@sema-agent/client-core 0.83.3 → 0.83.5

package/dist/displayUntrusted.js

@@ -37,13 +37,51 @@ function applyEdits(text, edits) {
 }
 class PlainTarget {
     text;
-    constructor(text) {
+    origin;
+    trace;
+    constructor(text, trace = false) {
         this.text = text;
+        this.trace = trace;
     }
     apply(edits) {
+        if (this.trace && edits.length > 0)
+            this.origin = editedOrigin(this.origin, this.text.length, edits);
         this.text = applyEdits(this.text, edits);
     }
 }
+const traced = (text, origin) => (origin === undefined ? { text } : { text, origin });
+function editedOrigin(prev, length, edits) {
+    let n = length;
+    for (const e of edits)
+        n += e.text.length - (e.end - e.start);
+    const out = new Int32Array(n);
+    let w = 0;
+    let cursor = 0;
+    const copy = (a, b) => {
+        for (let k = a; k < b; k++)
+            out[w++] = prev === undefined ? k : (prev[k] ?? -1);
+    };
+    for (const e of edits) {
+        copy(cursor, e.start);
+        out.fill(-1, w, w + e.text.length);
+        w += e.text.length;
+        cursor = e.end;
+    }
+    copy(cursor, length);
+    return out;
+}
+function composeOrigin(outer, inner) {
+    if (inner === undefined)
+        return outer;
+    if (outer === undefined)
+        return inner;
+    const out = new Int32Array(inner.length);
+    for (let k = 0; k < inner.length; k++) {
+        const s = inner[k] ?? -1;
+        out[k] = s < 0 ? -1 : (outer[s] ?? -1);
+    }
+    return out;
+}
 class TrackedTarget {
     text;
     src;
@@ -272,9 +310,10 @@ function urlTokenEdits(text) {
             const ch = text.charAt(end);
             if (isWhitespaceOrControl(ch) || TOKEN_STOP.has(ch))
                 break;
-            if (ch === VIEW_SEPARATOR) {
+            const c = ch.charCodeAt(0);
+            if (ch === VIEW_SEPARATOR || isUnicodeBlank(c)) {
                 let p = end;
-                while (p < text.length && text[p] === VIEW_SEPARATOR)
+                while (p < text.length && (text[p] === VIEW_SEPARATOR || isUnicodeBlank(text.charCodeAt(p))))
                     p++;
                 if (credentialWordStartsNear(text, p))
                     break;
@@ -317,6 +356,10 @@ function schemelessUserinfoEdits(text) {
         let runStart = at;
         while (runStart > floor && !breaksUserinfo(text.charCodeAt(runStart - 1)))
             runStart--;
+        if (text.charCodeAt(runStart) === 0x3a && runStart > floor && text[runStart - 1] === VIEW_SEPARATOR) {
+            while (runStart > floor && text[runStart - 1] === VIEW_SEPARATOR)
+                runStart--;
+        }
         let found = -1;
         let colon = -1;
         let s = runStart;
@@ -363,8 +406,23 @@ function washUrlNets(target) {
             return;
     }
 }
-const SECRET_SCHEME_WORD = /(?:\b|(?<=\\[A-Za-z"']))(bearer|basic)[\s:=\uFF1A\uFF1D]+/gi;
-const SECRET_LABELLED_WORD = /(?:\b|(?<=_)|(?<=\\[A-Za-z"']))((?:access[-_ ]?|refresh[-_ ]?|id[-_ ]?|client[-_ ]?|api[-_ ]?|x[-_]api[-_ ]?|session[-_ ]?|auth[-_ ]?)?(?:token|key|secret|password|authorization|credential)s?)(?:\\*["'])?\s*[:=\uFF1A\uFF1D]\s*/gi;
+const NAME_BLANK_RANGES = [
+    [0x00a0, 0x00a0],
+    [0x1680, 0x1680],
+    [0x2000, 0x200a],
+    [0x202f, 0x202f],
+    [0x205f, 0x205f],
+    [0x3000, 0x3000],
+    [0x115f, 0x1160],
+    [0x3164, 0x3164],
+    [0xffa0, 0xffa0],
+    [0x2800, 0x2800],
+];
+const isNameBlank = (cp) => NAME_BLANK_RANGES.some(([a, b]) => cp >= a && cp <= b);
+const isFoldedBlank = (c) => isNameBlank(c) && isRegexSpace(c);
+const isUnicodeBlank = (c) => (c > 0x7f && isRegexSpace(c) && c !== 0xfeff) || isNameBlank(c);
+const SECRET_SCHEME_WORD = /(?:\b|(?<=\\[A-Za-z"']))(bearer|basic)[\s:=\uFF1A\uFF1D\u115F\u1160\u3164\uFFA0\u2800]+/gi;
+const SECRET_LABELLED_WORD = /(?:\b|(?<=_)|(?<=\\[A-Za-z"']))((?:access[-_ ]?|refresh[-_ ]?|id[-_ ]?|client[-_ ]?|api[-_ ]?|x[-_]api[-_ ]?|session[-_ ]?|auth[-_ ]?)?(?:token|key|secret|password|authorization|credential)s?)(?:\\*["'])?[\s\u115F\u1160\u3164\uFFA0\u2800]*[:=\uFF1A\uFF1D][\s\u115F\u1160\u3164\uFFA0\u2800]*/gi;
 const DIAGNOSTIC_VALUE_WORDS = new Set([
     'missing', 'required', 'invalid', 'expired', 'unauthorized', 'unauthenticated', 'authentication',
     'authorization', 'credential', 'credentials', 'unsupported', 'malformed', 'rejected', 'absent',
@@ -566,6 +624,18 @@ function labelStartsAt(text, at) {
     return re.test(text);
 }
 function credentialWordStartsAt(text, at) {
+    if (at >= text.length)
+        return false;
+    if (credentialWordStartsExactlyAt(text, at))
+        return true;
+    let k = at;
+    while (k < text.length && text.charCodeAt(k) === 0x5c)
+        k++;
+    if (text[k] === '"' || text[k] === "'")
+        k++;
+    return k > at && credentialWordStartsExactlyAt(text, k);
+}
+function credentialWordStartsExactlyAt(text, at) {
     if (at >= text.length)
         return false;
     if (labelStartsAt(text, at))
@@ -730,7 +800,7 @@ function trailingLabelStart(text, from, end) {
 }
 const withoutSeparators = (s) => (s.includes(VIEW_SEPARATOR) ? s.split(VIEW_SEPARATOR).join('') : s);
 const isHorizontalSpace = (ch) => ch === ' ' || ch === '\t' || ch === '\u00a0' || ch === VIEW_SEPARATOR;
-function labelEdits(text, re) {
+function labelEdits(text, re, literalBlanks = false) {
     const edits = [];
     const schemePass = re === SECRET_SCHEME_WORD;
     const idx = new InnerWordIndex(text);
@@ -751,6 +821,12 @@ function labelEdits(text, re) {
             re.lastIndex = v.end;
             continue;
         }
+        if (literalBlanks) {
+            if (literalBlankLeadJudgedAsBlank(text, v, label, schemePass)) {
+                re.lastIndex = v.end;
+                continue;
+            }
+        }
         const rawValue = text.slice(v.start, v.end);
         const value = withoutSeparators(rawValue);
         const quoted = v.start > 0 && (text[v.start - 1] === '"' || text[v.start - 1] === "'");
@@ -800,6 +876,34 @@ function labelEdits(text, re) {
     }
     return edits;
 }
+function literalBlankLeadJudgedAsBlank(text, v, label, schemePass) {
+    let restStart;
+    if (v.start > 0 && text.charCodeAt(v.start - 1) === 0x5c && nameBlankTokenAt(text, v.start - 1) !== -1)
+        restStart = v.start + 5;
+    else if (nameBlankTokenAt(text, v.start) !== -1)
+        restStart = v.start + 6;
+    else if (eatenBlankTokenTailAt(text, v.start))
+        restStart = v.start + 5;
+    else
+        return false;
+    const rest = withoutSeparators(text.slice(restStart, v.end));
+    const bare = rest.replace(/[.,;:!?)\]}'"]+$/, '');
+    if (bare === '')
+        return true;
+    if (credentialWordStartsAt(' ' + text.slice(restStart, Math.min(text.length, v.end + 64)), 1))
+        return true;
+    if (schemePass && SCHEME_FOLLOWER_WORDS.has(bare.toLowerCase()))
+        return true;
+    if (!schemePass && isNamedNotValue(label, rest))
+        return true;
+    if (!schemePass && /authorizations?$/i.test(label) && isAuthScheme(bare))
+        return true;
+    return !isAddressShaped(rest) && isDiagnosticValue(rest);
+}
+function eatenBlankTokenTailAt(text, at) {
+    const hit = /^u([0-9A-Fa-f]{4})/.exec(text.slice(at, at + 5));
+    return hit !== null && isNameBlank(Number.parseInt(hit[1] ?? '', 16));
+}
 function isAuthParamAt(text, j, scheme) {
     const p = /^[A-Za-z][A-Za-z0-9_-]*([ \t\ufeff]*)=([ \t\ufeff]*)("|[^\s=,"]+)([ \t\ufeff]*,)?/.exec(text.slice(j, j + 512));
     if (p === null)
@@ -991,49 +1095,75 @@ function proseLiteralEdits(text) {
     }
     return edits;
 }
-function washWordNets(target) {
+function washWordNets(target, literalBlanks = false) {
     target.apply(pemEdits(target.text));
-    target.apply(labelEdits(target.text, SECRET_SCHEME_WORD));
-    target.apply(labelEdits(target.text, SECRET_LABELLED_WORD));
+    target.apply(labelEdits(target.text, SECRET_SCHEME_WORD, literalBlanks));
+    target.apply(labelEdits(target.text, SECRET_LABELLED_WORD, literalBlanks));
     target.apply(authParamEdits(target.text));
     target.apply(proseLiteralEdits(target.text));
 }
-function runCredentialNets(target, urls, words) {
+function runCredentialNets(target, urls, words, literalBlanks = false) {
     if (urls)
         washUrlNets(target);
     if (words)
-        washWordNets(target);
+        washWordNets(target, literalBlanks);
 }
-const NEEDS_VIEW = /[\u0000-\u0008\u000E-\u001F\u007F-\u009F]|\p{Cf}|\\u/u;
+const NEEDS_VIEW = /[\u0000-\u0008\u000E-\u001F\u007F-\u009F\uD800-\uDFFF]|\p{Cf}|\\u/u;
 const FORMAT_CHAR = /^\p{Cf}$/u;
 const isStrippableControl = (c) => (c <= 0x1f && (c < 0x09 || c > 0x0d)) || (c >= 0x7f && c <= 0x9f);
-function csiEnd(text, from) {
-    let j = from;
-    while (j < text.length && text.charCodeAt(j) >= 0x30 && text.charCodeAt(j) <= 0x3f)
-        j++;
-    while (j < text.length && text.charCodeAt(j) >= 0x20 && text.charCodeAt(j) <= 0x2f)
-        j++;
-    const fin = text.charCodeAt(j);
-    return fin >= 0x40 && fin <= 0x7e ? j + 1 : -1;
-}
-const MAX_CONTROL_STRING = 4096;
-class ControlStringEnds {
+class SequenceReader {
     text;
+    atomicBlanks;
+    foldBlanks;
     terminator;
     lineBreak;
     termFrom = -1;
     termHit = null;
     breakFrom = -1;
     breakAt = -1;
-    constructor(text) {
+    constructor(text, atomicBlanks, foldBlanks = false) {
         this.text = text;
-        this.terminator = /[\u0007\u009c]|\u001b\\|\\[uU](?:0007|009[cC]|001[bB]\\)/g;
+        this.atomicBlanks = atomicBlanks;
+        this.foldBlanks = foldBlanks;
+        this.terminator = /[\u0007\u009c]|\u001b\\|\\u(?:0007|009[cC]|001[bB]\\)/g;
         this.lineBreak = /[\n\r]/g;
     }
-    find(from) {
+    atomicTokenAt(at) {
+        if (this.text.charCodeAt(at) !== 0x5c)
+            return false;
+        if (escapeTokenAt(this.text, at) !== null)
+            return true;
+        if (this.atomicBlanks === 'none')
+            return false;
+        const cp = nameBlankTokenAt(this.text, at);
+        return this.atomicBlanks === 'all' ? cp !== -1 : isFoldedBlank(cp);
+    }
+    intermediateAt(at) {
+        const c = this.text.charCodeAt(at);
+        if (c >= 0x20 && c <= 0x2f)
+            return 1;
+        if (!this.foldBlanks)
+            return 0;
+        if (isFoldedBlank(c))
+            return 1;
+        return c === 0x5c && isFoldedBlank(nameBlankTokenAt(this.text, at)) ? 6 : 0;
+    }
+    interruptsAt(at) {
+        if (at >= this.text.length)
+            return false;
+        const c = this.text.charCodeAt(at);
+        if (isStrippableControl(c))
+            return true;
+        if (c === 0x5c)
+            return escapeTokenAt(this.text, at) !== null;
+        if (c < 0xad)
+            return false;
+        const cp = this.text.codePointAt(at) ?? c;
+        return (cp >= 0xd800 && cp <= 0xdfff) || FORMAT_CHAR.test(String.fromCodePoint(cp));
+    }
+    findControlStringEnd(from) {
         if (this.termFrom === -1 || from < this.termFrom || (this.termHit !== null && from > this.termHit.index)) {
-            this.terminator.lastIndex = from;
-            this.termHit = this.terminator.exec(this.text);
+            this.termHit = this.nextTerminator(from);
             this.termFrom = from;
         }
         if (this.breakFrom === -1 || from < this.breakFrom || (this.breakAt !== -1 && from > this.breakAt)) {
@@ -1049,34 +1179,57 @@ class ControlStringEnds {
             return null;
         return { contentEnd: hit.index, end: hit.index + hit[0].length };
     }
+    nextTerminator(from) {
+        this.terminator.lastIndex = from;
+        for (let hit = this.terminator.exec(this.text); hit !== null; hit = this.terminator.exec(this.text)) {
+            const last = hit.index + hit[0].length - 1;
+            if (this.text.charCodeAt(last) !== 0x5c || !this.atomicTokenAt(last))
+                return hit;
+            this.terminator.lastIndex = last;
+        }
+        return null;
+    }
+}
+function csiEnd(text, from, seq) {
+    let j = from;
+    while (j < text.length && text.charCodeAt(j) >= 0x30 && text.charCodeAt(j) <= 0x3f)
+        j++;
+    for (let w = seq.intermediateAt(j); w > 0 && j < text.length; w = seq.intermediateAt(j))
+        j += w;
+    if (seq.interruptsAt(j))
+        return j;
+    const fin = text.charCodeAt(j);
+    if (fin === 0x5c && seq.atomicTokenAt(j))
+        return j;
+    return fin > 0x40 && fin <= 0x7e ? j + 1 : j;
 }
-function controlString(from, ends) {
-    const s = ends.find(from);
+const MAX_CONTROL_STRING = 4096;
+function controlString(from, seq) {
+    const s = seq.findControlStringEnd(from);
     return s === null ? { end: from } : { end: s.end, content: [from, s.contentEnd] };
 }
-function escapeSequenceAfterEsc(text, at, ends) {
+function escapeSequenceAfterEsc(text, at, seq) {
     const n = text.charCodeAt(at);
-    if (n === 0x5b) {
-        const e = csiEnd(text, at + 1);
-        return e === -1 ? null : { end: e };
-    }
+    if (n === 0x5b)
+        return { end: csiEnd(text, at + 1, seq) };
     if (n === 0x5d || n === 0x50 || n === 0x58 || n === 0x5e || n === 0x5f)
-        return controlString(at + 1, ends);
-    if (n === 0x3a || n === 0x3d || (n >= 0x60 && n <= 0x7e))
+        return controlString(at + 1, seq);
+    if (n === 0x3a || n === 0x3d || n === 0x40 || (n >= 0x60 && n <= 0x7e))
         return null;
     let j = at;
-    while (j < text.length && text.charCodeAt(j) >= 0x20 && text.charCodeAt(j) <= 0x2f)
-        j++;
+    for (let w = seq.intermediateAt(j); w > 0 && j < text.length; w = seq.intermediateAt(j))
+        j += w;
     const f = text.charCodeAt(j);
-    return f >= 0x30 && f <= 0x7e ? { end: j + 1 } : null;
-}
-function c1SequenceAfter(text, c1, at, ends) {
-    if (c1 === 0x9b) {
-        const e = csiEnd(text, at);
-        return e === -1 ? null : { end: e };
-    }
+    const complete = !seq.interruptsAt(j) && !(f === 0x5c && seq.atomicTokenAt(j)) && f >= 0x30 && f <= 0x7e && f !== 0x40;
+    if (complete)
+        return { end: j + 1 };
+    return j > at ? { end: j } : null;
+}
+function c1SequenceAfter(text, c1, at, seq) {
+    if (c1 === 0x9b)
+        return { end: csiEnd(text, at, seq) };
     if (c1 === 0x9d || c1 === 0x90 || c1 === 0x98 || c1 === 0x9e || c1 === 0x9f)
-        return controlString(at, ends);
+        return controlString(at, seq);
     return null;
 }
 function isFaceMarkedCodePoint(cp) {
@@ -1097,15 +1250,23 @@ function escapeTokenAt(text, at) {
     const cp = Number.parseInt(hit[1] ?? '', 16);
     return cp <= 0x10ffff && isFaceMarkedCodePoint(cp) ? { end: at + hit[0].length, cp } : null;
 }
-function buildCredentialView(text, separated, wordLetters = false) {
-    if (!NEEDS_VIEW.test(text))
+function nameBlankTokenAt(text, at) {
+    const hit = /^\\u([0-9A-Fa-f]{4})/.exec(text.slice(at, at + 6));
+    if (hit === null)
+        return -1;
+    const cp = Number.parseInt(hit[1] ?? '', 16);
+    return isNameBlank(cp) ? cp : -1;
+}
+function buildCredentialView(text, separated, wordLetters = false, blankTokens = 'off') {
+    const folding = blankTokens === 'fold' || blankTokens === 'foldlit';
+    if (!NEEDS_VIEW.test(text) && !(folding && hasRawFoldedBlank(text)))
         return null;
     const chars = [];
     const starts = [];
     const ends = [];
     let changed = false;
     let splitAny = false;
-    const stringEnds = new ControlStringEnds(text);
+    const seq = new SequenceReader(text, blankTokens === 'blank' || blankTokens === 'fold' ? 'all' : blankTokens === 'foldlit' ? 'folded' : 'none', folding);
     const keep = (ch, s, e) => {
         chars.push(ch);
         starts.push(s);
@@ -1118,22 +1279,35 @@ function buildCredentialView(text, separated, wordLetters = false) {
     };
     const dropUnit = (s, unit) => {
         const last = unit.end - 1;
-        if (wordLetters && unit.content === undefined && last > s && credentialWordBeginsWith(text, last)) {
+        if ((blankTokens === 'literal' || blankTokens === 'foldlit') && last > s && text.charCodeAt(last) === 0x5c && nameBlankTokenAt(text, last) !== -1) {
+            drop(s, last);
+            keep(text.charAt(last + 1), last, last + 6);
+            for (let u = 2; u < 6; u++)
+                keep(text.charAt(last + u), last + 6, last + 6);
+            return last + 6;
+        }
+        if (wordLetters && unit.content === undefined && last > s && (credentialWordBeginsWith(text, last) || finalIsStructural(text, last))) {
             drop(s, last);
             keep(text.charAt(last), last, unit.end);
             splitAny = true;
-            return;
+            return unit.end;
         }
         drop(s, unit.end);
+        return unit.end;
     };
     let i = 0;
     while (i < text.length) {
         const c = text.charCodeAt(i);
+        if (folding && isFoldedBlank(c)) {
+            changed = true;
+            keep(' ', i, i + 1);
+            i++;
+            continue;
+        }
         if (c === 0x1b || c === 0x9b || c === 0x9d || c === 0x90 || c === 0x98 || c === 0x9e || c === 0x9f) {
-            const unit = c === 0x1b ? escapeSequenceAfterEsc(text, i + 1, stringEnds) : c1SequenceAfter(text, c, i + 1, stringEnds);
+            const unit = c === 0x1b ? escapeSequenceAfterEsc(text, i + 1, seq) : c1SequenceAfter(text, c, i + 1, seq);
             if (unit !== null) {
-                dropUnit(i, unit);
-                i = unit.end;
+                i = dropUnit(i, unit);
                 continue;
             }
             drop(i, i + 1);
@@ -1144,19 +1318,37 @@ function buildCredentialView(text, separated, wordLetters = false) {
             const tok = escapeTokenAt(text, i);
             if (tok !== null) {
                 const unit = tok.cp === 0x1b
-                    ? escapeSequenceAfterEsc(text, tok.end, stringEnds)
+                    ? escapeSequenceAfterEsc(text, tok.end, seq)
                     : tok.cp >= 0x90 && tok.cp <= 0x9f
-                        ? c1SequenceAfter(text, tok.cp, tok.end, stringEnds)
+                        ? c1SequenceAfter(text, tok.cp, tok.end, seq)
                         : null;
                 if (unit !== null) {
-                    dropUnit(i, unit);
-                    i = unit.end;
+                    i = dropUnit(i, unit);
                     continue;
                 }
                 drop(i, tok.end, ' ');
                 i = tok.end;
                 continue;
             }
+            if (blankTokens !== 'off') {
+                const cp = nameBlankTokenAt(text, i);
+                if (cp !== -1) {
+                    changed = true;
+                    if (blankTokens === 'blank')
+                        keep(String.fromCharCode(cp), i, i + 6);
+                    else if (blankTokens === 'fold')
+                        keep(isFoldedBlank(cp) ? ' ' : String.fromCharCode(cp), i, i + 6);
+                    else if (blankTokens === 'foldlit' && isFoldedBlank(cp))
+                        keep(' ', i, i + 6);
+                    else {
+                        keep(text.charAt(i), i, i + 6);
+                        for (let u = 1; u < 6; u++)
+                            keep(text.charAt(i + u), i + 6, i + 6);
+                    }
+                    i += 6;
+                    continue;
+                }
+            }
         }
         if (isStrippableControl(c)) {
             drop(i, i + 1);
@@ -1166,7 +1358,7 @@ function buildCredentialView(text, separated, wordLetters = false) {
         if (c >= 0xad) {
             const cp = text.codePointAt(i) ?? c;
             const width = cp > 0xffff ? 2 : 1;
-            if (FORMAT_CHAR.test(String.fromCodePoint(cp))) {
+            if (FORMAT_CHAR.test(String.fromCodePoint(cp)) || (cp >= 0xd800 && cp <= 0xdfff)) {
                 drop(i, i + width);
                 i += width;
                 continue;
@@ -1183,7 +1375,13 @@ function buildCredentialView(text, separated, wordLetters = false) {
         return null;
     return { view: chars.join(''), starts: Int32Array.from(starts), ends: Int32Array.from(ends) };
 }
-const isProbeFiller = (c) => c === 0x5c || c === 0x22 || c === 0x27 || isRegexSpace(c);
+function finalIsStructural(text, at) {
+    if (text.charCodeAt(at) !== 0x5c)
+        return false;
+    const n = text.charCodeAt(at + 1);
+    return n === 0x22 || n === 0x27;
+}
+const isProbeFiller = (c) => c === 0x5c || c === 0x22 || c === 0x27 || isRegexSpace(c) || isNameBlank(c);
 function credentialWordBeginsWith(text, at) {
     const c = text.charCodeAt(at);
     const letter = (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a);
@@ -1193,6 +1391,13 @@ function credentialWordBeginsWith(text, at) {
     const nextOk = (n >= 0x41 && n <= 0x5a) || (n >= 0x61 && n <= 0x7a) || (!letter && (n === 0x22 || n === 0x27));
     if (!nextOk)
         return false;
+    if (letter) {
+        let e = at;
+        while (e < text.length && isKeyWordChar(text.charCodeAt(e)))
+            e++;
+        if (SECRET_LITERAL_RE.test(text.slice(at, e + 1)))
+            return true;
+    }
     let end = Math.min(text.length, at + 64);
     while (end < text.length && isProbeFiller(text.charCodeAt(end - 1)))
         end++;
@@ -1201,8 +1406,21 @@ function credentialWordBeginsWith(text, at) {
         return credentialWordStartsAt(probe, 1);
     return credentialWordStartsAt(probe, 2) || credentialWordStartsAt(probe, 3);
 }
-function rebuildFromView(original, view, target) {
+function rebuildFromView(original, view, target, trace = false) {
     const out = [];
+    const origin = trace ? [] : null;
+    const fromOriginal = (a, b) => {
+        out.push(original.slice(a, b));
+        if (origin !== null)
+            for (let x = a; x < b; x++)
+                origin.push(x);
+    };
+    const inserted = (s) => {
+        out.push(s);
+        if (origin !== null)
+            for (let x = 0; x < s.length; x++)
+                origin.push(-1);
+    };
     const viewLength = view.view.length;
     let cursor = 0;
     let k = 0;
@@ -1212,11 +1430,11 @@ function rebuildFromView(original, view, target) {
         if (s >= 0) {
             const end = view.ends[s] ?? cursor;
             if ((view.starts[s] ?? 0) >= cursor) {
-                out.push(original.slice(cursor, end));
+                fromOriginal(cursor, end);
                 cursor = end;
             }
             else
-                out.push(text.charAt(k));
+                inserted(text.charAt(k));
             k++;
             continue;
         }
@@ -1232,38 +1450,144 @@ function rebuildFromView(original, view, target) {
         const from = a < viewLength ? (view.starts[a] ?? original.length) : original.length;
         const to = b > a ? (view.ends[b - 1] ?? from) : from;
         if (from > cursor)
-            out.push(original.slice(cursor, from));
-        out.push(text.slice(k, j));
+            fromOriginal(cursor, from);
+        inserted(text.slice(k, j));
         cursor = Math.max(cursor, to);
         k = j;
     }
-    out.push(original.slice(cursor));
-    return out.join('');
+    fromOriginal(cursor, original.length);
+    const rebuilt = out.join('');
+    return origin === null ? { text: rebuilt } : { text: rebuilt, origin: Int32Array.from(origin) };
 }
-function washThroughView(original, view, urls, words) {
+function washThroughView(original, view, urls, words, trace = false, literalBlanks = false) {
     const target = new TrackedTarget(view.view, view.view.length);
-    runCredentialNets(target, urls, words);
-    return target.text === view.view ? original : rebuildFromView(original, view, target);
-}
-function washCredentialNetsOnce(text, urls, words, nested) {
-    const contentsWashed = nested ? text : washControlStringContents(text, urls, words);
-    const lettered = buildCredentialView(contentsWashed, true, true);
-    const pre = lettered === null ? contentsWashed : washThroughView(contentsWashed, lettered, urls, words);
-    const separated = buildCredentialView(pre, true);
-    if (separated === null) {
-        const target = new PlainTarget(pre);
-        runCredentialNets(target, urls, words);
-        return target.text;
+    runCredentialNets(target, urls, words, literalBlanks);
+    return target.text === view.view ? { text: original } : rebuildFromView(original, view, target, trace);
+}
+function washCredentialNetsOnce(text, urls, words, nested, blankTokens, trace) {
+    const contents = nested ? { text } : washControlStringContents(text, urls, words, blankTokens, trace);
+    if (blankTokens === 'off')
+        return washThroughViews(contents, urls, words, 'off', trace);
+    const tokens = hasNameBlankToken(contents.text);
+    const readings = [];
+    if (tokens)
+        readings.push('literal');
+    const rawFolded = blankTokens === 'fold' && hasRawFoldedBlank(contents.text);
+    if (blankTokens === 'fold' && (tokens || rawFolded))
+        readings.push('fold');
+    if (blankTokens === 'fold' && tokens && hasNameBlankToken(contents.text, false) && (rawFolded || hasNameBlankToken(contents.text, true)))
+        readings.push('foldlit');
+    readings.push('blank');
+    if (readings.length === 1)
+        return washThroughViews(contents, urls, words, 'blank', trace);
+    const base = { text: contents.text };
+    const union = unionMaskedRanges(base.text, readings.map((r) => washThroughViews(base, urls, words, r, true)));
+    return traced(union.text, composeOrigin(contents.origin, union.origin));
+}
+function unionMaskedRanges(text, results) {
+    const ranges = [];
+    for (const r of results) {
+        if (r.text === text || r.origin === undefined)
+            continue;
+        const origin = r.origin;
+        let lastKept = -1;
+        let k = 0;
+        while (k < origin.length) {
+            if ((origin[k] ?? -1) >= 0) {
+                lastKept = origin[k] ?? lastKept;
+                k++;
+                continue;
+            }
+            let j = k;
+            while (j < origin.length && (origin[j] ?? -1) < 0)
+                j++;
+            const next = j < origin.length ? (origin[j] ?? text.length) : text.length;
+            ranges.push({ start: lastKept + 1, end: next, text: r.text.slice(k, j) });
+            k = j;
+        }
+    }
+    if (ranges.length === 0)
+        return { text };
+    ranges.sort((a, b) => (a.start !== b.start ? a.start - b.start : b.end - a.end));
+    const merged = [];
+    for (const m of ranges) {
+        const last = merged[merged.length - 1];
+        if (last !== undefined && (m.start < last.end || (m.start === last.start && m.end === last.end))) {
+            if (m.end > last.end) {
+                if (m.end - m.start > last.end - last.start)
+                    last.text = m.text;
+                last.end = m.end;
+            }
+            continue;
+        }
+        if (last !== undefined && m.start === m.end && m.start > last.start && m.start < last.end)
+            continue;
+        merged.push({ ...m });
+    }
+    const parts = [];
+    const origin = [];
+    let cursor = 0;
+    for (const m of merged) {
+        parts.push(text.slice(cursor, m.start), m.text);
+        for (let x = cursor; x < m.start; x++)
+            origin.push(x);
+        for (let x = 0; x < m.text.length; x++)
+            origin.push(-1);
+        cursor = m.end;
     }
-    const afterSeparated = washThroughView(pre, separated, urls, words);
-    const joined = buildCredentialView(afterSeparated, false);
-    return joined === null ? afterSeparated : washThroughView(afterSeparated, joined, urls, words);
+    parts.push(text.slice(cursor));
+    for (let x = cursor; x < text.length; x++)
+        origin.push(x);
+    return { text: parts.join(''), origin: Int32Array.from(origin) };
 }
-function washControlStringContents(text, urls, words) {
+function hasRawFoldedBlank(text) {
+    for (let k = 0; k < text.length; k++)
+        if (isFoldedBlank(text.charCodeAt(k)))
+            return true;
+    return false;
+}
+function hasNameBlankToken(text, folded) {
+    if (!text.includes('\\u'))
+        return false;
+    for (const hit of text.matchAll(/\\u([0-9A-Fa-f]{4})/g)) {
+        const cp = Number.parseInt(hit[1] ?? '', 16);
+        if (isNameBlank(cp) && (folded === undefined || isFoldedBlank(cp) === folded))
+            return true;
+    }
+    return false;
+}
+function washThroughViews(input, urls, words, blankRead, trace) {
+    const start = input.text;
+    const literal = blankRead === 'literal' || blankRead === 'foldlit';
+    const lettered = buildCredentialView(start, true, true, blankRead);
+    const letteredWashed = lettered === null ? { text: start } : washThroughView(start, lettered, urls, words, trace, literal);
+    const pre = letteredWashed.text;
+    let origin = composeOrigin(input.origin, letteredWashed.origin);
+    const separated = buildCredentialView(pre, true, false, blankRead);
+    if (separated === null) {
+        const target = new PlainTarget(pre, trace);
+        runCredentialNets(target, urls, words, literal);
+        return traced(target.text, composeOrigin(origin, target.origin));
+    }
+    const afterSeparated = washThroughView(pre, separated, urls, words, trace, literal);
+    origin = composeOrigin(origin, afterSeparated.origin);
+    const joined = buildCredentialView(afterSeparated.text, false, false, blankRead);
+    if (joined === null)
+        return traced(afterSeparated.text, origin);
+    const afterJoined = washThroughView(afterSeparated.text, joined, urls, words, trace, literal);
+    return traced(afterJoined.text, composeOrigin(origin, afterJoined.origin));
+}
+function washControlStringContents(text, urls, words, blankTokens, trace) {
     if (!/[\u001b\u0090\u0098\u009d-\u009f]|\\u/.test(text))
-        return text;
-    const ends = new ControlStringEnds(text);
+        return { text };
+    const ends = new SequenceReader(text, 'none');
     const parts = [];
+    const origin = trace ? [] : null;
+    const keptUpTo = (a, b) => {
+        if (origin !== null)
+            for (let x = a; x < b; x++)
+                origin.push(x);
+    };
     let cursor = 0;
     let i = 0;
     while (i < text.length) {
@@ -1288,32 +1612,45 @@ function washControlStringContents(text, urls, words) {
         if (unit.content !== undefined) {
             const [a, b] = unit.content;
             const inner = text.slice(a, b);
-            const washed = washCredentialNets(inner, urls, words, true);
-            if (washed !== inner) {
-                parts.push(text.slice(cursor, a), washed);
+            const washed = washNets(inner, urls, words, true, blankTokens, trace);
+            if (washed.text !== inner) {
+                parts.push(text.slice(cursor, a), washed.text);
+                keptUpTo(cursor, a);
+                if (origin !== null) {
+                    const w = washed.origin;
+                    for (let x = 0; x < washed.text.length; x++) {
+                        const s = w === undefined ? x : (w[x] ?? -1);
+                        origin.push(s < 0 ? -1 : a + s);
+                    }
+                }
                 cursor = b;
             }
         }
         i = Math.max(unit.end, i + 1);
     }
     if (cursor === 0)
-        return text;
+        return { text };
     parts.push(text.slice(cursor));
-    return parts.join('');
+    keptUpTo(cursor, text.length);
+    const joined = parts.join('');
+    return origin === null ? { text: joined } : { text: joined, origin: Int32Array.from(origin) };
 }
 const MAX_SETTLE_ROUNDS = 4;
-function washCredentialNets(text, urls, words, nested = false) {
+function washNets(text, urls, words, nested, blankTokens, trace) {
     if (!urls && !words)
-        return text;
-    let current = text;
+        return { text };
+    let current = { text };
     for (let round = 0; round < MAX_SETTLE_ROUNDS; round++) {
-        const next = washCredentialNetsOnce(current, urls, words, nested);
-        if (next === current)
+        const next = washCredentialNetsOnce(current.text, urls, words, nested, blankTokens, trace);
+        if (next.text === current.text)
             return current;
-        current = next;
+        current = traced(next.text, composeOrigin(current.origin, next.origin));
     }
     return current;
 }
+function washCredentialNets(text, urls, words, nested = false, blankTokens = 'off') {
+    return washNets(text, urls, words, nested, blankTokens, false).text;
+}
 export function washCredentials(text) {
     if (typeof text !== 'string')
         return text;
@@ -1324,7 +1661,111 @@ const C0_KEEP_LAYOUT = '\\u0000-\\u0008\\u000B-\\u001F';
 const DEL_C1 = '\\u007F-\\u009F';
 const LONE_SURROGATE = '\\uD800-\\uDFFF';
 const LINE_SEPARATORS = '\\u2028\\u2029';
-const FORMAT_CLASS = '(?![\\u200C\\u200D])\\p{Cf}';
+const NAME_BLANKS = NAME_BLANK_RANGES.map(([a, b]) => (a === b ? classEscape(a) : `${classEscape(a)}-${classEscape(b)}`)).join('');
+function classEscape(cp) {
+    return `\\u${cp.toString(16).toUpperCase().padStart(4, '0')}`;
+}
+function compilesAsUnicodeRegExp(source) {
+    try {
+        return new RegExp(source, 'u').unicode;
+    }
+    catch {
+        return false;
+    }
+}
+const JOINING_SCRIPT_CANDIDATES = [
+    'Arab', 'Syrc', 'Mand', 'Mani', 'Phlp', 'Sogd', 'Ougr', 'Chrs', 'Mong', 'Phag', 'Nkoo', 'Adlm', 'Rohg',
+    'Deva', 'Beng', 'Guru', 'Gujr', 'Orya', 'Taml', 'Telu', 'Knda', 'Mlym', 'Sinh',
+    'Brah', 'Kthi', 'Shrd', 'Sidd', 'Tirh', 'Gran', 'Newa', 'Takr', 'Modi', 'Mahj', 'Khoj', 'Sind', 'Dogr', 'Nand',
+    'Gonm', 'Gong', 'Diak', 'Bhks', 'Zanb', 'Soyo', 'Ahom', 'Cakm', 'Sylo', 'Saur', 'Mtei', 'Limb', 'Lepc', 'Kawi',
+    'Mymr', 'Khmr', 'Thai', 'Laoo', 'Tibt', 'Bali', 'Java', 'Sund', 'Lana', 'Tavt', 'Talu', 'Tale', 'Cham', 'Batk',
+    'Bugi', 'Maka', 'Rjng', 'Kali', 'Tglg', 'Hano', 'Buhd', 'Tagb',
+];
+const JOINING_SCRIPTS = JOINING_SCRIPT_CANDIDATES.filter((sc) => compilesAsUnicodeRegExp(`\\p{scx=${sc}}`));
+function codePointTest(source) {
+    if (!compilesAsUnicodeRegExp(source))
+        return () => false;
+    const re = new RegExp(`^${source}$`, 'u');
+    return (cp) => re.test(String.fromCodePoint(cp));
+}
+const isClusterExtender = codePointTest('[\\p{M}\\p{Emoji_Modifier}]');
+const isPictograph = codePointTest('\\p{Extended_Pictographic}');
+const isEmojiPresentation = codePointTest('\\p{Emoji_Presentation}');
+const isEmojiModifier = codePointTest('\\p{Emoji_Modifier}');
+const isJoiningLetter = JOINING_SCRIPTS.length === 0
+    ? () => false
+    : codePointTest('(?=\\p{L})(?!(?=\\p{Lm})[\\p{sc=Zyyy}\\p{sc=Zinh}])[' + JOINING_SCRIPTS.map((sc) => '\\p{scx=' + sc + '}').join('') + ']');
+const VIRAMA_CODE_POINTS = [
+    0x094d, 0x09cd, 0x0a4d, 0x0acd, 0x0b4d, 0x0bcd, 0x0c4d, 0x0ccd, 0x0d3b, 0x0d3c, 0x0d4d, 0x0dca,
+    0x0e3a, 0x0eba, 0x0f84, 0x1039, 0x103a, 0x1714, 0x1715, 0x1734, 0x17d2, 0x1a60, 0x1b44, 0x1baa, 0x1bab, 0x1bf2, 0x1bf3,
+    0xa806, 0xa82c, 0xa8c4, 0xa953, 0xa9c0, 0xaaf6, 0xabed,
+    0x11046, 0x11070, 0x1107f, 0x110b9, 0x11133, 0x11134, 0x111c0, 0x11235, 0x112ea, 0x1134d, 0x11442, 0x114c2, 0x115bf,
+    0x1163f, 0x116b6, 0x1172b, 0x11839, 0x1193d, 0x1193e, 0x119e0, 0x11a34, 0x11a47, 0x11a99, 0x11c3f, 0x11d44, 0x11d45,
+    0x11d97, 0x11f41, 0x11f42,
+];
+const VIRAMAS = new Set(VIRAMA_CODE_POINTS);
+function joinerKept(text, at, zwj) {
+    let p = at;
+    let left = -1;
+    let base = -1;
+    let afterBase = -1;
+    let visited = -1;
+    while (p > 0) {
+        let q = p - 1;
+        const unit = text.charCodeAt(q);
+        if (unit >= 0xdc00 && unit <= 0xdfff && q > 0) {
+            const hi = text.charCodeAt(q - 1);
+            if (hi >= 0xd800 && hi <= 0xdbff)
+                q -= 1;
+        }
+        const cp = text.codePointAt(q) ?? unit;
+        if (left === -1)
+            left = cp;
+        p = q;
+        if (!isClusterExtender(cp)) {
+            base = cp;
+            afterBase = visited;
+            break;
+        }
+        visited = cp;
+    }
+    if (base === -1)
+        return false;
+    let r = at + 1;
+    let next = -1;
+    let rightBase = -1;
+    while (r < text.length) {
+        const cp = text.codePointAt(r) ?? 0;
+        if (next === -1)
+            next = cp;
+        r += cp > 0xffff ? 2 : 1;
+        if (!isClusterExtender(cp)) {
+            rightBase = cp;
+            break;
+        }
+    }
+    if (zwj && next !== -1) {
+        const nextEnd = at + 1 + (next > 0xffff ? 2 : 1);
+        const afterNext = nextEnd < text.length ? (text.codePointAt(nextEnd) ?? -1) : -1;
+        if (emojiPresented(base, afterBase) && emojiPresented(next, afterNext))
+            return true;
+    }
+    if (!isJoiningLetter(base))
+        return false;
+    if (rightBase !== -1 && isJoiningLetter(rightBase))
+        return true;
+    return zwj && VIRAMAS.has(left);
+}
+function emojiPresented(cp, after) {
+    return isPictograph(cp) && (isEmojiPresentation(cp) || after === 0xfe0f || (after !== -1 && isEmojiModifier(after)));
+}
+function faceHitKept(ch, at, text) {
+    if (ch.length > 2)
+        return true;
+    const c = ch.charCodeAt(0);
+    return ch.length === 1 && (c === 0x200d || c === 0x200c) && joinerKept(text, at, c === 0x200d);
+}
+const FORMAT_CLASS = '\\p{Cf}';
 const RGI_TAG_FLAG = '\\u{1F3F4}\\u{E0067}\\u{E0062}(?:\\u{E0065}\\u{E006E}\\u{E0067}|\\u{E0073}\\u{E0063}\\u{E0074}|\\u{E0077}\\u{E006C}\\u{E0073})\\u{E007F}';
 const BIDI_REORDER = '\\u061C\\u200E\\u200F\\u2028\\u2029\\u202A-\\u202E\\u2066-\\u2069';
 function unsafeClass(members, withFormatClass) {
@@ -1357,27 +1798,173 @@ function markOf(ch, mark) {
     const hex = code.toString(16).toUpperCase();
     return code > 0xffff ? `\\u{${hex}}` : `\\u${hex.padStart(4, '0')}`;
 }
-const foldWhitespace = (s) => s.replace(/\s+/g, ' ').trim();
+const FOLD_RUN = /\s+/g;
+const FOLD_RUN_KEEPING_BLANKS = new RegExp(`[^\\S${NAME_BLANKS}]+`, 'g');
+const EDGE_SPACE = /^ | $/g;
+const foldWhitespace = (s, keepBlanks = false) => keepBlanks ? s.replace(FOLD_RUN_KEEPING_BLANKS, ' ').replace(EDGE_SPACE, '') : s.replace(FOLD_RUN, ' ').trim();
 export function applyDisplayFace(text, face) {
-    const markAll = (s) => face.unsafe === null ? s : s.replace(face.unsafe, ch => (ch.length > 2 ? ch : markOf(ch, face.mark)));
+    const markAll = (s) => face.unsafe === null ? s : s.replace(face.unsafe, (ch, at, whole) => (faceHitKept(ch, at, whole) ? ch : markOf(ch, face.mark)));
+    const keepBlanks = face.keepBlanks === true;
     if (face.mark === 'space') {
         const marked = markAll(text);
-        return face.fold ? foldWhitespace(marked) : marked;
+        return face.fold ? foldWhitespace(marked, keepBlanks) : marked;
+    }
+    return markAll(face.fold ? foldWhitespace(text, keepBlanks) : text);
+}
+function markTracked(t, re, mark, ledger) {
+    const parts = [];
+    const ids = [];
+    const keep = (a, b) => {
+        parts.push(t.text.slice(a, b));
+        for (let k = a; k < b; k++)
+            ids.push(t.ids[k] ?? -1);
+    };
+    let cursor = 0;
+    for (const hit of t.text.matchAll(re)) {
+        const at = hit.index ?? 0;
+        const ch = hit[0];
+        keep(cursor, at);
+        if (faceHitKept(ch, at, t.text))
+            keep(at, at + ch.length);
+        else {
+            const form = markOf(ch, mark);
+            const id = ledger.cps.length;
+            ledger.cps.push(ch.codePointAt(0) ?? 0);
+            ledger.lens.push(form.length);
+            parts.push(form);
+            for (let x = 0; x < form.length; x++)
+                ids.push(id);
+        }
+        cursor = at + ch.length;
     }
-    return markAll(face.fold ? foldWhitespace(text) : text);
+    if (cursor === 0)
+        return t;
+    keep(cursor, t.text.length);
+    return { text: parts.join(''), ids: Int32Array.from(ids) };
 }
-const PUBLIC_UNSAFE_BY_NETS = Object.freeze(Array.from({ length: 8 }, (_, i) => {
-    const controls = (i & 4) !== 0;
-    const bidi = (i & 2) !== 0;
-    const keep = (i & 1) !== 0;
-    const members = `${controls ? `${keep ? C0_KEEP_LAYOUT : C0_ALL}${DEL_C1}${LONE_SURROGATE}` : ''}${bidi ? LINE_SEPARATORS : ''}`;
+function foldTracked(t, keepBlanks) {
+    const parts = [];
+    const ids = [];
+    let cursor = 0;
+    for (const run of t.text.matchAll(keepBlanks ? FOLD_RUN_KEEPING_BLANKS : FOLD_RUN)) {
+        const at = run.index ?? 0;
+        parts.push(t.text.slice(cursor, at));
+        for (let k = cursor; k < at; k++)
+            ids.push(t.ids[k] ?? -1);
+        let id = -1;
+        for (let k = at; k < at + run[0].length && id < 0; k++)
+            id = t.ids[k] ?? -1;
+        parts.push(' ');
+        ids.push(id);
+        cursor = at + run[0].length;
+    }
+    parts.push(t.text.slice(cursor));
+    for (let k = cursor; k < t.text.length; k++)
+        ids.push(t.ids[k] ?? -1);
+    const folded = parts.join('');
+    let from = 0;
+    let to = folded.length;
+    if (folded.charCodeAt(0) === 0x20)
+        from = 1;
+    if (to > from && folded.charCodeAt(to - 1) === 0x20)
+        to -= 1;
+    return { text: folded.slice(from, to), ids: Int32Array.from(ids.slice(from, to)) };
+}
+function faceTracked(t, face, ledger) {
+    const keepBlanks = face.keepBlanks === true;
+    const unsafe = face.unsafe;
+    const markAll = (x) => (unsafe === null ? x : markTracked(x, unsafe, face.mark, ledger));
+    if (face.mark === 'space') {
+        const marked = markAll(t);
+        return face.fold ? foldTracked(marked, keepBlanks) : marked;
+    }
+    return markAll(face.fold ? foldTracked(t, keepBlanks) : t);
+}
+function carryIds(ids, origin) {
+    if (origin === undefined)
+        return ids;
+    const out = new Int32Array(origin.length);
+    for (let k = 0; k < origin.length; k++) {
+        const s = origin[k] ?? -1;
+        out[k] = s < 0 ? -1 : (ids[s] ?? -1);
+    }
+    return out;
+}
+function pairLiteralBackslashes(t) {
+    if (!t.text.includes('\\'))
+        return t;
+    const parts = [];
+    const ids = [];
+    for (let k = 0; k < t.text.length; k++) {
+        const ch = t.text.charAt(k);
+        const id = t.ids[k] ?? -1;
+        parts.push(ch);
+        ids.push(id);
+        if (ch === '\\' && id < 0) {
+            parts.push('\\');
+            ids.push(-1);
+        }
+    }
+    return { text: parts.join(''), ids: Int32Array.from(ids) };
+}
+function capPaired(t, max) {
+    if (typeof max !== 'number' || !Number.isFinite(max))
+        return t;
+    const limit = Math.max(0, Math.floor(max));
+    let cost = 0;
+    let cut = 0;
+    while (cut < t.text.length) {
+        const width = t.text.charCodeAt(cut) === 0x5c && (t.ids[cut] ?? -1) < 0 ? 2 : 1;
+        if (cost + width > limit)
+            break;
+        cost += width;
+        cut++;
+    }
+    if (cut === t.text.length)
+        return t;
+    const id = t.ids[cut] ?? -1;
+    if (id >= 0)
+        while (cut > 0 && t.ids[cut - 1] === id)
+            cut--;
+    if (cut > 0) {
+        const code = t.text.charCodeAt(cut - 1);
+        if (code >= 0xd800 && code <= 0xdbff)
+            cut -= 1;
+    }
+    return { text: t.text.slice(0, cut), ids: t.ids.slice(0, cut) };
+}
+function collectMarks(t, ledger) {
+    const out = [];
+    let k = 0;
+    while (k < t.ids.length) {
+        const id = t.ids[k] ?? -1;
+        if (id < 0) {
+            k++;
+            continue;
+        }
+        let j = k + 1;
+        while (j < t.ids.length && t.ids[j] === id)
+            j++;
+        if (j - k === ledger.lens[id])
+            out.push({ start: k, end: j, codePoint: ledger.cps[id] ?? 0 });
+        k = j;
+    }
+    return out;
+}
+const PUBLIC_UNSAFE_BY_NETS = Object.freeze(Array.from({ length: 16 }, (_, i) => {
+    const controls = (i & 8) !== 0;
+    const bidi = (i & 4) !== 0;
+    const keep = (i & 2) !== 0;
+    const blanks = (i & 1) !== 0;
+    const members = `${controls ? `${keep ? C0_KEEP_LAYOUT : C0_ALL}${DEL_C1}${LONE_SURROGATE}` : ''}${bidi ? LINE_SEPARATORS : ''}${blanks ? NAME_BLANKS : ''}`;
     return unsafeClass(members, bidi);
 }));
 function publicFace(opts) {
     const fold = opts.foldLines !== false;
     const keep = !fold && opts.keepLayout === true;
-    const index = (opts.controls !== false ? 4 : 0) + (opts.bidi !== false ? 2 : 0) + (keep ? 1 : 0);
-    return { unsafe: PUBLIC_UNSAFE_BY_NETS[index] ?? null, fold, mark: opts.mark ?? 'escape' };
+    const blanks = opts.blanks === true;
+    const index = (opts.controls !== false ? 8 : 0) + (opts.bidi !== false ? 4 : 0) + (keep ? 2 : 0) + (blanks ? 1 : 0);
+    return { unsafe: PUBLIC_UNSAFE_BY_NETS[index] ?? null, fold, mark: opts.mark ?? 'escape', keepBlanks: blanks };
 }
 const ESCAPE_TOKEN_AT = /^\\u(?:[0-9A-F]{4}|\{[0-9A-F]{1,6}\})/;
 function capDisplay(text, max, mark) {
@@ -1405,33 +1992,72 @@ function capDisplay(text, max, mark) {
     return text.slice(0, cut);
 }
 const MAX_CAP_SETTLE_ROUNDS = 4;
-export function displayUntrusted(text, opts = {}) {
-    const input = typeof text === 'string' ? text : String(text ?? '');
-    const o = opts ?? {};
-    const urls = o.credentialUrls !== false;
-    const words = o.credentialWords !== false;
-    const face = publicFace(o);
+function runDisplaySteps(start, steps) {
     const settle = (s) => {
-        let current = applyDisplayFace(washCredentialNets(s, urls, words), face);
-        if (current === s)
+        let current = steps.paint(steps.wash(s));
+        if (steps.text(current) === steps.text(s))
             return current;
         for (let round = 1; round < MAX_SETTLE_ROUNDS; round++) {
-            const next = applyDisplayFace(washCredentialNets(current, urls, words), face);
-            if (next === current)
+            const next = steps.paint(steps.wash(current));
+            if (steps.text(next) === steps.text(current))
                 return current;
             current = next;
         }
         return current;
     };
-    const settled = settle(input);
-    let out = capDisplay(settled, o.max, face.mark);
-    if (out === settled)
+    const settled = settle(start);
+    let out = steps.cap(settled);
+    if (steps.text(out) === steps.text(settled))
         return out;
     for (let round = 0; round < MAX_CAP_SETTLE_ROUNDS; round++) {
-        const again = capDisplay(settle(out), o.max, face.mark);
-        if (again === out)
+        const again = steps.cap(settle(out));
+        if (steps.text(again) === steps.text(out))
             break;
         out = again;
     }
     return out;
 }
+function renderUntrusted(text, opts, ledger) {
+    const input = typeof text === 'string' ? text : String(text ?? '');
+    const o = opts ?? {};
+    const urls = o.credentialUrls !== false;
+    const words = o.credentialWords !== false;
+    const face = publicFace(o);
+    const blankTokens = face.keepBlanks !== true ? 'off' : face.fold ? 'fold' : 'keep';
+    const pairBackslashes = o.escapeBackslashes === true && face.mark !== 'dot' && face.mark !== 'space';
+    const book = ledger ?? (pairBackslashes ? { cps: [], lens: [] } : null);
+    if (book === null) {
+        return runDisplaySteps(input, {
+            wash: (s) => washCredentialNets(s, urls, words, false, blankTokens),
+            paint: (s) => applyDisplayFace(s, face),
+            cap: (s) => capDisplay(s, o.max, face.mark),
+            text: (s) => s,
+        });
+    }
+    const out = runDisplaySteps({ text: input, ids: new Int32Array(input.length).fill(-1) }, {
+        wash: (t) => {
+            const r = washNets(t.text, urls, words, false, blankTokens, true);
+            return r.text === t.text ? t : { text: r.text, ids: carryIds(t.ids, r.origin) };
+        },
+        paint: (t) => faceTracked(t, face, book),
+        cap: (t) => {
+            if (pairBackslashes)
+                return capPaired(t, o.max);
+            const cut = capDisplay(t.text, o.max, face.mark);
+            return cut === t.text ? t : { text: cut, ids: t.ids.slice(0, cut.length) };
+        },
+        text: (t) => t.text,
+    });
+    return pairBackslashes ? pairLiteralBackslashes(out) : out;
+}
+export function displayUntrusted(text, opts = {}) {
+    const out = renderUntrusted(text, opts, null);
+    return typeof out === 'string' ? out : out.text;
+}
+export function displayUntrustedMarks(text, opts = {}) {
+    const ledger = { cps: [], lens: [] };
+    const out = renderUntrusted(text, opts, ledger);
+    if (typeof out === 'string')
+        return { text: out, marks: [] };
+    return { text: out.text, marks: collectMarks(out, ledger) };
+}