length;
+    while (end > 0 && TRAILING_PUNCTUATION.has(value.charAt(end - 1)))
+        end--;
+    return value.slice(0, end);
+}
+function isKnownSecretSegment(value) {
+    const core = valueCoreForJudging(value);
+    return core.length > 0 && looksLikeKnownSecret(core);
+}
+function queryEdits(src, base, query, edits) {
+    let pos = base;
+    for (const part of query.split('&')) {
+        if (part.length > 0) {
+            const eq = part.indexOf('=');
+            if (eq === -1) {
+                if (!isMarker(part))
+                    pushEdit(edits, src, pos, pos + part.length, REDACTED_QUERY);
+            }
+            else {
+                const value = part.slice(eq + 1);
+                if (value.length > 0 && !isMarker(value))
+                    pushEdit(edits, src, pos + eq + 1, pos + part.length, REDACTED_QUERY);
+            }
+        }
+        pos += part.length + 1;
+    }
+}
+function pathEdits(src, base, path, opaqueSegments, edits) {
+    let pos = base;
+    for (const segment of path.split('/')) {
+        const semi = segment.indexOf(';');
+        const head = semi === -1 ? segment : segment.slice(0, semi);
+        if (opaqueSegments && isKnownSecretSegment(head))
+            pushEdit(edits, src, pos, pos + head.length, REDACTED_SECRET);
+        if (semi !== -1) {
+            let ppos = pos + semi + 1;
+            for (const part of segment.slice(semi + 1).split(';')) {
+                const eq = part.indexOf('=');
+                if (eq !== -1) {
+                    const value = part.slice(eq + 1);
+                    if (value.length > 0 && !isMarker(value))
+                        pushEdit(edits, src, ppos + eq + 1, ppos + part.length, REDACTED_QUERY);
+                }
+                ppos += part.length + 1;
+            }
+        }
+        pos += segment.length + 1;
+    }
+}
+function urlTokenEditsAt(src, start, end, edits) {
+    const token = src.slice(start, end);
+    const schemeEnd = token.indexOf('://') + '://'.length;
+    const scheme = token.slice(0, schemeEnd);
+    const rest = token.slice(schemeEnd);
+    const authorityEnd = rest.search(/[/?#]/);
+    const authority = authorityEnd === -1 ? rest : rest.slice(0, authorityEnd);
+    const tailStart = schemeEnd + authority.length;
+    const tail = token.slice(tailStart);
+    const at = authority.lastIndexOf('@');
+    if (at !== -1)
+        pushEdit(edits, src, start + schemeEnd, start + schemeEnd + at, REDACTED_USERINFO);
+    const hash = tail.indexOf('#');
+    const beforeHash = hash === -1 ? tail : tail.slice(0, hash);
+    const question = beforeHash.indexOf('?');
+    const path = question === -1 ? beforeHash : beforeHash.slice(0, question);
+    pathEdits(src, start + tailStart, path, !/^file:/i.test(scheme), edits);
+    if (question !== -1)
+        queryEdits(src, start + tailStart + question + 1, beforeHash.slice(question + 1), edits);
+    if (hash !== -1) {
+        const rawFragment = tail.slice(hash + 1);
+        if (rawFragment.length > 0 && !isMarker(rawFragment))
+            pushEdit(edits, src, start + tailStart + hash + 1, end, REDACTED_FRAGMENT);
+    }
+}
+function urlTokenEdits(text) {
+    const edits = [];
+    let mark = text.indexOf('://');
+    while (mark !== -1) {
+        let start = mark;
+        while (start > 0 && isSchemeChar(text.charAt(start - 1)))
+            start--;
+        while (start < mark && !isAlpha(text.charAt(start)))
+            start++;
+        if (start === mark) {
+            mark = text.indexOf('://', mark + 3);
+            continue;
+        }
+        let end = mark + 3;
+        while (end < text.length) {
+            const ch = text.charAt(end);
+            if (isWhitespaceOrControl(ch) || TOKEN_STOP.has(ch))
+                break;
+            if (ch === VIEW_SEPARATOR) {
+                let p = end;
+                while (p < text.length && text[p] === VIEW_SEPARATOR)
+                    p++;
+                if (credentialWordStartsNear(text, p))
+                    break;
+                end = p;
+                continue;
+            }
+            end++;
+        }
+        while (end > mark + 3 && text.charAt(end - 1) === VIEW_SEPARATOR)
+            end--;
+        let runStart = end;
+        while (runStart > mark + 3 && TRAILING_PUNCTUATION.has(text.charAt(runStart - 1)))
+            runStart--;
+        if (runStart < end && !VALUE_BOUNDARY_TAIL.test(text.slice(start, runStart)))
+            end = runStart;
+        urlTokenEditsAt(text, start, end, edits);
+        mark = text.indexOf('://', end > mark + 3 ? end : mark + 3);
+    }
+    return edits;
+}
+const MARKER_ANYWHERE = /\u00abredacted(?::[a-z-]{1,16}){0,2}\u00bb/g;
+function markerSpans(text) {
+    const spans = [];
+    if (!text.includes(REDACTION_MARKER_PREFIX))
+        return spans;
+    const re = new RegExp(MARKER_ANYWHERE.source, MARKER_ANYWHERE.flags);
+    for (let hit = re.exec(text); hit !== null; hit = re.exec(text))
+        spans.push(hit.index, hit.index + hit[0].length);
+    return spans;
+}
+function schemelessUserinfoEdits(text) {
+    const edits = [];
+    const markers = markerSpans(text);
+    let m = 0;
+    let floor = 0;
+    for (let at = text.indexOf('@'); at !== -1; at = text.indexOf('@', at + 1)) {
+        const hostEnd = schemelessHostEnd(text, at + 1);
+        if (hostEnd === -1)
+            continue;
+        let runStart = at;
+        while (runStart > floor && !breaksUserinfo(text.charCodeAt(runStart - 1)))
+            runStart--;
+        let found = -1;
+        let colon = -1;
+        let s = runStart;
+        while (s + 2 < at) {
+            if (colon < s) {
+                colon = s;
+                while (colon < at && text.charCodeAt(colon) !== 0x3a)
+                    colon++;
+            }
+            if (colon + 1 >= at)
+                break;
+            if (colon === s) {
+                s++;
+                continue;
+            }
+            while (m < markers.length && (markers[m + 1] ?? 0) <= colon)
+                m += 2;
+            if (m < markers.length && (markers[m] ?? 0) <= colon) {
+                s = colon + 1;
+                continue;
+            }
+            const prev = s === 0 ? -1 : text.charCodeAt(s - 1);
+            const midPair = prev >= 0xd800 && prev <= 0xdbff && (text.charCodeAt(s) & 0xfc00) === 0xdc00;
+            if ((prev === -1 || !blocksUserinfoStart(prev)) && !midPair) {
+                found = s;
+                break;
+            }
+            s++;
+        }
+        if (found === -1)
+            continue;
+        pushEdit(edits, text, found, at, REDACTED_USERINFO);
+        floor = hostEnd;
+    }
+    return edits;
+}
+const MAX_URL_WASH_PASSES = 4;
+function washUrlNets(target) {
+    for (let pass = 0; pass < MAX_URL_WASH_PASSES; pass++) {
+        target.apply(urlTokenEdits(target.text));
+        const handedOff = schemelessUserinfoEdits(target.text);
+        target.apply(handedOff);
+        if (handedOff.length === 0)
+            return;
+    }
+}
+const SECRET_SCHEME_WORD = /(?:\b|(?<=\\[A-Za-z"']))(bearer|basic)[\s:=\uFF1A\uFF1D]+/gi;
+const SECRET_LABELLED_WORD = /(?:\b|(?<=_)|(?<=\\[A-Za-z"']))((?:access[-_ ]?|refresh[-_ ]?|id[-_ ]?|client[-_ ]?|api[-_ ]?|x[-_]api[-_ ]?|session[-_ ]?|auth[-_ ]?)?(?:token|key|secret|password|authorization|credential)s?)(?:\\*["'])?\s*[:=\uFF1A\uFF1D]\s*/gi;
+const DIAGNOSTIC_VALUE_WORDS = new Set([
+    'missing', 'required', 'invalid', 'expired', 'unauthorized', 'unauthenticated', 'authentication',
+    'authorization', 'credential', 'credentials', 'unsupported', 'malformed', 'rejected', 'absent',
+    'empty', 'undefined', 'null', 'none', 'unknown', 'forbidden', 'redacted', 'notprovided', 'notfound',
+    'mismatch', 'revoked', 'disabled', 'unavailable', 'incorrect',
+    'not', 'no', 'set', 'unset', 'blank', 'value', 'values', 'of', 'the', 'a', 'an', 'is', 'was', 'are',
+    'for', 'to', 'in', 'on', 'and', 'or', 'from', 'with', 'at', 'by', 'this', 'that', 'it', 'be', 'must',
+    'should', 'can', 'cannot', 'true', 'false', 'yes', 'ok', 'n/a', 'na',
+    'bearer', 'basic', 'digest', 'hmac', 'oauth', 'oauth2', 'jwt', 'apikey', 'api-key',
+]);
+const SCHEME_FOLLOWER_WORDS = new Set([
+    'token', 'tokens', 'auth', 'authentication', 'authorization', 'header', 'headers', 'scheme', 'schemes', 'realm',
+    'challenge', 'access', 'login', 'prefix', 'format', 'type', 'mode', 'method', 'flow', 'grant', 'usage', 'example',
+    'setup', 'plan', 'tier', 'info', 'information', 'support', 'level', 'string', 'config', 'configuration', 'settings',
+    'version', 'check', 'validation', 'error', 'errors', 'failed', 'failure', 'credentials', 'user', 'username',
+]);
+const AUTH_SCHEME_WORDS = new Set([
+    'bearer', 'basic', 'digest', 'token', 'bot', 'ssws', 'api-key', 'apikey', 'key', 'hmac', 'oauth', 'oauth2', 'jwt',
+    'negotiate', 'ntlm', 'hawk', 'mac', 'dsn', 'splunk', 'sapisidhash', 'googlelogin', 'aws', 'client-id', 'pat',
+]);
+const AUTH_SIGNATURE_SCHEME = /^[A-Z][A-Z0-9]*(?:-[A-Z0-9]+){2,}$/;
+const BARE_VALUE_STOP_CHARS = new Set([',', ';', '"', "'", '\\', '(', ')', '[', ']', '{', '}', '<', '>']);
+const isBareValueStop = (ch) => ch <= ' ' || BARE_VALUE_STOP_CHARS.has(ch);
+class InnerWordIndex {
+    text;
+    probes;
+    constructor(text) {
+        this.text = text;
+        this.probes = [
+            { re: new RegExp(SECRET_LABELLED_WORD.source, SECRET_LABELLED_WORD.flags), scheme: false, from: -1, hit: null },
+            { re: new RegExp(SECRET_SCHEME_WORD.source, SECRET_SCHEME_WORD.flags), scheme: true, from: -1, hit: null },
+        ];
+    }
+    next(q) {
+        let best = null;
+        for (const p of this.probes) {
+            const reusable = p.from !== -1 && q >= p.from && (p.hit === null || q <= p.hit.start);
+            if (!reusable) {
+                p.re.lastIndex = q;
+                const m = p.re.exec(this.text);
+                p.from = q;
+                if (m === null)
+                    p.hit = null;
+                else {
+                    const sep = p.scheme ? (m[1] ?? '').length : m[0].search(/[:=：＝]/);
+                    p.hit = { start: m.index, sepAt: m.index + Math.max(0, sep) };
+                }
+            }
+            if (p.hit !== null && (best === null || p.hit.start < best.start))
+                best = p.hit;
+        }
+        return best;
+    }
+}
+function innerWordFits(text, w) {
+    for (let k = w.start; k <= w.sepAt && k < text.length; k++)
+        if (isBareValueStop(text.charAt(k)))
+            return false;
+    return true;
+}
+const isCutDelimiter = (ch) => ch === '&' || ch === '|' || ch === '.';
+function scanSecretValue(text, from, idx) {
+    let i = from;
+    let slashes = 0;
+    while (i < text.length && text[i] === '\\') {
+        i++;
+        slashes++;
+    }
+    const q = text[i];
+    if (q === '"' || q === "'") {
+        const open = i + 1;
+        const trimmed = (end) => {
+            let a = open;
+            let b = end;
+            while (a < b && text[a] === VIEW_SEPARATOR)
+                a++;
+            while (b > a && text[b - 1] === VIEW_SEPARATOR)
+                b--;
+            return b > a ? { start: a, end: b } : null;
+        };
+        if (slashes > 0) {
+            const close = text.indexOf('\\' + q, open);
+            return trimmed(close === -1 ? text.length : close);
+        }
+        let j = open;
+        while (j < text.length) {
+            if (text[j] === '\\') {
+                j += 2;
+                continue;
+            }
+            if (text[j] === q)
+                return trimmed(j);
+            j++;
+        }
+        return trimmed(text.length);
+    }
+    const markerAt = new RegExp(MARKER_ANYWHERE.source, 'y');
+    markerAt.lastIndex = i;
+    const leadMarker = markerAt.exec(text);
+    if (leadMarker !== null) {
+        const k = i + leadMarker[0].length;
+        if (/^(?:&+[^\s&=#"'<>`|\\^{}]{1,128}=|#\u00abredacted:)/.test(text.slice(k, k + 160)))
+            return { start: i, end: k };
+    }
+    const head = text.slice(i, i + 64);
+    const cuttable = idx !== undefined && !ADDRESS_SCHEME_RE.test(head) && !withoutSeparators(head).startsWith(`${REDACTED_USERINFO}@`);
+    let pending = cuttable ? idx.next(i + 1) : null;
+    let cut = false;
+    let j = i;
+    while (j < text.length) {
+        if (pending !== null && j >= pending.start) {
+            if (j === pending.start && innerWordFits(text, pending)) {
+                cut = true;
+                break;
+            }
+            pending = null;
+        }
+        const ch = text.charAt(j);
+        if (isBareValueStop(ch))
+            break;
+        if (ch === VIEW_SEPARATOR) {
+            let p = j;
+            while (p < text.length && text[p] === VIEW_SEPARATOR)
+                p++;
+            if (credentialWordStartsNear(text, p))
+                break;
+            j = p;
+            continue;
+        }
+        j++;
+    }
+    while (j > i && text[j - 1] === VIEW_SEPARATOR)
+        j--;
+    if (cut) {
+        while (j > i && isCutDelimiter(text.charAt(j - 1))) {
+            j--;
+            while (j > i && text[j - 1] === VIEW_SEPARATOR)
+                j--;
+        }
+    }
+    return j > i ? { start: i, end: j } : null;
+}
+const ADDRESS_SCHEME_RE = /^[a-z][a-z0-9+.-]{1,15}:\/{2}/i;
+function isDiagnosticValue(value, raw = value) {
+    if (MARKER_RE.test(value) || value === RETIRED_MARKER)
+        return true;
+    if (MARKER_RE.test(value.replace(/^\.+/, '')))
+        return true;
+    if (value.startsWith(`${REDACTED_USERINFO}@`))
+        return true;
+    if (ADDRESS_SCHEME_RE.test(raw))
+        return true;
+    const bare = value.replace(/^\.+/, '').replace(/[.,;:!?)\]}'"]{0,8}$/, '').toLowerCase();
+    return bare === '' || DIAGNOSTIC_VALUE_WORDS.has(bare);
+}
+const TOKEN_COUNT_HEAD_WORDS = new Set([
+    'max', 'min', 'num', 'n', 'input', 'output', 'total', 'prompt', 'completion', 'thinking', 'reasoning',
+    'cache', 'cached', 'context', 'budget', 'used', 'remaining', 'reserved', 'new', 'effective', 'limit',
+    'sampled', 'generated', 'response', 'request', 'cumulative', 'image', 'audio', 'text', 'tool',
+]);
+const isIdentOrDash = (ch) => (ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z') || (ch >= '0' && ch <= '9') || ch === '_' || ch === '-';
+function isTokenCountLabel(text, at, label) {
+    if (label.toLowerCase() !== 'tokens' || at === 0)
+        return false;
+    const sep = text.charAt(at - 1);
+    if (sep !== '_' && sep !== '-')
+        return false;
+    let i = at - 1;
+    while (i > 0 && isIdentOrDash(text.charAt(i - 1)))
+        i--;
+    const head = text.slice(i, at - 1).toLowerCase();
+    const lastSep = Math.max(head.lastIndexOf('_'), head.lastIndexOf('-'));
+    return TOKEN_COUNT_HEAD_WORDS.has(head.slice(lastSep + 1));
+}
+const BACKTICKED_CREDENTIAL_NAME = /^\x60[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+\x60[.,;:!?)]*$/;
+const CREDENTIAL_NAME_SEGMENTS = new Set([
+    'KEY', 'KEYS', 'TOKEN', 'TOKENS', 'SECRET', 'SECRETS', 'PASSWORD', 'PASSWD', 'PWD', 'CREDENTIAL', 'CREDENTIALS',
+    'AUTH', 'APIKEY', 'PAT',
+]);
+function isBacktickedCredentialName(value) {
+    if (!BACKTICKED_CREDENTIAL_NAME.test(value))
+        return false;
+    const name = value.slice(1, value.indexOf('`', 1));
+    return name.split('_').some(seg => CREDENTIAL_NAME_SEGMENTS.has(seg));
+}
+const KEY_NAME_SHAPE = /^(?:[a-z]+(?:[A-Z][a-z]+)*|[a-z]+(?:_[a-z]+)+)$/;
+function isNamedNotValue(label, value) {
+    const l = label.toLowerCase();
+    const core = value.replace(/[.,;:!?)]+$/, '');
+    if (l === 'tokens' && /^[0-9]+$/.test(core))
+        return true;
+    if (l === 'keys' && core.length <= 40 && KEY_NAME_SHAPE.test(core))
+        return true;
+    return isBacktickedCredentialName(value);
+}
+function labelStartsAt(text, at) {
+    const re = new RegExp(SECRET_LABELLED_WORD.source, 'iy');
+    re.lastIndex = at;
+    return re.test(text);
+}
+function credentialWordStartsAt(text, at) {
+    if (at >= text.length)
+        return false;
+    if (labelStartsAt(text, at))
+        return true;
+    const re = new RegExp(SECRET_SCHEME_WORD.source, 'iy');
+    re.lastIndex = at;
+    return re.test(text);
+}
+function credentialWordStartsNear(text, at) {
+    return credentialWordStartsAt(text, at) || credentialWordStartsAt(text, at + 1);
+}
+function percentDecodeForMatching(text) {
+    const chars = [];
+    const offsets = [];
+    let i = 0;
+    while (i < text.length) {
+        if (text.charAt(i) === '%' && isHexDigit(text.charAt(i + 1)) && isHexDigit(text.charAt(i + 2))) {
+            const code = Number.parseInt(text.slice(i + 1, i + 3), 16);
+            if (code < 0x80) {
+                chars.push(String.fromCharCode(code));
+                offsets.push(i);
+                i += 3;
+                continue;
+            }
+        }
+        chars.push(text.charAt(i));
+        offsets.push(i);
+        i += 1;
+    }
+    offsets.push(text.length);
+    return { decoded: chars.join(''), offsets };
+}
+function firstLabelCutInPath(path) {
+    let cut = -1;
+    for (const src of [SECRET_SCHEME_WORD, SECRET_LABELLED_WORD]) {
+        const hit = new RegExp(src.source, src.flags.replace('g', '')).exec(path);
+        if (hit === null)
+            continue;
+        const at = hit.index + hit[0].length;
+        if (at >= path.length)
+            continue;
+        if (cut === -1 || at < cut)
+            cut = at;
+    }
+    return cut;
+}
+function pathCutAfterFirstLabel(path) {
+    let cut = firstLabelCutInPath(path);
+    const { decoded, offsets } = percentDecodeForMatching(path);
+    if (decoded !== path) {
+        const decodedCut = firstLabelCutInPath(decoded);
+        if (decodedCut !== -1) {
+            const mapped = offsets[decodedCut] ?? path.length;
+            if (mapped < path.length && (cut === -1 || mapped < cut))
+                cut = mapped;
+        }
+    }
+    return cut;
+}
+function hostTokenIsLabel(afterUserinfo, hostEnd) {
+    const re = new RegExp(SECRET_LABELLED_WORD.source, SECRET_LABELLED_WORD.flags);
+    for (let hit = re.exec(afterUserinfo); hit !== null && hit.index <= hostEnd; hit = re.exec(afterUserinfo)) {
+        const sepEnd = hit.index + hit[0].length;
+        const rest = afterUserinfo.slice(sepEnd);
+        const bareColon = hit[0].endsWith(':') && !/[\s=\uFF1A\uFF1D]/.test(hit[0]);
+        const hostBefore = afterUserinfo.slice(0, sepEnd - 1);
+        const port = /^([0-9]{1,5})(?:[/?#]|$)/.exec(rest);
+        const hostNameOnly = /^[A-Za-z0-9\u00a1-\uffff](?:[A-Za-z0-9\u00a1-\uffff-]*[A-Za-z0-9\u00a1-\uffff])?(?:\.[A-Za-z0-9\u00a1-\uffff](?:[A-Za-z0-9\u00a1-\uffff-]*[A-Za-z0-9\u00a1-\uffff])?)*$/;
+        const portLike = bareColon && hostNameOnly.test(hostBefore) && port !== null && Number(port[1]) <= 65535;
+        if (!portLike)
+            return true;
+    }
+    return false;
+}
+function exemptAddressEdits(src, from, to, edits) {
+    const value = src.slice(from, to);
+    const q = value.search(/[?#]/);
+    const prefix = q === -1 ? value : value.slice(0, q);
+    const scheme = ADDRESS_SCHEME_RE.exec(prefix)?.[0] ?? '';
+    const slash = prefix.indexOf('/', scheme.length);
+    const rawAuthority = slash === -1 ? prefix.slice(scheme.length) : prefix.slice(scheme.length, slash);
+    const at = rawAuthority.lastIndexOf('@');
+    if (at !== -1)
+        pushEdit(edits, src, from + scheme.length, from + scheme.length + at, REDACTED_USERINFO);
+    const hostPort = at === -1 ? rawAuthority : `${REDACTED_USERINFO}@${rawAuthority.slice(at + 1)}`;
+    const userinfoLen = at === -1 ? 0 : REDACTED_USERINFO.length + 1;
+    const hostEnd = /^(?:\[[0-9A-Fa-f:.]*\]|[A-Za-z0-9._\u00a1-\uffff-]*)(?::[A-Za-z0-9]*)?/.exec(hostPort.slice(userinfoLen))?.[0].length ?? 0;
+    const cut = hostTokenIsLabel(hostPort.slice(userinfoLen), hostEnd) ? userinfoLen : userinfoLen + hostEnd;
+    const pathStart = scheme.length + (at === -1 ? cut : at + 1 + (cut - userinfoLen));
+    const pathEnd = q === -1 ? value.length : q;
+    const pathCut = pathCutAfterFirstLabel(value.slice(pathStart, pathEnd));
+    if (pathCut !== -1)
+        pushEdit(edits, src, from + pathStart + pathCut, from + pathEnd, REDACTED_SECRET);
+    if (q !== -1)
+        pushEdit(edits, src, from + q + 1, to, value.charAt(q) === '#' ? REDACTED_FRAGMENT : REDACTED_QUERY);
+}
+function isAddressShaped(value, raw = value) {
+    return value.startsWith(`${REDACTED_USERINFO}@`) || ADDRESS_SCHEME_RE.test(raw);
+}
+function addressExtentEnd(text, from) {
+    let end = from;
+    while (end < text.length) {
+        const ch = text.charAt(end);
+        if (ch === '"' || ch === "'") {
+            const prev = end > from ? text.charAt(end - 1) : '';
+            let bs = 0;
+            for (let k = end - 1; k >= from && text[k] === '\\'; k--)
+                bs++;
+            if (bs % 2 === 1) {
+                let j = end + 1;
+                let close = -1;
+                let outer = -1;
+                while (j < text.length) {
+                    if (text[j] === ch) {
+                        let b = 0;
+                        for (let k = j - 1; k > end && text[k] === '\\'; k--)
+                            b++;
+                        if (b % 2 === 1) {
+                            close = j;
+                            break;
+                        }
+                        outer = j;
+                        break;
+                    }
+                    j++;
+                }
+                if (close !== -1) {
+                    end = close + 1;
+                    continue;
+                }
+                end = outer === -1 ? text.length : outer;
+                break;
+            }
+            const next = text.charAt(end + 1);
+            const looksClosing = next === '' || next === ',' || next === '}' || next === ']' || next === ':' || next <= ' ';
+            if ((prev !== '=' && prev !== ':') || looksClosing)
+                break;
+            let j = end + 1;
+            while (j < text.length && text[j] !== ch)
+                j += text[j] === '\\' ? 2 : 1;
+            end = Math.min(j + 1, text.length);
+            continue;
+        }
+        if (ch <= ' ')
+            break;
+        end++;
+    }
+    return end;
+}
+function trailingLabelStart(text, from, end) {
+    const window = text.slice(from, Math.min(text.length, end + 12));
+    const segLen = end - from;
+    let best = -1;
+    for (const src of [SECRET_SCHEME_WORD, SECRET_LABELLED_WORD]) {
+        const re = new RegExp(src.source, src.flags);
+        for (let hit = re.exec(window); hit !== null && hit.index < segLen; hit = re.exec(window)) {
+            if (hit.index + hit[0].length >= segLen && (best === -1 || hit.index < best))
+                best = hit.index;
+        }
+    }
+    return best;
+}
+const withoutSeparators = (s) => (s.includes(VIEW_SEPARATOR) ? s.split(VIEW_SEPARATOR).join('') : s);
+const isHorizontalSpace = (ch) => ch === ' ' || ch === '\t' || ch === '\u00a0' || ch === VIEW_SEPARATOR;
+function labelEdits(text, re) {
+    const edits = [];
+    const schemePass = re === SECRET_SCHEME_WORD;
+    const idx = new InnerWordIndex(text);
+    re.lastIndex = 0;
+    for (let hit = re.exec(text); hit !== null; hit = re.exec(text)) {
+        const label = hit[1] ?? '';
+        if (isTokenCountLabel(text, hit.index, label))
+            continue;
+        const from = hit.index + hit[0].length;
+        if (credentialWordStartsAt(text, from)) {
+            re.lastIndex = from;
+            continue;
+        }
+        const v = scanSecretValue(text, from, idx);
+        if (v === null)
+            continue;
+        if (text.startsWith('-----BEGIN ', v.start)) {
+            re.lastIndex = v.end;
+            continue;
+        }
+        const rawValue = text.slice(v.start, v.end);
+        const value = withoutSeparators(rawValue);
+        const quoted = v.start > 0 && (text[v.start - 1] === '"' || text[v.start - 1] === "'");
+        if (schemePass && !quoted && SCHEME_FOLLOWER_WORDS.has(value.replace(/[.,;:!?)]+$/, '').toLowerCase())) {
+            re.lastIndex = v.end;
+            continue;
+        }
+        if (!schemePass && isNamedNotValue(label, value)) {
+            re.lastIndex = v.end;
+            continue;
+        }
+        if (!schemePass && !quoted && /authorizations?$/i.test(label) && isAuthScheme(value)) {
+            let j = v.end;
+            while (j < text.length && isHorizontalSpace(text.charAt(j)))
+                j++;
+            if (j > v.end && isAuthParamAt(text, j, value)) {
+                re.lastIndex = v.end;
+                continue;
+            }
+            const cred = j > v.end && !labelStartsAt(text, j) ? scanSecretValue(text, j, idx) : null;
+            if (cred !== null) {
+                const credValue = withoutSeparators(text.slice(cred.start, cred.end));
+                const keep = isMarker(credValue) || DIAGNOSTIC_VALUE_WORDS.has(credValue.replace(/[.,;:!?)\]}\x27\x22]+$/, '').toLowerCase());
+                if (!keep)
+                    pushEdit(edits, text, cred.start, cred.end, REDACTED_SECRET);
+                re.lastIndex = cred.end;
+                continue;
+            }
+            re.lastIndex = v.end;
+            continue;
+        }
+        if (isDiagnosticValue(value, rawValue)) {
+            if (isAddressShaped(value, rawValue)) {
+                let end = quoted ? v.end : addressExtentEnd(text, v.start);
+                const trailing = trailingLabelStart(text, v.start, end);
+                if (trailing !== -1)
+                    end = v.start + trailing;
+                exemptAddressEdits(text, v.start, end, edits);
+                re.lastIndex = end;
+                continue;
+            }
+        }
+        else {
+            pushEdit(edits, text, v.start, v.end, REDACTED_SECRET);
+        }
+        re.lastIndex = v.end;
+    }
+    return edits;
+}
+function isAuthParamAt(text, j, scheme) {
+    const p = /^[A-Za-z][A-Za-z0-9_-]*([ \t\ufeff]*)=([ \t\ufeff]*)("|[^\s=,"]+)([ \t\ufeff]*,)?/.exec(text.slice(j, j + 512));
+    if (p === null)
+        return false;
+    if (p[1] === '' && p[2] === '')
+        return true;
+    if (!/^(?:digest|oauth|hawk|mac|hmac)$/i.test(scheme) && !AUTH_SIGNATURE_SCHEME.test(scheme))
+        return false;
+    return !(p[1] === '' && p[3] !== '"' && p[4] === undefined);
+}
+function isAuthScheme(value) {
+    if (isMarker(value))
+        return false;
+    return AUTH_SCHEME_WORDS.has(value.toLowerCase()) || AUTH_SIGNATURE_SCHEME.test(value);
+}
+const isKeyWordChar = (c) => (c >= 0x30 && c <= 0x39) || (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a) || c === 0x5f || c === 0x2d;
+const isAlnumCode = (c) => (c >= 0x30 && c <= 0x39) || (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a);
+const PROSE_LITERAL_MIN_RUN = 16;
+function longestAlnumRun(word) {
+    let best = 0;
+    let run = 0;
+    for (let k = 0; k < word.length; k++) {
+        if (isAlnumCode(word.charCodeAt(k))) {
+            run++;
+            if (run > best)
+                best = run;
+        }
+        else
+            run = 0;
+    }
+    return best;
+}
+const JWT_WORD = /^eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}$/;
+const PEM_BEGIN_SOURCE = '-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----';
+const PEM_END_MARK = '-----END';
+function lineBreakLengthAt(text, at) {
+    if (text.startsWith('\r\n', at))
+        return 2;
+    const c = text.charAt(at);
+    if (c === '\n' || c === '\r')
+        return 1;
+    if (text.startsWith('\\r\\n', at))
+        return 4;
+    if (text.startsWith('\\n', at) || text.startsWith('\\r', at))
+        return 2;
+    return 0;
+}
+function lineBreakLengthBefore(text, at) {
+    if (at >= 2 && text.startsWith('\r\n', at - 2))
+        return 2;
+    const c = text.charAt(at - 1);
+    if (c === '\n' || c === '\r')
+        return 1;
+    if (at >= 4 && text.startsWith('\\r\\n', at - 4))
+        return 4;
+    if (at >= 2 && (text.startsWith('\\n', at - 2) || text.startsWith('\\r', at - 2)))
+        return 2;
+    return 0;
+}
+function pemBodyEndWithoutTrailer(text, from) {
+    let pos = from;
+    let inBody = false;
+    let end = from;
+    while (pos < text.length) {
+        let le = pos;
+        while (le < text.length && lineBreakLengthAt(text, le) === 0)
+            le++;
+        const line = text.slice(pos, le);
+        if (line.trim() === '') {
+            if (inBody)
+                break;
+        }
+        else if (!inBody && /^[A-Za-z][A-Za-z0-9-]*:\s/.test(line)) {
+            end = le;
+        }
+        else {
+            inBody = true;
+            const quote = line.indexOf('"');
+            if (quote !== -1) {
+                end = pos + quote;
+                break;
+            }
+            end = le;
+        }
+        if (le >= text.length)
+            break;
+        pos = le + lineBreakLengthAt(text, le);
+    }
+    return end;
+}
+function pemEdits(text) {
+    const edits = [];
+    if (!text.includes('-----BEGIN '))
+        return edits;
+    const begin = new RegExp(PEM_BEGIN_SOURCE, 'g');
+    let nextEnd = -2;
+    for (let b = begin.exec(text); b !== null; b = begin.exec(text)) {
+        let bodyStart = b.index + b[0].length;
+        const lead = lineBreakLengthAt(text, bodyStart);
+        if (lead > 0)
+            bodyStart += lead;
+        else
+            while (bodyStart < text.length && (text[bodyStart] === ' ' || text[bodyStart] === '\t'))
+                bodyStart++;
+        if (nextEnd !== -1 && nextEnd < bodyStart)
+            nextEnd = text.indexOf(PEM_END_MARK, bodyStart);
+        let bodyEnd;
+        if (nextEnd === -1)
+            bodyEnd = pemBodyEndWithoutTrailer(text, bodyStart);
+        else {
+            bodyEnd = nextEnd;
+            const back = lineBreakLengthBefore(text, bodyEnd);
+            if (back > 0 && bodyEnd - back >= bodyStart)
+                bodyEnd -= back;
+        }
+        if (bodyEnd > bodyStart)
+            pushEdit(edits, text, bodyStart, bodyEnd, REDACTED_SECRET);
+        begin.lastIndex = Math.max(begin.lastIndex, bodyEnd);
+    }
+    return edits;
+}
+function authParamEdits(text) {
+    const edits = [];
+    if (!/authorization/i.test(text))
+        return edits;
+    const header = /(?:\b|(?<=_))(?:proxy-)?authorization["']?[ \t]*[:=]\s*["']?[A-Za-z][A-Za-z0-9._~+/-]*\s+/gi;
+    const param = /([A-Za-z][A-Za-z0-9_-]*)[ \t]*=[ \t]*("(?:[^"\\\n]|\\.)*"?|[^\s,"]*)\s*,?\s*/dy;
+    const signed = /^(?:response|signature|oauth_signature)$/i;
+    for (let h = header.exec(text); h !== null; h = header.exec(text)) {
+        let pos = h.index + h[0].length;
+        for (;;) {
+            param.lastIndex = pos;
+            const p = param.exec(text);
+            if (p === null || p[0].length === 0)
+                break;
+            const span = p.indices?.[2];
+            if (span !== undefined && signed.test(p[1] ?? '')) {
+                let a = span[0];
+                let b = span[1];
+                if (text[a] === '"') {
+                    a++;
+                    if (b > a && text[b - 1] === '"')
+                        b--;
+                }
+                if (b > a && !isMarker(text.slice(a, b)))
+                    pushEdit(edits, text, a, b, REDACTED_SECRET);
+            }
+            pos = p.index + p[0].length;
+        }
+        header.lastIndex = Math.max(header.lastIndex, pos);
+    }
+    return edits;
+}
+function proseLiteralEdits(text) {
+    const edits = [];
+    let i = 0;
+    while (i < text.length) {
+        const c = text.charCodeAt(i);
+        if (!isKeyWordChar(c) || (i > 0 && isKeyWordChar(text.charCodeAt(i - 1)))) {
+            i++;
+            continue;
+        }
+        let end = i;
+        while (end < text.length && isKeyWordChar(text.charCodeAt(end)))
+            end++;
+        const word = text.slice(i, end);
+        if (word.startsWith('eyJ')) {
+            let segEnd = end;
+            let segments = 1;
+            while (segments < 4 && text.charAt(segEnd) === '.' && segEnd + 1 < text.length && isKeyWordChar(text.charCodeAt(segEnd + 1))) {
+                segEnd++;
+                while (segEnd < text.length && isKeyWordChar(text.charCodeAt(segEnd)))
+                    segEnd++;
+                segments++;
+            }
+            if (segments === 3 && JWT_WORD.test(text.slice(i, segEnd))) {
+                pushEdit(edits, text, i, segEnd, REDACTED_SECRET);
+                i = segEnd;
+                continue;
+            }
+        }
+        const prev = i > 0 ? text.charAt(i - 1) : '';
+        const hostSlot = prev === '/' && i > 1 && text.charAt(i - 2) === '/';
+        const pathish = (prev === '/' && !hostSlot) || prev === '\\' || prev === '.';
+        if (!pathish && SECRET_LITERAL_RE.test(word) && longestAlnumRun(word) >= PROSE_LITERAL_MIN_RUN) {
+            pushEdit(edits, text, i, end, REDACTED_SECRET);
+        }
+        i = end;
+    }
+    return edits;
+}
+function washWordNets(target) {
+    target.apply(pemEdits(target.text));
+    target.apply(labelEdits(target.text, SECRET_SCHEME_WORD));
+    target.apply(labelEdits(target.text, SECRET_LABELLED_WORD));
+    target.apply(authParamEdits(target.text));
+    target.apply(proseLiteralEdits(target.text));
+}
+function runCredentialNets(target, urls, words) {
+    if (urls)
+        washUrlNets(target);
+    if (words)
+        washWordNets(target);
+}
+const NEEDS_VIEW = /[\u0000-\u0008\u000E-\u001F\u007F-\u009F]|\p{Cf}|\\u/u;
+const FORMAT_CHAR = /^\p{Cf}$/u;
+const isStrippableControl = (c) => (c <= 0x1f && (c < 0x09 || c > 0x0d)) || (c >= 0x7f && c <= 0x9f);
+function csiEnd(text, from) {
+    let j = from;
+    while (j < text.length && text.charCodeAt(j) >= 0x30 && text.charCodeAt(j) <= 0x3f)
+        j++;
+    while (j < text.length && text.charCodeAt(j) >= 0x20 && text.charCodeAt(j) <= 0x2f)
+        j++;
+    const fin = text.charCodeAt(j);
+    return fin >= 0x40 && fin <= 0x7e ? j + 1 : -1;
+}
+const MAX_CONTROL_STRING = 4096;
+class ControlStringEnds {
+    text;
+    terminator;
+    lineBreak;
+    termFrom = -1;
+    termHit = null;
+    breakFrom = -1;
+    breakAt = -1;
+    constructor(text) {
+        this.text = text;
+        this.terminator = /[\u0007\u009c]|\u001b\\|\\[uU](?:0007|009[cC]|001[bB]\\)/g;
+        this.lineBreak = /[\n\r]/g;
+    }
+    find(from) {
+        if (this.termFrom === -1 || from < this.termFrom || (this.termHit !== null && from > this.termHit.index)) {
+            this.terminator.lastIndex = from;
+            this.termHit = this.terminator.exec(this.text);
+            this.termFrom = from;
+        }
+        if (this.breakFrom === -1 || from < this.breakFrom || (this.breakAt !== -1 && from > this.breakAt)) {
+            this.lineBreak.lastIndex = from;
+            const b = this.lineBreak.exec(this.text);
+            this.breakAt = b === null ? -1 : b.index;
+            this.breakFrom = from;
+        }
+        const hit = this.termHit;
+        if (hit === null || hit.index >= Math.min(this.text.length, from + MAX_CONTROL_STRING))
+            return null;
+        if (this.breakAt !== -1 && this.breakAt < hit.index)
+            return null;
+        return { contentEnd: hit.index, end: hit.index + hit[0].length };
+    }
+}
+function controlString(from, ends) {
+    const s = ends.find(from);
+    return s === null ? { end: from } : { end: s.end, content: [from, s.contentEnd] };
+}
+function escapeSequenceAfterEsc(text, at, ends) {
+    const n = text.charCodeAt(at);
+    if (n === 0x5b) {
+        const e = csiEnd(text, at + 1);
+        return e === -1 ? null : { end: e };
+    }
+    if (n === 0x5d || n === 0x50 || n === 0x58 || n === 0x5e || n === 0x5f)
+        return controlString(at + 1, ends);
+    if (n === 0x3a || n === 0x3d || (n >= 0x60 && n <= 0x7e))
+        return null;
+    let j = at;
+    while (j < text.length && text.charCodeAt(j) >= 0x20 && text.charCodeAt(j) <= 0x2f)
+        j++;
+    const f = text.charCodeAt(j);
+    return f >= 0x30 && f <= 0x7e ? { end: j + 1 } : null;
+}
+function c1SequenceAfter(text, c1, at, ends) {
+    if (c1 === 0x9b) {
+        const e = csiEnd(text, at);
+        return e === -1 ? null : { end: e };
+    }
+    if (c1 === 0x9d || c1 === 0x90 || c1 === 0x98 || c1 === 0x9e || c1 === 0x9f)
+        return controlString(at, ends);
+    return null;
+}
+function isFaceMarkedCodePoint(cp) {
+    if (cp <= 0x1f || (cp >= 0x7f && cp <= 0x9f))
+        return true;
+    if (cp >= 0xd800 && cp <= 0xdfff)
+        return true;
+    if (cp === 0x2028 || cp === 0x2029)
+        return true;
+    return cp >= 0xad && cp <= 0x10ffff && FORMAT_CHAR.test(String.fromCodePoint(cp));
+}
+function escapeTokenAt(text, at) {
+    const four = /^\\u([0-9A-Fa-f]{4})/.exec(text.slice(at, at + 6));
+    const braced = four === null ? /^\\u\{([0-9A-Fa-f]{1,6})\}/.exec(text.slice(at, at + 11)) : null;
+    const hit = four ?? braced;
+    if (hit === null)
+        return null;
+    const cp = Number.parseInt(hit[1] ?? '', 16);
+    return cp <= 0x10ffff && isFaceMarkedCodePoint(cp) ? { end: at + hit[0].length, cp } : null;
+}
+function buildCredentialView(text, separated, wordLetters = false) {
+    if (!NEEDS_VIEW.test(text))
+        return null;
+    const chars = [];
+    const starts = [];
+    const ends = [];
+    let changed = false;
+    let splitAny = false;
+    const stringEnds = new ControlStringEnds(text);
+    const keep = (ch, s, e) => {
+        chars.push(ch);
+        starts.push(s);
+        ends.push(e);
+    };
+    const drop = (s, e, placeholder = VIEW_SEPARATOR) => {
+        changed = true;
+        if (separated)
+            keep(placeholder, s, e);
+    };
+    const dropUnit = (s, unit) => {
+        const last = unit.end - 1;
+        if (wordLetters && unit.content === undefined && last > s && credentialWordBeginsWith(text, last)) {
+            drop(s, last);
+            keep(text.charAt(last), last, unit.end);
+            splitAny = true;
+            return;
+        }
+        drop(s, unit.end);
+    };
+    let i = 0;
+    while (i < text.length) {
+        const c = text.charCodeAt(i);
+        if (c === 0x1b || c === 0x9b || c === 0x9d || c === 0x90 || c === 0x98 || c === 0x9e || c === 0x9f) {
+            const unit = c === 0x1b ? escapeSequenceAfterEsc(text, i + 1, stringEnds) : c1SequenceAfter(text, c, i + 1, stringEnds);
+            if (unit !== null) {
+                dropUnit(i, unit);
+                i = unit.end;
+                continue;
+            }
+            drop(i, i + 1);
+            i++;
+            continue;
+        }
+        if (c === 0x5c && text.charCodeAt(i + 1) === 0x75) {
+            const tok = escapeTokenAt(text, i);
+            if (tok !== null) {
+                const unit = tok.cp === 0x1b
+                    ? escapeSequenceAfterEsc(text, tok.end, stringEnds)
+                    : tok.cp >= 0x90 && tok.cp <= 0x9f
+                        ? c1SequenceAfter(text, tok.cp, tok.end, stringEnds)
+                        : null;
+                if (unit !== null) {
+                    dropUnit(i, unit);
+                    i = unit.end;
+                    continue;
+                }
+                drop(i, tok.end, ' ');
+                i = tok.end;
+                continue;
+            }
+        }
+        if (isStrippableControl(c)) {
+            drop(i, i + 1);
+            i++;
+            continue;
+        }
+        if (c >= 0xad) {
+            const cp = text.codePointAt(i) ?? c;
+            const width = cp > 0xffff ? 2 : 1;
+            if (FORMAT_CHAR.test(String.fromCodePoint(cp))) {
+                drop(i, i + width);
+                i += width;
+                continue;
+            }
+            for (let u = 0; u < width; u++)
+                keep(text.charAt(i + u), i + u, i + u + 1);
+            i += width;
+            continue;
+        }
+        keep(text.charAt(i), i, i + 1);
+        i++;
+    }
+    if (!changed || (wordLetters && !splitAny))
+        return null;
+    return { view: chars.join(''), starts: Int32Array.from(starts), ends: Int32Array.from(ends) };
+}
+const isProbeFiller = (c) => c === 0x5c || c === 0x22 || c === 0x27 || isRegexSpace(c);
+function credentialWordBeginsWith(text, at) {
+    const c = text.charCodeAt(at);
+    const letter = (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a);
+    if (!letter && c !== 0x5c)
+        return false;
+    const n = text.charCodeAt(at + 1);
+    const nextOk = (n >= 0x41 && n <= 0x5a) || (n >= 0x61 && n <= 0x7a) || (!letter && (n === 0x22 || n === 0x27));
+    if (!nextOk)
+        return false;
+    let end = Math.min(text.length, at + 64);
+    while (end < text.length && isProbeFiller(text.charCodeAt(end - 1)))
+        end++;
+    const probe = ' ' + text.slice(at, Math.min(text.length, end + 2));
+    if (letter)
+        return credentialWordStartsAt(probe, 1);
+    return credentialWordStartsAt(probe, 2) || credentialWordStartsAt(probe, 3);
+}
+function rebuildFromView(original, view, target) {
+    const out = [];
+    const viewLength = view.view.length;
+    let cursor = 0;
+    let k = 0;
+    const text = target.text;
+    while (k < text.length) {
+        const s = target.src[k] ?? 0;
+        if (s >= 0) {
+            const end = view.ends[s] ?? cursor;
+            if ((view.starts[s] ?? 0) >= cursor) {
+                out.push(original.slice(cursor, end));
+                cursor = end;
+            }
+            else
+                out.push(text.charAt(k));
+            k++;
+            continue;
+        }
+        let j = k + 1;
+        while (j < text.length && (target.src[j] ?? 0) < 0)
+            j++;
+        let a = target.rangeStart(k);
+        let b = target.rangeEnd(k);
+        for (let t = k + 1; t < j; t++) {
+            a = Math.min(a, target.rangeStart(t));
+            b = Math.max(b, target.rangeEnd(t));
+        }
+        const from = a < viewLength ? (view.starts[a] ?? original.length) : original.length;
+        const to = b > a ? (view.ends[b - 1] ?? from) : from;
+        if (from > cursor)
+            out.push(original.slice(cursor, from));
+        out.push(text.slice(k, j));
+        cursor = Math.max(cursor, to);
+        k = j;
+    }
+    out.push(original.slice(cursor));
+    return out.join('');
+}
+function washThroughView(original, view, urls, words) {
+    const target = new TrackedTarget(view.view, view.view.length);
+    runCredentialNets(target, urls, words);
+    return target.text === view.view ? original : rebuildFromView(original, view, target);
+}
+function washCredentialNetsOnce(text, urls, words, nested) {
+    const contentsWashed = nested ? text : washControlStringContents(text, urls, words);
+    const lettered = buildCredentialView(contentsWashed, true, true);
+    const pre = lettered === null ? contentsWashed : washThroughView(contentsWashed, lettered, urls, words);
+    const separated = buildCredentialView(pre, true);
+    if (separated === null) {
+        const target = new PlainTarget(pre);
+        runCredentialNets(target, urls, words);
+        return target.text;
+    }
+    const afterSeparated = washThroughView(pre, separated, urls, words);
+    const joined = buildCredentialView(afterSeparated, false);
+    return joined === null ? afterSeparated : washThroughView(afterSeparated, joined, urls, words);
+}
+function washControlStringContents(text, urls, words) {
+    if (!/[\u001b\u0090\u0098\u009d-\u009f]|\\u/.test(text))
+        return text;
+    const ends = new ControlStringEnds(text);
+    const parts = [];
+    let cursor = 0;
+    let i = 0;
+    while (i < text.length) {
+        const c = text.charCodeAt(i);
+        let unit = null;
+        let next = i + 1;
+        if (c === 0x1b)
+            unit = escapeSequenceAfterEsc(text, i + 1, ends);
+        else if (c >= 0x90 && c <= 0x9f)
+            unit = c1SequenceAfter(text, c, i + 1, ends);
+        else if (c === 0x5c && text.charCodeAt(i + 1) === 0x75) {
+            const tok = escapeTokenAt(text, i);
+            if (tok !== null) {
+                next = tok.end;
+                unit = tok.cp === 0x1b ? escapeSequenceAfterEsc(text, tok.end, ends) : tok.cp >= 0x90 && tok.cp <= 0x9f ? c1SequenceAfter(text, tok.cp, tok.end, ends) : null;
+            }
+        }
+        if (unit === null) {
+            i = next;
+            continue;
+        }
+        if (unit.content !== undefined) {
+            const [a, b] = unit.content;
+            const inner = text.slice(a, b);
+            const washed = washCredentialNets(inner, urls, words, true);
+            if (washed !== inner) {
+                parts.push(text.slice(cursor, a), washed);
+                cursor = b;
+            }
+        }
+        i = Math.max(unit.end, i + 1);
+    }
+    if (cursor === 0)
+        return text;
+    parts.push(text.slice(cursor));
+    return parts.join('');
+}
+const MAX_SETTLE_ROUNDS = 4;
+function washCredentialNets(text, urls, words, nested = false) {
+    if (!urls && !words)
+        return text;
+    let current = text;
+    for (let round = 0; round < MAX_SETTLE_ROUNDS; round++) {
+        const next = washCredentialNetsOnce(current, urls, words, nested);
+        if (next === current)
+            return current;
+        current = next;
+    }
+    return current;
+}
+export function washCredentials(text) {
+    if (typeof text !== 'string')
+        return text;
+    return washCredentialNets(text, true, true);
+}
+const C0_ALL = '\\u0000-\\u001F';
+const C0_KEEP_LAYOUT = '\\u0000-\\u0008\\u000B-\\u001F';
+const DEL_C1 = '\\u007F-\\u009F';
+const LONE_SURROGATE = '\\uD800-\\uDFFF';
+const LINE_SEPARATORS = '\\u2028\\u2029';
+const FORMAT_CLASS = '(?![\\u200C\\u200D])\\p{Cf}';
+const RGI_TAG_FLAG = '\\u{1F3F4}\\u{E0067}\\u{E0062}(?:\\u{E0065}\\u{E006E}\\u{E0067}|\\u{E0073}\\u{E0063}\\u{E0074}|\\u{E0077}\\u{E006C}\\u{E0073})\\u{E007F}';
+const BIDI_REORDER = '\\u061C\\u200E\\u200F\\u2028\\u2029\\u202A-\\u202E\\u2066-\\u2069';
+function unsafeClass(members, withFormatClass) {
+    if (members === '' && !withFormatClass)
+        return null;
+    const parts = [
+        ...(withFormatClass ? [RGI_TAG_FLAG] : []),
+        ...(members !== '' ? [`[${members}]`] : []),
+        ...(withFormatClass ? [FORMAT_CLASS] : []),
+    ];
+    return new RegExp(parts.join('|'), 'gu');
+}
+export const LEGACY_ESCAPE_FACE = Object.freeze({
+    unsafe: unsafeClass(`${C0_ALL}${DEL_C1}${BIDI_REORDER}${LONE_SURROGATE}`, false),
+    fold: false,
+    mark: 'escape',
+});
+export const LEGACY_LABEL_FACE = Object.freeze({ ...LEGACY_ESCAPE_FACE, fold: true });
+export const LEGACY_NAME_FACE = Object.freeze({
+    unsafe: unsafeClass(`${C0_ALL}\\u007F${LINE_SEPARATORS}`, false),
+    fold: true,
+    mark: 'space',
+});
+function markOf(ch, mark) {
+    if (mark === 'dot')
+        return '.';
+    if (mark === 'space')
+        return ' ';
+    const code = ch.codePointAt(0) ?? 0;
+    const hex = code.toString(16).toUpperCase();
+    return code > 0xffff ? `\\u{${hex}}` : `\\u${hex.padStart(4, '0')}`;
+}
+const foldWhitespace = (s) => s.replace(/\s+/g, ' ').trim();
+export function applyDisplayFace(text, face) {
+    const markAll = (s) => face.unsafe === null ? s : s.replace(face.unsafe, ch => (ch.length > 2 ? ch : markOf(ch, face.mark)));
+    if (face.mark === 'space') {
+        const marked = markAll(text);
+        return face.fold ? foldWhitespace(marked) : marked;
+    }
+    return markAll(face.fold ? foldWhitespace(text) : text);
+}
+const PUBLIC_UNSAFE_BY_NETS = Object.freeze(Array.from({ length: 8 }, (_, i) => {
+    const controls = (i & 4) !== 0;
+    const bidi = (i & 2) !== 0;
+    const keep = (i & 1) !== 0;
+    const members = `${controls ? `${keep ? C0_KEEP_LAYOUT : C0_ALL}${DEL_C1}${LONE_SURROGATE}` : ''}${bidi ? LINE_SEPARATORS : ''}`;
+    return unsafeClass(members, bidi);
+}));
+function publicFace(opts) {
+    const fold = opts.foldLines !== false;
+    const keep = !fold && opts.keepLayout === true;
+    const index = (opts.controls !== false ? 4 : 0) + (opts.bidi !== false ? 2 : 0) + (keep ? 1 : 0);
+    return { unsafe: PUBLIC_UNSAFE_BY_NETS[index] ?? null, fold, mark: opts.mark ?? 'escape' };
+}
+const ESCAPE_TOKEN_AT = /^\\u(?:[0-9A-F]{4}|\{[0-9A-F]{1,6}\})/;
+function capDisplay(text, max, mark) {
+    if (typeof max !== 'number' || !Number.isFinite(max))
+        return text;
+    const limit = Math.max(0, Math.floor(max));
+    if (text.length <= limit)
+        return text;
+    let cut = limit;
+    if (mark === 'escape') {
+        for (let p = cut - 1; p >= 0 && p >= cut - 10; p--) {
+            if (text.charAt(p) !== '\\')
+                continue;
+            const token = ESCAPE_TOKEN_AT.exec(text.slice(p, p + 11));
+            if (token !== null && p + token[0].length > cut)
+                cut = p;
+            break;
+        }
+    }
+    if (cut > 0) {
+        const code = text.charCodeAt(cut - 1);
+        if (code >= 0xd800 && code <= 0xdbff)
+            cut -= 1;
+    }
+    return text.slice(0, cut);
+}
+const MAX_CAP_SETTLE_ROUNDS = 4;
+export function displayUntrusted(text, opts = {}) {
+    const input = typeof text === 'string' ? text : String(text ?? '');
+    const o = opts ?? {};
+    const urls = o.credentialUrls !== false;
+    const words = o.credentialWords !== false;
+    const face = publicFace(o);
+    const settle = (s) => {
+        let current = applyDisplayFace(washCredentialNets(s, urls, words), face);
+        if (current === s)
+            return current;
+        for (let round = 1; round < MAX_SETTLE_ROUNDS; round++) {
+            const next = applyDisplayFace(washCredentialNets(current, urls, words), face);
+            if (next === current)
+                return current;
+            current = next;
+        }
+        return current;
+    };
+    const settled = settle(input);
+    let out = capDisplay(settled, o.max, face.mark);
+    if (out === settled)
+        return out;
+    for (let round = 0; round < MAX_CAP_SETTLE_ROUNDS; round++) {
+        const again = capDisplay(settle(out), o.max, face.mark);
+        if (again === out)
+            break;
+        out = again;
+    }
+    return out;
+}