@sema-agent/client-core 0.87.0 → 0.89.0

package/dist/displayUntrusted.js

@@ -26,135 +26,6 @@ function pushEdit(edits, src, start, end, text) {
 const UNIT_NONE = 0;
 const UNIT_SEQUENCE = 1;
 const UNIT_SINGLE = 2;
-const NO_UNITS = () => UNIT_NONE;
-function applyEdits(text, edits) {
-    if (edits.length === 0)
-        return text;
-    const parts = [];
-    let cursor = 0;
-    for (const e of edits) {
-        parts.push(text.slice(cursor, e.start), e.text);
-        cursor = e.end;
-    }
-    parts.push(text.slice(cursor));
-    return parts.join('');
-}
-class PlainTarget {
-    text;
-    origin;
-    trace;
-    constructor(text, trace = false) {
-        this.text = text;
-        this.trace = trace;
-    }
-    apply(edits) {
-        if (this.trace && edits.length > 0)
-            this.origin = editedOrigin(this.origin, this.text.length, edits);
-        this.text = applyEdits(this.text, edits);
-    }
-    unitAt() {
-        return UNIT_NONE;
-    }
-}
-const traced = (text, origin) => (origin === undefined ? { text } : { text, origin });
-function editedOrigin(prev, length, edits) {
-    let n = length;
-    for (const e of edits)
-        n += e.text.length - (e.end - e.start);
-    const out = new Int32Array(n);
-    let w = 0;
-    let cursor = 0;
-    const copy = (a, b) => {
-        for (let k = a; k < b; k++)
-            out[w++] = prev === undefined ? k : (prev[k] ?? -1);
-    };
-    for (const e of edits) {
-        copy(cursor, e.start);
-        out.fill(-1, w, w + e.text.length);
-        w += e.text.length;
-        cursor = e.end;
-    }
-    copy(cursor, length);
-    return out;
-}
-function composeOrigin(outer, inner) {
-    if (inner === undefined)
-        return outer;
-    if (outer === undefined)
-        return inner;
-    const out = new Int32Array(inner.length);
-    for (let k = 0; k < inner.length; k++) {
-        const s = inner[k] ?? -1;
-        out[k] = s < 0 ? -1 : (outer[s] ?? -1);
-    }
-    return out;
-}
-class TrackedTarget {
-    text;
-    src;
-    spans = [];
-    viewLength;
-    units;
-    constructor(text, viewLength, units) {
-        this.text = text;
-        this.viewLength = viewLength;
-        this.units = units;
-        this.src = new Int32Array(text.length);
-        for (let k = 0; k < text.length; k++)
-            this.src[k] = k;
-    }
-    unitAt(k) {
-        const s = this.src[k] ?? -1;
-        return s >= 0 && this.units !== undefined ? (this.units[s] ?? UNIT_NONE) : UNIT_NONE;
-    }
-    rangeStart(k) {
-        const s = this.src[k] ?? 0;
-        return s >= 0 ? s : (this.spans[2 * (-1 - s)] ?? 0);
-    }
-    rangeEnd(k) {
-        const s = this.src[k] ?? 0;
-        return s >= 0 ? s + 1 : (this.spans[2 * (-1 - s) + 1] ?? 0);
-    }
-    apply(edits) {
-        if (edits.length === 0)
-            return;
-        let length = this.text.length;
-        for (const e of edits)
-            length += e.text.length - (e.end - e.start);
-        const src = new Int32Array(length);
-        const parts = [];
-        let cursor = 0;
-        let w = 0;
-        for (const e of edits) {
-            src.set(this.src.subarray(cursor, e.start), w);
-            w += e.start - cursor;
-            parts.push(this.text.slice(cursor, e.start), e.text);
-            let a;
-            let b;
-            if (e.start === e.end) {
-                a = e.start < this.text.length ? this.rangeStart(e.start) : this.viewLength;
-                b = a;
-            }
-            else {
-                a = this.rangeStart(e.start);
-                b = this.rangeEnd(e.start);
-                for (let k = e.start + 1; k < e.end; k++) {
-                    a = Math.min(a, this.rangeStart(k));
-                    b = Math.max(b, this.rangeEnd(k));
-                }
-            }
-            const id = this.spans.length / 2;
-            this.spans.push(a, b);
-            src.fill(-1 - id, w, w + e.text.length);
-            w += e.text.length;
-            cursor = e.end;
-        }
-        src.set(this.src.subarray(cursor), w);
-        parts.push(this.text.slice(cursor));
-        this.text = parts.join('');
-        this.src = src;
-    }
-}
 const SECRET_LITERAL_RE = /^(sk-|gh[opus]_|github_pat_|xox[baprse]-|xapp-|bearer\s|basic\s|eyJ[A-Za-z0-9_-]{10,}\.|AKIA[0-9A-Z]{12,}|AIza[0-9A-Za-z_-]{20,}|-----BEGIN[A-Z0-9 ]*PRIVATE KEY)/i;
 const SCHEME_TOKEN_RE = /(?:^|[^A-Za-z0-9_-])(?:bearer|basic)[ \t]+\S{8,4096}/i;
 const JWT_RE = /(?:^|[^A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{8,2048}\.[A-Za-z0-9_-]{8,2048}\.[A-Za-z0-9_-]{4,2048}/i;
@@ -181,6 +52,147 @@ export function looksLikeKnownSecret(s) {
     }
     return false;
 }
+const KIND_BY_TEXT = new Map([
+    [REDACTED_USERINFO, 'userinfo'],
+    [REDACTED_QUERY, 'query'],
+    [REDACTED_FRAGMENT, 'fragment'],
+    [REDACTED_SECRET, 'secret'],
+]);
+const TEXT_BY_KIND = {
+    userinfo: REDACTED_USERINFO,
+    query: REDACTED_QUERY,
+    fragment: REDACTED_FRAGMENT,
+    secret: REDACTED_SECRET,
+};
+const isStructuralKind = (kind) => kind !== 'secret';
+const MARKER_WITH_DOTS = /^[. ]*(?:(?:\u00abredacted(?::[a-z-]{1,16}){0,2}\u00bb|\*{3})[. ]*)+$/;
+function valueIsWholeMarker(S, start, end, tokenInner = true) {
+    const text = S.text;
+    let k = start;
+    while (k < end && (S.dropped(k) || text[k] === '.' || text[k] === ' '))
+        k++;
+    let m;
+    const retired = text.startsWith(RETIRED_MARKER, k);
+    if (retired)
+        m = k + RETIRED_MARKER.length;
+    else {
+        if (!text.startsWith(REDACTION_MARKER_PREFIX, k))
+            return false;
+        const re = new RegExp(MARKER_ANYWHERE.source, 'y');
+        re.lastIndex = k;
+        if (!re.test(text))
+            return false;
+        m = re.lastIndex;
+    }
+    let j = m;
+    while (j < end && S.dropped(j))
+        j++;
+    if (text[j] === '@' && text.startsWith(REDACTED_USERINFO, k))
+        return false;
+    if (retired) {
+        while (j < end && (S.dropped(j) || S.painted(j) || text[j] === '.' || text[j] === ' '))
+            j++;
+        return j >= end || credentialWordStartsExactlyAt(text, j, tokenInner) || credentialPairAt(S, j);
+    }
+    while (j < end && (S.dropped(j) || S.painted(j)))
+        j++;
+    return j >= end || !isKeyWordChar(text.charCodeAt(j)) || credentialWordStartsExactlyAt(text, j, tokenInner) || credentialPairAt(S, j);
+}
+const CREDENTIAL_NAME = /(?:(?:access|refresh|id|client|api|x[-_]api|session|auth)[-_]?)?(?:token|key|secret|password|authorization|credential)s?|bearer|basic/iy;
+const LABEL_SEPARATOR = /(?:\\*["'])?[\s\u115F\u1160\u3164\uFFA0\u2800]*[:=\uFF1A\uFF1D]/y;
+const SCHEME_SEPARATOR = /[\s:=\uFF1A\uFF1D\u115F\u1160\u3164\uFFA0\u2800]/y;
+function credentialPairAt(S, at) {
+    const text = S.text;
+    const re = new RegExp(CREDENTIAL_NAME.source, 'iy');
+    re.lastIndex = at;
+    const m = re.exec(text);
+    if (m === null)
+        return false;
+    let k = at + m[0].length;
+    if (isKeyWordChar(text.charCodeAt(k)))
+        return false;
+    const skippable = (p) => S.dropped(p) || S.painted(p) || text[p] === '.' || text[p] === ' ';
+    const skipped = k < text.length && skippable(k);
+    while (k < text.length && skippable(k))
+        k++;
+    if (k >= text.length)
+        return true;
+    const scheme = /^(?:bearer|basic)$/i.test(m[0]);
+    if (!(scheme && skipped)) {
+        const sep = new RegExp((scheme ? SCHEME_SEPARATOR : LABEL_SEPARATOR).source, 'y');
+        sep.lastIndex = k;
+        if (!sep.test(text))
+            return false;
+        k = sep.lastIndex;
+    }
+    while (k < text.length && (skippable(k) || isRegexSpace(text.charCodeAt(k)) || text[k] === '"' || text[k] === "'" || text[k] === '\\'))
+        k++;
+    if (k >= text.length || isBareValueStop(text.charAt(k)))
+        return true;
+    if (text.startsWith(RETIRED_MARKER, k))
+        return true;
+    const mk = new RegExp(MARKER_ANYWHERE.source, 'y');
+    mk.lastIndex = k;
+    return mk.test(text);
+}
+const MARKER_LEAD = /^[. ,;:!?']*(?:(?:\u00abredacted(?::[a-z-]{1,16}){0,2}\u00bb|\*{3})[. ,;:!?']*)+/;
+function nextPairOrNameAt(v, at) {
+    const name = new RegExp(CREDENTIAL_NAME.source, 'iy');
+    name.lastIndex = at;
+    if (name.test(v)) {
+        let k = name.lastIndex;
+        while (k < v.length && TRAILING_PUNCTUATION.has(v.charAt(k)))
+            k++;
+        if (k >= v.length)
+            return true;
+    }
+    return credentialWordStartsExactlyAt(v, at);
+}
+function userinfoIsWholeMarker(part) {
+    const v = withoutSeparators(part);
+    if (v.replace(/^[. ]+/, '').startsWith(`${REDACTED_USERINFO}@`))
+        return true;
+    const lead = MARKER_LEAD.exec(v);
+    if (lead === null)
+        return false;
+    return lead[0].length >= v.length || nextPairOrNameAt(v, lead[0].length);
+}
+function slotIsWholeMarker(part, soft) {
+    if (soft !== undefined && markerPunctSoftGlue(part, soft))
+        return false;
+    const v = withoutSeparators(part);
+    let k = 0;
+    while (k < v.length && (v[k] === '.' || v[k] === ' '))
+        k++;
+    if (v.startsWith(RETIRED_MARKER, k)) {
+        const lead = MARKER_LEAD.exec(v);
+        return lead !== null && (lead[0].length >= v.length || nextPairOrNameAt(v, lead[0].length));
+    }
+    const re = new RegExp(MARKER_ANYWHERE.source, 'y');
+    re.lastIndex = k;
+    if (!re.test(v))
+        return false;
+    let j = re.lastIndex;
+    while (j < v.length && (v[j] === '.' || v[j] === ' '))
+        j++;
+    return j >= v.length || !isKeyWordChar(v.charCodeAt(j)) || nextPairOrNameAt(v, j);
+}
+function markerPunctSoftGlue(part, soft) {
+    let k = 0;
+    while (k < part.length && (part[k] === VIEW_SEPARATOR || part[k] === '.' || part[k] === ' '))
+        k++;
+    const re = new RegExp(MARKER_ANYWHERE.source, 'y');
+    re.lastIndex = k;
+    if (!re.test(part))
+        return false;
+    let j = re.lastIndex;
+    while (j < part.length && part[j] !== VIEW_SEPARATOR && !soft(j) && TRAILING_PUNCTUATION.has(part.charAt(j)))
+        j++;
+    const s0 = j;
+    while (j < part.length && (part[j] === VIEW_SEPARATOR || soft(j)))
+        j++;
+    return j > s0 && j < part.length && isKeyWordChar(part.charCodeAt(j)) && !nextPairOrNameAt(part, j);
+}
 const TOKEN_STOP = new Set(['"', '<', '>', '`', '|', '\\', '^', '{', '}']);
 const TRAILING_PUNCTUATION = new Set(['.', ',', ';', ':', '!', '?', "'"]);
 const VALUE_BOUNDARY_TAIL = /[?#&=;]$/;
@@ -188,6 +200,10 @@ const isWhitespaceOrControl = (ch) => {
     const c = ch.charCodeAt(0);
     return c <= 0x20 || c === 0x7f;
 };
+const endsUrlFragmentAt = (s, at) => {
+    const ch = s.charAt(at);
+    return ch !== '' && (isWhitespaceOrControl(ch) || TOKEN_STOP.has(ch));
+};
 const isSchemeChar = (ch) => (ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z') || (ch >= '0' && ch <= '9') || ch === '+' || ch === '.' || ch === '-';
 const isAlpha = (ch) => (ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z');
 const isHexDigit = (ch) => (ch >= '0' && ch <= '9') || (ch >= 'a' && ch <= 'f') || (ch >= 'A' && ch <= 'F');
@@ -226,7 +242,8 @@ function schemelessHostEnd(text, from) {
         if (d > k + 1)
             k = d;
     }
-    return endsSchemelessHost(text.charCodeAt(k)) ? k : -1;
+    const c = text.charCodeAt(k);
+    return endsSchemelessHost(c) || c === 0x27 ? k : -1;
 }
 function valueCoreForJudging(value) {
     if (value.length === 0 || isMarker(value))
@@ -240,38 +257,49 @@ function isKnownSecretSegment(value) {
     const core = valueCoreForJudging(value);
     return core.length > 0 && looksLikeKnownSecret(core);
 }
-function queryEdits(src, base, query, edits) {
+function queryCandidates(src, base, query, edits, soft) {
     let pos = base;
     for (const part of query.split('&')) {
         if (part.length > 0) {
             const eq = part.indexOf('=');
             if (eq === -1) {
-                if (!isMarker(part))
+                const at = pos;
+                if (!slotIsWholeMarker(part, soft && ((i) => soft(at + i))))
                     pushEdit(edits, src, pos, pos + part.length, REDACTED_QUERY);
             }
             else {
                 const value = part.slice(eq + 1);
-                if (value.length > 0 && !isMarker(value))
+                const at = pos + eq + 1;
+                if (value.length > 0 && !slotIsWholeMarker(value, soft && ((i) => soft(at + i))))
                     pushEdit(edits, src, pos + eq + 1, pos + part.length, REDACTED_QUERY);
             }
         }
         pos += part.length + 1;
     }
 }
-function pathEdits(src, base, path, opaqueSegments, edits) {
+function pathCandidates(src, base, path, opaqueSegments, edits, soft) {
     let pos = base;
     for (const segment of path.split('/')) {
         const semi = segment.indexOf(';');
         const head = semi === -1 ? segment : segment.slice(0, semi);
-        if (opaqueSegments && isKnownSecretSegment(head))
-            pushEdit(edits, src, pos, pos + head.length, REDACTED_SECRET);
+        if (opaqueSegments && isKnownSecretSegment(head)) {
+            let a = 0;
+            let b = head.length;
+            while (a < b && !isKeyWordChar(head.charCodeAt(a)))
+                a++;
+            while (b > a && !isKeyWordChar(head.charCodeAt(b - 1)))
+                b--;
+            if (b > a)
+                pushEdit(edits, src, pos + a, pos + b, REDACTED_SECRET);
+        }
         if (semi !== -1) {
             let ppos = pos + semi + 1;
             for (const part of segment.slice(semi + 1).split(';')) {
                 const eq = part.indexOf('=');
                 if (eq !== -1) {
                     const value = part.slice(eq + 1);
-                    if (value.length > 0 && !isMarker(value))
+                    const at = ppos + eq + 1;
+                    if (value.length > 0 && !slotIsWholeMarker(value, soft && ((i) => soft(at + i))))
                         pushEdit(edits, src, ppos + eq + 1, ppos + part.length, REDACTED_QUERY);
                 }
                 ppos += part.length + 1;
@@ -280,7 +308,7 @@ function pathEdits(src, base, path, opaqueSegments, edits) {
         pos += segment.length + 1;
     }
 }
-function urlTokenEditsAt(src, start, end, edits) {
+function urlTokenCandidatesAt(src, start, end, edits, soft) {
     const token = src.slice(start, end);
     const schemeEnd = token.indexOf('://') + '://'.length;
     const scheme = token.slice(0, schemeEnd);
@@ -290,23 +318,23 @@ function urlTokenEditsAt(src, start, end, edits) {
     const tailStart = schemeEnd + authority.length;
     const tail = token.slice(tailStart);
     const at = authority.lastIndexOf('@');
-    if (at !== -1)
+    if (at !== -1 && !userinfoIsWholeMarker(authority.slice(0, at)))
         pushEdit(edits, src, start + schemeEnd, start + schemeEnd + at, REDACTED_USERINFO);
     const hash = tail.indexOf('#');
     const beforeHash = hash === -1 ? tail : tail.slice(0, hash);
     const question = beforeHash.indexOf('?');
     const path = question === -1 ? beforeHash : beforeHash.slice(0, question);
-    pathEdits(src, start + tailStart, path, !/^file:/i.test(scheme), edits);
+    pathCandidates(src, start + tailStart, path, !/^file:/i.test(scheme), edits, soft);
     if (question !== -1)
-        queryEdits(src, start + tailStart + question + 1, beforeHash.slice(question + 1), edits);
+        queryCandidates(src, start + tailStart + question + 1, beforeHash.slice(question + 1), edits, soft);
     if (hash !== -1) {
         const rawFragment = tail.slice(hash + 1);
-        if (rawFragment.length > 0 && !isMarker(rawFragment))
+        const at = start + tailStart + hash + 1;
+        if (rawFragment.length > 0 && !slotIsWholeMarker(rawFragment, soft && ((i) => soft(at + i))))
             pushEdit(edits, src, start + tailStart + hash + 1, end, REDACTED_FRAGMENT);
     }
 }
-function urlTokenEdits(text) {
-    const edits = [];
+function urlCandidates(text, out, regions, unitPos = () => false, soft) {
     let mark = text.indexOf('://');
     while (mark !== -1) {
         let start = mark;
@@ -319,20 +347,47 @@ function urlTokenEdits(text) {
             continue;
         }
         let end = mark + 3;
+        let seenPathSep = false;
+        let atAhead = -2;
+        const colons = new AuthorityColons(text, mark + 3);
+        let firstVisible = -1;
+        const adjacent = (at) => {
+            if (firstVisible === -1) {
+                firstVisible = mark + 3;
+                while (firstVisible < text.length && unitPos(firstVisible))
+                    firstVisible++;
+            }
+            return at <= firstVisible;
+        };
         while (end < text.length) {
             const ch = text.charAt(end);
-            if (isWhitespaceOrControl(ch) || TOKEN_STOP.has(ch))
+            if (isWhitespaceOrControl(ch))
+                break;
+            if (TOKEN_STOP.has(ch)) {
+                if (!seenPathSep) {
+                    if (atAhead === -2)
+                        atAhead = atInAuthority(text, end);
+                    if (atAhead > end && (adjacent(end) || colons.colonBefore(end))) {
+                        end++;
+                        continue;
+                    }
+                }
                 break;
+            }
             const c = ch.charCodeAt(0);
             if (ch === VIEW_SEPARATOR || isUnicodeBlank(c)) {
                 let p = end;
                 while (p < text.length && (text[p] === VIEW_SEPARATOR || isUnicodeBlank(text.charCodeAt(p))))
                     p++;
-                if (credentialWordStartsNear(text, p))
+                if (nextPairBeyondFragmentAt(text, p))
                     break;
                 end = p;
                 continue;
             }
+            if ((ch === ',' || ch === ';') && nextPairBeyondFragmentAt(text, end + 1))
+                break;
+            if (ch === '/' || ch === '?' || ch === '#')
+                seenPathSep = true;
             end++;
         }
         while (end > mark + 3 && text.charAt(end - 1) === VIEW_SEPARATOR)
@@ -342,10 +397,67 @@ function urlTokenEdits(text) {
             runStart--;
         if (runStart < end && !VALUE_BOUNDARY_TAIL.test(text.slice(start, runStart)))
             end = runStart;
-        urlTokenEditsAt(text, start, end, edits);
+        const tokenEdits = [];
+        urlTokenCandidatesAt(text, start, end, tokenEdits, soft);
+        editsToCandidates(tokenEdits, 'url', out, end);
+        const token = text.slice(start, end);
+        const schemeEnd = token.indexOf('://') + 3;
+        const rest = token.slice(schemeEnd);
+        const authorityEnd = rest.search(/[/?#]/);
+        const tailStart = schemeEnd + (authorityEnd === -1 ? rest.length : authorityEnd);
+        const tail = token.slice(tailStart);
+        const hash = tail.indexOf('#');
+        const beforeHash = hash === -1 ? tail : tail.slice(0, hash);
+        const question = beforeHash.indexOf('?');
+        if (question !== -1)
+            regions.push([start + tailStart + question + 1, start + tailStart + beforeHash.length, 'query']);
+        if (hash !== -1 && hash + 1 < tail.length)
+            regions.push([start + tailStart + hash + 1, end, 'fragment']);
         mark = text.indexOf('://', end > mark + 3 ? end : mark + 3);
     }
-    return edits;
+}
+function atInAuthority(text, from) {
+    for (let p = from; p < text.length; p++) {
+        const ch = text.charAt(p);
+        if (isWhitespaceOrControl(ch) || ch === '/' || ch === '?' || ch === '#')
+            return -1;
+        if (ch === '@')
+            return p;
+    }
+    return -1;
+}
+class AuthorityColons {
+    text;
+    scanned;
+    colons = 0;
+    bracketEnd = -1;
+    constructor(text, from) {
+        this.text = text;
+        this.scanned = from;
+        if (text.charCodeAt(from) === 0x5b) {
+            let k = from + 1;
+            while (k < text.length && isIpv6Char(text.charCodeAt(k)))
+                k++;
+            if (text.charCodeAt(k) === 0x5d)
+                this.bracketEnd = k;
+        }
+    }
+    colonBefore(to) {
+        for (; this.scanned < to; this.scanned++) {
+            const c = this.text.charCodeAt(this.scanned);
+            if (c === 0xab) {
+                const re = new RegExp(MARKER_ANYWHERE.source, 'y');
+                re.lastIndex = this.scanned;
+                if (re.test(this.text) && re.lastIndex <= to) {
+                    this.scanned = re.lastIndex - 1;
+                    continue;
+                }
+            }
+            if (c === 0x3a && this.scanned > this.bracketEnd)
+                this.colons++;
+        }
+        return this.colons > 0;
+    }
 }
 const MARKER_ANYWHERE = /\u00abredacted(?::[a-z-]{1,16}){0,2}\u00bb/g;
 function markerSpans(text) {
@@ -357,18 +469,123 @@ function markerSpans(text) {
         spans.push(hit.index, hit.index + hit[0].length);
     return spans;
 }
-function schemelessUserinfoEdits(text, unitAt = NO_UNITS) {
-    const edits = [];
+const USERNAME_DELIMITERS = new Set(['"', "'", '`', '(', ')', '[', ']', '{', '}', '<', '>', '|', '\\', '^', ',', ';', '=']);
+const PASSWORD_FORBIDDEN = new Set(['"', '`', '<', '>']);
+const forbiddenCloser = (ch) => (ch === '<' ? '>' : ch === '"' || ch === '`' ? ch : '');
+const isBareUserChar = (c) => (c >= 0x30 && c <= 0x39) || (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a) ||
+    c === 0x2e || c === 0x5f || c === 0x2d || c === 0x7e || c === 0x25 || c === 0x2b;
+function userinfoCandidates(S, out, words = true) {
+    const text = S.text;
+    const unitAt = (k) => S.unitAt(k);
     const markers = markerSpans(text);
-    let m = 0;
+    const markerStartAt = new Map();
+    const markerStartByEnd = markers.length === 0 ? null : new Map();
+    const markerEndAt = markers.length === 0 ? null : new Int32Array(text.length).fill(-1);
+    for (let m = 0; m + 1 < markers.length; m += 2) {
+        const a = markers[m] ?? 0;
+        const b = markers[m + 1] ?? 0;
+        markerStartAt.set(a, b);
+        markerStartByEnd?.set(b, a);
+        if (markerEndAt !== null)
+            for (let k = a; k < b; k++)
+                markerEndAt[k] = b;
+    }
+    let markerFrom = 0;
+    const inMarker = (k) => (markerEndAt === null ? -1 : (markerEndAt[k] ?? -1));
+    let forbiddenNext = null;
+    const nextForbidden = (k) => {
+        if (forbiddenNext === null) {
+            const n = text.length;
+            const t = new Int32Array(n + 1).fill(n);
+            for (let x = n - 1; x >= 0; x--)
+                t[x] = PASSWORD_FORBIDDEN.has(text.charAt(x)) ? x : (t[x + 1] ?? n);
+            forbiddenNext = t;
+        }
+        return forbiddenNext[k] ?? text.length;
+    };
+    let forbiddenPrev = null;
+    const prevForbidden = (k) => {
+        if (forbiddenPrev === null) {
+            const n = text.length;
+            const t = new Int32Array(n + 1).fill(-1);
+            for (let x = 1; x <= n; x++)
+                t[x] = PASSWORD_FORBIDDEN.has(text.charAt(x - 1)) ? x - 1 : (t[x - 1] ?? -1);
+            forbiddenPrev = t;
+        }
+        return forbiddenPrev[k] ?? -1;
+    };
+    let bareStopNext = null;
+    const nextBareStop = (k) => {
+        if (bareStopNext === null) {
+            const n = text.length;
+            const t = new Int32Array(n + 1).fill(n);
+            for (let x = n - 1; x >= 0; x--)
+                t[x] = isBareValueStop(text.charAt(x)) ? x : (t[x + 1] ?? n);
+            bareStopNext = t;
+        }
+        return bareStopNext[k] ?? text.length;
+    };
+    const labelValueReaches = (from, at) => {
+        let i = from;
+        while (i < at && text.charCodeAt(i) === 0x5c)
+            i++;
+        const q = text[i];
+        if (q === '"' || q === "'") {
+            if (i > from) {
+                const close = text.indexOf('\\' + q, i + 1);
+                return close === -1 || close >= at;
+            }
+            for (let j = i + 1; j < at; j++) {
+                if (text[j] === '\\') {
+                    j++;
+                    continue;
+                }
+                if (text[j] === q)
+                    return false;
+            }
+            return true;
+        }
+        return nextBareStop(from) >= at;
+    };
     let floor = 0;
-    for (let at = text.indexOf('@'), prevAt = -1; at !== -1; prevAt = at, at = text.indexOf('@', at + 1)) {
+    for (let at = text.indexOf('@'); at !== -1; at = text.indexOf('@', at + 1)) {
         let hostEnd = schemelessHostEnd(text, at + 1);
         const hidden = hostEnd === -1;
         if (hidden)
             hostEnd = hiddenHostEnd(text, at + 1, unitAt);
         if (hostEnd === -1)
             continue;
+        let shaped = null;
+        const hostShaped = () => {
+            if (shaped === null) {
+                const c = text.charCodeAt(hostEnd);
+                shaped = !(c === 0x3c || c === 0x3e || c === 0x7c || c === 0x5c || c === 0x5e || c === 0x7b || c === 0x7d);
+                if (!shaped)
+                    for (let k = at + 1; k < hostEnd && !shaped; k++) {
+                        const h = text.charCodeAt(k);
+                        if (h === 0x2e || h === 0x3a || h === 0x5b)
+                            shaped = true;
+                    }
+            }
+            return shaped;
+        };
+        const keptDespiteForbidden = (userStart, colon) => {
+            if (labelEndsBefore(text, userStart, floor, '\'"`'))
+                return 'label';
+            if (hidden || userStart >= colon)
+                return null;
+            if (labelEndsAt(text, colon + 1) || schemeWordEndsAt(text, colon + 1))
+                return words && labelValueReaches(colon + 1, at) ? null : 'label';
+            for (let k = userStart; k < colon; k++)
+                if (!isBareUserChar(text.charCodeAt(k)))
+                    return null;
+            const q = prevForbidden(at);
+            const closer = forbiddenCloser(text.charAt(q));
+            if (closer !== '' && q < at - 1 && text.charCodeAt(q - 1) !== 0x5c && text.charAt(hostEnd) === closer)
+                return null;
+            return hostShaped() ? 'bare' : null;
+        };
+        const refused = [];
         let runStart = at;
         while (runStart > floor && (!breaksUserinfo(text.charCodeAt(runStart - 1)) || (hidden && unitAt(runStart - 1) !== UNIT_NONE)))
             runStart--;
@@ -377,67 +594,135 @@ function schemelessUserinfoEdits(text, unitAt = NO_UNITS) {
                 runStart--;
         }
         let found = -1;
-        let colon = -1;
-        let s = runStart;
-        while (s + 2 < at) {
-            if (colon < s) {
-                colon = s;
-                while (colon < at && text.charCodeAt(colon) !== 0x3a)
-                    colon++;
+        let lo = runStart;
+        let keyClose = -2;
+        let wholeMarkerAt = -1;
+        for (let mk = markerFrom; mk + 1 < markers.length && (markers[mk] ?? 0) < at; mk += 2) {
+            const a = markers[mk] ?? 0;
+            const b = markers[mk + 1] ?? 0;
+            markerFrom = mk;
+            if (a < runStart)
+                continue;
+            let p = b;
+            while (p < at && (text[p] === VIEW_SEPARATOR || text[p] === '.'))
+                p++;
+            if ((p >= at || !isKeyWordChar(text.charCodeAt(p))) && labelWashedBefore(text, a, runStart))
+                wholeMarkerAt = a;
+        }
+        let markerTail = at;
+        for (;;) {
+            while (markerTail > runStart && (text[markerTail - 1] === VIEW_SEPARATOR || text[markerTail - 1] === '.' || text[markerTail - 1] === ' '))
+                markerTail--;
+            const ms = markerTail > runStart ? (markerStartByEnd?.get(markerTail) ?? -1) : -1;
+            if (ms === -1 || ms < runStart)
+                break;
+            markerTail = ms;
+        }
+        let sFrom = runStart;
+        for (let colon = runStart; colon < at && found === -1; colon++) {
+            const me = inMarker(colon);
+            if (me !== -1) {
+                colon = me - 1;
+                continue;
+            }
+            const ch = text.charAt(colon);
+            if (ch === '[') {
+                let k = colon + 1;
+                while (k < at && isIpv6Char(text.charCodeAt(k)))
+                    k++;
+                if (k < at && text.charCodeAt(k) === 0x5d && k > colon + 1) {
+                    colon = k;
+                    lo = k + 1;
+                    continue;
+                }
+            }
+            if (USERNAME_DELIMITERS.has(ch)) {
+                lo = colon + 1;
+                continue;
             }
+            if (text.charCodeAt(colon) !== 0x3a)
+                continue;
             if (colon + 1 >= at)
                 break;
-            if (colon === s) {
-                s++;
+            const leftOfColon = colon > 0 ? text.charAt(colon - 1) : '';
+            if ((leftOfColon === "'" || leftOfColon === '"' || leftOfColon === '`') && colon > 1 && isKeyWordChar(text.charCodeAt(colon - 2))) {
+                lo = colon + 1;
+                keyClose = colon;
                 continue;
             }
-            while (m < markers.length && (markers[m + 1] ?? 0) <= colon)
-                m += 2;
-            if (m < markers.length && (markers[m] ?? 0) <= colon) {
-                s = colon + 1;
+            const forbidden = nextForbidden(colon + 1) < at;
+            if (!forbidden && text[colon + 1] === "'" && text[hostEnd] === "'") {
+                lo = colon + 1;
                 continue;
             }
-            const prev = s === 0 ? -1 : text.charCodeAt(s - 1);
-            const midPair = prev >= 0xd800 && prev <= 0xdbff && (text.charCodeAt(s) & 0xfc00) === 0xdc00;
-            if ((prev === -1 || !blocksUserinfoStart(prev)) && !midPair) {
-                found = s;
-                break;
+            if (wholeMarkerAt > colon && colon + 1 < markerTail) {
+                lo = colon + 1;
+                continue;
+            }
+            if (wholeMarkerAt === colon + 1 && markerTail === colon + 1 && text.startsWith(REDACTED_USERINFO, colon + 1)) {
+                lo = colon + 1;
+                continue;
+            }
+            let userStart = -1;
+            if (lo === colon)
+                userStart = colon;
+            else {
+                for (let s = Math.max(lo, sFrom); s < colon; s++) {
+                    if (markerStartAt.has(s)) {
+                        userStart = s;
+                        break;
+                    }
+                    const prev = s === 0 ? -1 : text.charCodeAt(s - 1);
+                    const midPair = prev >= 0xd800 && prev <= 0xdbff && (text.charCodeAt(s) & 0xfc00) === 0xdc00;
+                    if ((prev === -1 || !blocksUserinfoStart(prev) || s === keyClose + 1) && !midPair) {
+                        userStart = s;
+                        break;
+                    }
+                    const inner = inMarker(s);
+                    if (inner !== -1)
+                        s = inner - 1;
+                }
+                if (userStart === -1)
+                    sFrom = colon;
+            }
+            const kept = userStart === -1 || !forbidden ? null : keptDespiteForbidden(userStart, colon);
+            if (userStart === -1 || (forbidden && kept === null)) {
+                if (forbidden) {
+                    lo = colon + 1;
+                    if (userStart !== -1)
+                        refused.push(colon, userStart);
+                }
+                continue;
+            }
+            found = userStart;
+            if (kept === 'bare') {
+                for (let r = 0; r + 1 < refused.length; r += 2) {
+                    if (nextForbidden((refused[r] ?? 0) + 1) >= userStart) {
+                        found = refused[r + 1] ?? userStart;
+                        break;
+                    }
+                }
             }
-            s++;
         }
         if (found === -1)
             continue;
-        if (hidden && credentialWordAttached(text, prevAt + 1, found, at, unitAt))
-            continue;
-        pushEdit(edits, text, found, at, REDACTED_USERINFO);
+        out.push({ a: found, b: at, kind: 'userinfo', cls: hidden ? 'userinfo-hidden' : 'structural', te: hostEnd });
         floor = hostEnd;
     }
-    return edits;
 }
-function credentialWordAttached(text, lo, found, at, unitAt) {
-    if (credentialWordEndsFrom(text.slice(lo, at), found - lo))
-        return true;
-    const kept = [];
-    let joinedFound = -1;
-    for (let k = lo; k < at; k++) {
-        if (k === found)
-            joinedFound = kept.length;
-        if (unitAt(k) === UNIT_NONE)
-            kept.push(text.charAt(k));
-    }
-    return joinedFound !== -1 && credentialWordEndsFrom(kept.join(''), joinedFound);
-}
-function credentialWordEndsFrom(seg, from) {
-    for (const word of [SECRET_LABELLED_WORD, SECRET_SCHEME_WORD]) {
-        const re = new RegExp(word.source, 'gi');
-        for (let hit = re.exec(seg); hit !== null; hit = re.exec(seg)) {
-            if (hit.index + hit[0].length >= from)
-                return true;
-            if (hit[0].length === 0)
-                re.lastIndex++;
-        }
-    }
-    return false;
+function labelWashedBefore(text, a, floor) {
+    return labelEndsBefore(text, a, floor, "'");
+}
+function labelEndsBefore(text, a, floor, quotes) {
+    let e = a;
+    while (e > floor && text[e - 1] === VIEW_SEPARATOR)
+        e--;
+    if (e > floor && quotes.includes(text[e - 1] ?? '\u0000'))
+        e--;
+    const w = text.slice(Math.max(floor, e - 96), e);
+    if (w === '')
+        return false;
+    return new RegExp(`(?:${SECRET_LABELLED_WORD.source})$`, 'i').test(w) || new RegExp(`(?:${SECRET_SCHEME_WORD.source})$`, 'i').test(w);
 }
 function unitRunEnd(text, from, unitAt) {
     let k = from;
@@ -459,16 +744,6 @@ function hiddenHostEnd(text, from, unitAt) {
     const c = text.charCodeAt(k);
     return endsSchemelessHost(c) || c === 0x40 ? k : -1;
 }
-const MAX_URL_WASH_PASSES = 4;
-function washUrlNets(target) {
-    for (let pass = 0; pass < MAX_URL_WASH_PASSES; pass++) {
-        target.apply(urlTokenEdits(target.text));
-        const handedOff = schemelessUserinfoEdits(target.text, (k) => target.unitAt(k));
-        target.apply(handedOff);
-        if (handedOff.length === 0)
-            return;
-    }
-}
 const NAME_BLANK_RANGES = [
     [0x00a0, 0x00a0],
     [0x1680, 0x1680],
@@ -484,7 +759,8 @@ const NAME_BLANK_RANGES = [
 const isNameBlank = (cp) => NAME_BLANK_RANGES.some(([a, b]) => cp >= a && cp <= b);
 const isFoldedBlank = (c) => isNameBlank(c) && isRegexSpace(c);
 const isUnicodeBlank = (c) => (c > 0x7f && isRegexSpace(c) && c !== 0xfeff) || isNameBlank(c);
-const SECRET_SCHEME_WORD = /(?:\b|(?<=\\[A-Za-z"']))(bearer|basic)[\s:=\uFF1A\uFF1D\u115F\u1160\u3164\uFFA0\u2800]+/gi;
+const SECRET_SCHEME_WORD = /(?:\b|(?<=\\[A-Za-z"']))(bearer|basic|token)[\s:=\uFF1A\uFF1D\u115F\u1160\u3164\uFFA0\u2800]+/gi;
+const schemeWordIsInner = (word, tokenInner) => tokenInner || word.toLowerCase() !== 'token';
 const SECRET_LABELLED_WORD = /(?:\b|(?<=_)|(?<=\\[A-Za-z"']))((?:access[-_ ]?|refresh[-_ ]?|id[-_ ]?|client[-_ ]?|api[-_ ]?|x[-_]api[-_ ]?|session[-_ ]?|auth[-_ ]?)?(?:token|key|secret|password|authorization|credential)s?)(?:\\*["'])?[\s\u115F\u1160\u3164\uFFA0\u2800]*[:=\uFF1A\uFF1D][\s\u115F\u1160\u3164\uFFA0\u2800]*/gi;
 const DIAGNOSTIC_VALUE_WORDS = new Set([
     'missing', 'required', 'invalid', 'expired', 'unauthorized', 'unauthenticated', 'authentication',
@@ -502,6 +778,37 @@ const SCHEME_FOLLOWER_WORDS = new Set([
     'setup', 'plan', 'tier', 'info', 'information', 'support', 'level', 'string', 'config', 'configuration', 'settings',
     'version', 'check', 'validation', 'error', 'errors', 'failed', 'failure', 'credentials', 'user', 'username',
 ]);
+const TOKEN_FOLLOWER_WORDS = new Set([
+    ...SCHEME_FOLLOWER_WORDS,
+    'count', 'counts', 'counting', 'counter', 'counters', 'limit', 'limits', 'budget', 'budgets', 'window', 'windows', 'estimate', 'estimates',
+    'estimation', 'estimator', 'length', 'size', 'cost', 'costs', 'price', 'pricing', 'rate', 'rates', 'quota', 'quotas', 'cap', 'caps', 'ceiling',
+    'threshold', 'total', 'totals', 'accounting', 'allocation', 'consumption', 'overflow', 'savings', 'reduction', 'spend', 'metrics', 'stats',
+    'boundary', 'boundaries', 'stream', 'streaming', 'position', 'positions', 'index', 'offset', 'probability', 'probabilities', 'logprob',
+    'logprobs', 'sequence', 'encoding', 'tokenizer', 'vocabulary', 'id', 'ids', 'maximum', 'minimum', 'max', 'min', 'ratio', 'table', 'line',
+    'lines', 'unit', 'units', 'indices',
+    'refresh', 'refreshed', 'refreshes', 'refreshing', 'exchange', 'exchanged', 'endpoint', 'endpoints', 'request', 'requests', 'response',
+    'responses', 'store', 'stored', 'storage', 'cache', 'cached', 'caching', 'file', 'files', 'path', 'dir', 'directory', 'source', 'provider',
+    'providers', 'supplier', 'helper', 'command', 'env', 'environment', 'variable', 'lifetime', 'ttl', 'expiry', 'expiration', 'expires', 'expiring',
+    'rotation', 'rotated', 'revocation', 'revoke', 'introspection', 'verification', 'verified', 'generation', 'generated', 'issuer', 'issued',
+    'audience', 'claims', 'scope', 'scopes', 'permission', 'permissions', 'owner', 'name', 'label', 'hash', 'signature', 'payload', 'body',
+    'cookie', 'kind', 'types', 'data', 'metadata', 'envelope', 'binding', 'bound', 'renewal', 'minted', 'acquired', 'fetch', 'fetched', 'parsing',
+    'parse', 'parsed', 'persisted', 'url', 'urls', 'client', 'argument', 'flag', 'option', 'field', 'governance', 'target',
+    'has', 'have', 'had', 'will', 'would', 'could', 'may', 'might', 'does', 'did', 'do', 'doesn', 'isn', 'wasn', 'hasn', 'didn', 'won', 'couldn',
+    'wouldn', 'shouldn', 'aren', 'weren', 'haven', 'been', 'being', 'needs', 'need', 'appears', 'seems', 'looks', 'lives', 'stays', 'remains',
+    'starts', 'stopped', 'closed', 'arrived', 'surfaced', 'vanished', 'belongs', 'carries', 'contains', 'lacks', 'matches', 'match', 'changed',
+    'created', 'deleted', 'removed', 'updated', 'exceeded', 'exceeds', 'exhausted', 'reached', 'returned', 'returns', 'received', 'provided',
+    'supplied', 'found', 'used', 'using', 'saved', 'loaded', 'accepted', 'validated', 'passed', 'sent', 'fails', 'works', 'already', 'still',
+    'also', 'only', 'never', 'now', 'here', 'there', 'then', 'than', 'so', 'but', 'as', 'if', 'when', 'while', 'until', 'before', 'after',
+    'since', 'because', 'via', 'into', 'over', 'under', 'within', 'without', 'per', 'each', 'every', 'any', 'all', 'its', 'which', 'whose',
+    'please', 'run', 'try', 'retry', 'see', 'use', 'visit', 'reauthenticate', 'reconnect',
+]);
+function schemeFollowerReleased(scheme, value, afterPathSlash) {
+    const word = value.replace(/[.,;:!?)]+$/, '').toLowerCase();
+    const isToken = scheme.toLowerCase() === 'token';
+    if (isToken && afterPathSlash && /^\d{3}$/.test(word))
+        return true;
+    return (isToken ? TOKEN_FOLLOWER_WORDS : SCHEME_FOLLOWER_WORDS).has(word);
+}
 const AUTH_SCHEME_WORDS = new Set([
     'bearer', 'basic', 'digest', 'token', 'bot', 'ssws', 'api-key', 'apikey', 'key', 'hmac', 'oauth', 'oauth2', 'jwt',
     'negotiate', 'ntlm', 'hawk', 'mac', 'dsn', 'splunk', 'sapisidhash', 'googlelogin', 'aws', 'client-id', 'pat',
@@ -511,9 +818,11 @@ const BARE_VALUE_STOP_CHARS = new Set([',', ';', '"', "'", '\\', '(', ')', '[',
 const isBareValueStop = (ch) => ch <= ' ' || BARE_VALUE_STOP_CHARS.has(ch);
 class InnerWordIndex {
     text;
+    tokenInner;
     probes;
-    constructor(text) {
+    constructor(text, tokenInner = true) {
         this.text = text;
+        this.tokenInner = tokenInner;
         this.probes = [
             { re: new RegExp(SECRET_LABELLED_WORD.source, SECRET_LABELLED_WORD.flags), scheme: false, from: -1, hit: null },
             { re: new RegExp(SECRET_SCHEME_WORD.source, SECRET_SCHEME_WORD.flags), scheme: true, from: -1, hit: null },
@@ -525,7 +834,11 @@ class InnerWordIndex {
             const reusable = p.from !== -1 && q >= p.from && (p.hit === null || q <= p.hit.start);
             if (!reusable) {
                 p.re.lastIndex = q;
-                const m = p.re.exec(this.text);
+                let m = p.re.exec(this.text);
+                while (m !== null && p.scheme && !schemeWordIsInner(m[1] ?? '', this.tokenInner)) {
+                    p.re.lastIndex = m.index + 1;
+                    m = p.re.exec(this.text);
+                }
                 p.from = q;
                 if (m === null)
                     p.hit = null;
@@ -610,7 +923,7 @@ function scanSecretValue(text, from, idx) {
             let p = j;
             while (p < text.length && text[p] === VIEW_SEPARATOR)
                 p++;
-            if (credentialWordStartsNear(text, p))
+            if (credentialWordStartsNear(text, p, idx?.tokenInner ?? true))
                 break;
             j = p;
             continue;
@@ -660,6 +973,22 @@ function isTokenCountLabel(text, at, label) {
     const lastSep = Math.max(head.lastIndexOf('_'), head.lastIndexOf('-'));
     return TOKEN_COUNT_HEAD_WORDS.has(head.slice(lastSep + 1));
 }
+function isParserDiagnosticToken(text, at, label) {
+    if (label.toLowerCase() !== 'token' || at < 1)
+        return false;
+    if (text.charAt(at - 1) !== ' ')
+        return false;
+    const head = 'unexpected';
+    const start = at - 1 - head.length;
+    if (start < 0 || text.slice(start, at - 1).toLowerCase() !== head)
+        return false;
+    if (start === 0)
+        return true;
+    const before = text.charAt(start - 1);
+    if (!/[A-Za-z0-9_]/.test(before))
+        return true;
+    return start >= 2 && text.charAt(start - 2) === '\\' && /[A-Za-z"']/.test(before);
+}
 const BACKTICKED_CREDENTIAL_NAME = /^\x60[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+\x60[.,;:!?)]*$/;
 const CREDENTIAL_NAME_SEGMENTS = new Set([
     'KEY', 'KEYS', 'TOKEN', 'TOKENS', 'SECRET', 'SECRETS', 'PASSWORD', 'PASSWD', 'PWD', 'CREDENTIAL', 'CREDENTIALS',
@@ -686,29 +1015,58 @@ function labelStartsAt(text, at) {
     re.lastIndex = at;
     return re.test(text);
 }
-function credentialWordStartsAt(text, at) {
+function credentialWordStartsAt(text, at, tokenInner = true) {
     if (at >= text.length)
         return false;
-    if (credentialWordStartsExactlyAt(text, at))
+    if (credentialWordStartsExactlyAt(text, at, tokenInner))
         return true;
     let k = at;
     while (k < text.length && text.charCodeAt(k) === 0x5c)
         k++;
     if (text[k] === '"' || text[k] === "'")
         k++;
-    return k > at && credentialWordStartsExactlyAt(text, k);
+    return k > at && credentialWordStartsExactlyAt(text, k, tokenInner);
 }
-function credentialWordStartsExactlyAt(text, at) {
+function credentialWordStartsExactlyAt(text, at, tokenInner = true) {
     if (at >= text.length)
         return false;
     if (labelStartsAt(text, at))
         return true;
     const re = new RegExp(SECRET_SCHEME_WORD.source, 'iy');
     re.lastIndex = at;
-    return re.test(text);
-}
-function credentialWordStartsNear(text, at) {
-    return credentialWordStartsAt(text, at) || credentialWordStartsAt(text, at + 1);
+    const m = re.exec(text);
+    return m !== null && schemeWordIsInner(m[1] ?? '', tokenInner);
+}
+function credentialWordStartsNear(text, at, tokenInner = true) {
+    return credentialWordStartsAt(text, at, tokenInner) || credentialWordStartsAt(text, at + 1, tokenInner);
+}
+function innerWordMatchAt(text, at, tokenInner) {
+    const lab = new RegExp(SECRET_LABELLED_WORD.source, 'iy');
+    lab.lastIndex = at;
+    const m = lab.exec(text);
+    if (m !== null)
+        return m;
+    const sch = new RegExp(SECRET_SCHEME_WORD.source, 'iy');
+    sch.lastIndex = at;
+    const s = sch.exec(text);
+    return s !== null && schemeWordIsInner(s[1] ?? '', tokenInner) ? s : null;
+}
+function nextPairBeyondFragmentAt(text, at) {
+    for (const p of [at, at + 1]) {
+        let k = p;
+        while (k < text.length && text.charCodeAt(k) === 0x5c)
+            k++;
+        if (text[k] === '"' || text[k] === "'")
+            k++;
+        for (const src of [SECRET_LABELLED_WORD, SECRET_SCHEME_WORD]) {
+            const re = new RegExp(src.source, 'iy');
+            re.lastIndex = k;
+            const m = re.exec(text);
+            if (m !== null && endsUrlFragmentAt(m[0], m[0].length - 1))
+                return true;
+        }
+    }
+    return false;
 }
 function percentDecodeForMatching(text) {
     const chars = [];
@@ -773,7 +1131,7 @@ function hostTokenIsLabel(afterUserinfo, hostEnd) {
     }
     return false;
 }
-function exemptAddressEdits(src, from, to, edits) {
+function exemptAddressEdits(src, from, to, edits, rawPart = (a, b) => src.slice(a, b)) {
     const value = src.slice(from, to);
     const q = value.search(/[?#]/);
     const prefix = q === -1 ? value : value.slice(0, q);
@@ -790,11 +1148,48 @@ function exemptAddressEdits(src, from, to, edits) {
     const pathStart = scheme.length + (at === -1 ? cut : at + 1 + (cut - userinfoLen));
     const pathEnd = q === -1 ? value.length : q;
     const pathCut = pathCutAfterFirstLabel(value.slice(pathStart, pathEnd));
-    if (pathCut !== -1)
+    if (pathCut !== -1 && !onlyQuotesAndMarkers(rawPart(from + pathStart + pathCut, from + pathEnd)))
         pushEdit(edits, src, from + pathStart + pathCut, from + pathEnd, REDACTED_SECRET);
     if (q !== -1)
         pushEdit(edits, src, from + q + 1, to, value.charAt(q) === '#' ? REDACTED_FRAGMENT : REDACTED_QUERY);
 }
+function addressJunkStart(text, from, to) {
+    let authEnd = from;
+    while (authEnd < to && text[authEnd] !== '/' && text[authEnd] !== '?' && text[authEnd] !== '#')
+        authEnd++;
+    const at = text.lastIndexOf('@', authEnd - 1);
+    if (at < from)
+        return -1;
+    let k = at + 1;
+    if (text[k] === '[') {
+        const close = text.indexOf(']', k);
+        if (close === -1 || close >= to)
+            return -1;
+        k = close + 1;
+    }
+    else {
+        while (k < to) {
+            const c = text.charCodeAt(k);
+            if (!(isHostChar(c) || (c >= 0xa1 && c !== 0xab && c !== 0xbb && !isRegexSpace(c))))
+                break;
+            k++;
+        }
+    }
+    if (text.charCodeAt(k) === 0x3a) {
+        let d = k + 1;
+        while (d < to && text.charCodeAt(d) >= 0x30 && text.charCodeAt(d) <= 0x39)
+            d++;
+        if (d > k + 1)
+            k = d;
+    }
+    if (k >= to || text[k] === '/' || text[k] === '?' || text[k] === '#')
+        return -1;
+    return k;
+}
+function onlyQuotesAndMarkers(part) {
+    const core = part.replace(new RegExp(MARKER_ANYWHERE.source, 'g'), '').split(RETIRED_MARKER).join('');
+    return /^["'\\]*$/.test(core);
+}
 function isAddressShaped(value, raw = value) {
     return value.startsWith(`${REDACTED_USERINFO}@`) || ADDRESS_SCHEME_RE.test(raw);
 }
@@ -866,13 +1261,15 @@ function addressExtentEnd(text, from) {
     }
     return end;
 }
-function trailingLabelStart(text, from, end) {
+function trailingLabelStart(text, from, end, tokenInner = true) {
     const window = text.slice(from, Math.min(text.length, end + 12));
     const segLen = end - from;
     let best = -1;
     for (const src of [SECRET_SCHEME_WORD, SECRET_LABELLED_WORD]) {
         const re = new RegExp(src.source, src.flags);
         for (let hit = re.exec(window); hit !== null && hit.index < segLen; hit = re.exec(window)) {
+            if (src === SECRET_SCHEME_WORD && !schemeWordIsInner(hit[1] ?? '', tokenInner))
+                continue;
             if (hit.index + hit[0].length >= segLen && (best === -1 || hit.index < best))
                 best = hit.index;
         }
@@ -881,37 +1278,476 @@ function trailingLabelStart(text, from, end) {
 }
 const withoutSeparators = (s) => (s.includes(VIEW_SEPARATOR) ? s.split(VIEW_SEPARATOR).join('') : s);
 const isHorizontalSpace = (ch) => ch === ' ' || ch === '\t' || ch === '\u00a0' || ch === VIEW_SEPARATOR;
-function labelEdits(text, re, literalBlanks = false, unitAt = NO_UNITS) {
-    const edits = [];
-    const schemePass = re === SECRET_SCHEME_WORD;
-    const idx = new InnerWordIndex(text);
+function rawUserinfoAddressAt(text, at, end, gapAfter, stops) {
+    const k = Math.min(end, stops.user[at] ?? text.length);
+    if (k === at || text[k] !== ':')
+        return false;
+    const p = Math.min(end, stops.password[k + 1] ?? text.length);
+    if (p <= k + 1 || text[p] !== '@')
+        return false;
+    if (gapAfter(p))
+        return false;
+    return schemelessHostEnd(text, p + 1) !== -1;
+}
+function userinfoStops(text) {
+    const n = text.length;
+    const user = new Int32Array(n + 1).fill(n);
+    const password = new Int32Array(n + 1).fill(n);
+    const brk = new Int32Array(n + 1).fill(n);
+    for (let k = n - 1; k >= 0; k--) {
+        const c = text.charCodeAt(k);
+        const br = breaksUserinfo(c);
+        user[k] = br || c === 0x3a || USERNAME_DELIMITERS.has(text.charAt(k)) ? k : (user[k + 1] ?? n);
+        brk[k] = br && text[k] !== VIEW_SEPARATOR ? k : (brk[k + 1] ?? n);
+        password[k] = (br && text[k] !== VIEW_SEPARATOR) || PASSWORD_FORBIDDEN.has(text.charAt(k)) ? k : (password[k + 1] ?? n);
+    }
+    return { user, password, brk };
+}
+function forbiddenUserinfoAt(text, at, end, gapAfter, stops, unitAt) {
+    const k = Math.min(end, stops.user[at] ?? text.length);
+    if (k >= end || text[k] !== ':')
+        return -1;
+    for (let u = at; u < k; u++)
+        if (unitAt(u) !== UNIT_NONE || text[u] === VIEW_SEPARATOR)
+            return -1;
+    const p = Math.min(end, stops.password[k + 1] ?? text.length);
+    if (p >= end || !PASSWORD_FORBIDDEN.has(text.charAt(p)))
+        return -1;
+    const a = Math.min(end, stops.brk[k + 1] ?? text.length);
+    if (a >= end || text[a] !== '@' || gapAfter(a))
+        return -1;
+    return schemelessHostEnd(text, a + 1) === -1 ? -1 : a;
+}
+function isTokenCountAt(text, at) {
+    const re = new RegExp(SECRET_LABELLED_WORD.source, 'iy');
+    re.lastIndex = at;
+    const m = re.exec(text);
+    return m !== null && isTokenCountLabel(text, at, m[1] ?? '');
+}
+function innerWordHasValue(text, at, idx) {
+    const m = innerWordMatchAt(text, at, idx.tokenInner);
+    return m !== null && scanSecretValue(text, at + m[0].length, idx) !== null;
+}
+function quoteSwallowedBefore(S, at) {
+    let k = at - 1;
+    while (k >= 0 && S.dropped(k))
+        k--;
+    const lo = k >= 0 ? S.rawEnd(k) : 0;
+    const hi = at < S.text.length ? S.rawStart(at) : S.raw.length;
+    if (hi <= lo)
+        return '';
+    const gap = S.raw.slice(lo, hi);
+    const dq = gap.indexOf('"');
+    const sq = gap.indexOf("'");
+    if (dq === -1 && sq === -1)
+        return '';
+    return dq === -1 ? "'" : sq === -1 ? '"' : dq < sq ? '"' : "'";
+}
+function labelEndsAt(text, end, atLeast = false) {
+    let k = end;
+    while (k > 0 && isRegexSpace(text.charCodeAt(k - 1)))
+        k--;
+    if (k === 0)
+        return false;
+    const sep = text.charAt(k - 1);
+    if (sep !== ':' && sep !== '=' && sep !== '\uFF1A' && sep !== '\uFF1D')
+        return false;
+    k--;
+    while (k > 0 && isRegexSpace(text.charCodeAt(k - 1)))
+        k--;
+    if (k > 0 && (text[k - 1] === '"' || text[k - 1] === "'"))
+        k--;
+    while (k > 0 && text.charCodeAt(k - 1) === 0x5c)
+        k--;
+    let w = k;
+    while (w > 0 && isIdentOrDash(text.charAt(w - 1)))
+        w--;
+    const re = new RegExp(SECRET_LABELLED_WORD.source, 'iy');
+    for (let s = w; s < k; s++) {
+        re.lastIndex = s;
+        const m = re.exec(text);
+        if (m !== null && (atLeast ? s + m[0].length >= end : s + m[0].length === end) && !isTokenCountLabel(text, s, m[1] ?? ''))
+            return true;
+    }
+    return false;
+}
+function schemeWordEndsAt(text, end) {
+    const sep = text.charAt(end - 1);
+    if (sep !== ':' && sep !== '=' && sep !== '\uFF1A' && sep !== '\uFF1D')
+        return false;
+    let w = end - 1;
+    while (w > 0 && isIdentOrDash(text.charAt(w - 1)))
+        w--;
+    const re = new RegExp(SECRET_SCHEME_WORD.source, 'iy');
+    for (let s = w; s < end - 1; s++) {
+        re.lastIndex = s;
+        const m = re.exec(text);
+        if (m !== null && s + m[0].length === end)
+            return true;
+    }
+    return false;
+}
+function quotedExtensionEnd(text, close, cache) {
+    const escaped = text.charCodeAt(close) === 0x5c;
+    const q = escaped ? text.charAt(close + 1) : text.charAt(close);
+    if (q !== '"' && q !== "'")
+        return close;
+    const token = escaped ? `\\${q}` : q;
+    const after = (at) => at + token.length;
+    let memo = cache.get(token);
+    if (memo === undefined) {
+        memo = new Map();
+        cache.set(token, memo);
+    }
+    const done = memo;
+    const step = (cur) => {
+        let n = after(cur);
+        while (n < text.length && (text[n] === ' ' || text[n] === '\t'))
+            n++;
+        const sepNext = text[n] === ':' || text[n] === '=' || text[n] === '\uFF1A' || text[n] === '\uFF1D';
+        if (sepNext && labelEndsAt(text, n + 1, true) && !labelEndsAt(text, cur)) {
+            const next = text.indexOf(token, after(cur));
+            return next === -1 ? { kind: 'open', inner: false } : { kind: 'next', at: next };
+        }
+        if (labelEndsAt(text, cur)) {
+            const innerClose = text.indexOf(token, after(cur));
+            if (innerClose === -1)
+                return { kind: 'open', inner: true };
+            const next = text.indexOf(token, after(innerClose));
+            return next === -1 ? { kind: 'open', inner: true } : { kind: 'next', at: next };
+        }
+        return { kind: 'end' };
+    };
+    const first = step(close);
+    if (first.kind === 'end')
+        return close;
+    if (first.kind === 'open')
+        return first.inner ? close : text.length;
+    const path = [];
+    let cur = first.at;
+    let result;
+    for (;;) {
+        const hit = done.get(cur);
+        if (hit !== undefined) {
+            result = hit;
+            break;
+        }
+        path.push(cur);
+        const s = step(cur);
+        if (s.kind === 'end') {
+            result = cur;
+            break;
+        }
+        if (s.kind === 'open') {
+            result = text.length;
+            break;
+        }
+        cur = s.at;
+    }
+    for (const p of path)
+        done.set(p, result);
+    return result;
+}
+function extensionMaskStart(text, close) {
+    let n = close + (text.charCodeAt(close) === 0x5c ? 2 : 1);
+    while (n < text.length && (text[n] === ' ' || text[n] === '\t'))
+        n++;
+    const sep = text[n];
+    if (sep !== ':' && sep !== '=' && sep !== '\uFF1A' && sep !== '\uFF1D')
+        return close;
+    if (!labelEndsAt(text, n + 1, true) || labelEndsAt(text, close))
+        return close;
+    n++;
+    while (n < text.length && (text[n] === ' ' || text[n] === '\t'))
+        n++;
+    return n;
+}
+function quotedAddressEnd(S, from, to) {
+    const text = S.text;
+    for (let k = from; k < to; k++) {
+        const c = text.charCodeAt(k);
+        if ((isRegexSpace(c) && c !== 0xfeff) || S.unitAt(k) !== UNIT_NONE)
+            return k;
+        if (k > from && S.spaceGapBefore(k))
+            return k;
+    }
+    return to;
+}
+function labelCandidates(S, pass, regions, out) {
+    const text = S.text;
+    const unitAt = (k) => S.unitAt(k);
+    const re = pass === 'label' ? SECRET_LABELLED_WORD : SECRET_SCHEME_WORD;
+    const schemePass = pass !== 'label';
+    const tokenPass = pass === 'token';
+    const idx = new InnerWordIndex(text, tokenPass);
+    const extensionCache = new Map();
+    let stops;
+    const push = (start, end, kindText, te = -1, cls) => {
+        let a = start;
+        let b = end;
+        while (a < b && text[a] === VIEW_SEPARATOR)
+            a++;
+        while (b > a && text[b - 1] === VIEW_SEPARATOR)
+            b--;
+        if (a >= b)
+            return;
+        if (text.slice(a, b) === kindText)
+            return;
+        const kind = KIND_BY_TEXT.get(kindText);
+        if (kind === undefined)
+            return;
+        out.push({ a, b, kind, cls: cls ?? (kindText === REDACTED_SECRET ? 'word' : 'structural'), te });
+    };
+    const pushEdits = (edits, te) => {
+        for (const e of edits) {
+            const part = text.slice(e.start, e.end);
+            if (e.text === REDACTED_USERINFO ? userinfoIsWholeMarker(part) : e.text !== REDACTED_SECRET && slotIsWholeMarker(part))
+                continue;
+            push(e.start, e.end, e.text, e.text === REDACTED_SECRET ? -1 : te);
+        }
+    };
+    let markerCache = -2;
+    const nextMarkerFrom = (p) => {
+        if (markerCache === -1 || markerCache >= p)
+            return markerCache;
+        markerCache = text.indexOf(REDACTION_MARKER_PREFIX, p);
+        return markerCache;
+    };
+    const maskGaps = (r0, end) => {
+        let p = r0;
+        while (p < end) {
+            while (p < end && (isRegexSpace(text.charCodeAt(p)) || unitAt(p) !== UNIT_NONE))
+                p++;
+            if (p >= end)
+                return;
+            let inner = idx.next(p);
+            while (inner !== null && inner.start < end && isTokenCountAt(text, inner.start))
+                inner = idx.next(inner.start + 1);
+            const hasInner = inner !== null && inner.start < end;
+            let stop = hasInner && inner !== null ? inner.start : end;
+            const head = withoutSeparators(text.slice(p, Math.min(stop, p + 80)));
+            const addressEnd = ADDRESS_SCHEME_RE.test(head) || head.startsWith(`${REDACTED_USERINFO}@`) ? Math.min(stop, quotedAddressEnd(S, p, end)) : -1;
+            if (addressEnd !== -1 && addressEnd < stop) {
+                p = addressEnd;
+                continue;
+            }
+            if (addressEnd === -1) {
+                let marker = null;
+                for (let at = nextMarkerFrom(p); at !== -1 && at < stop && marker === null; at = nextMarkerFrom(at + 1)) {
+                    const mk = new RegExp(MARKER_ANYWHERE.source, 'y');
+                    mk.lastIndex = at;
+                    marker = mk.exec(text);
+                }
+                const markerHit = marker !== null && marker.index < stop;
+                if (markerHit && marker !== null)
+                    stop = marker.index;
+                let cut = stop;
+                while (cut > p && (isCutDelimiter(text.charAt(cut - 1)) || isRegexSpace(text.charCodeAt(cut - 1))))
+                    cut--;
+                if (cut > p) {
+                    const rest = withoutSeparators(text.slice(p, cut));
+                    if (rest.trim() !== '' && !valueIsWholeMarker(S, p, cut, idx.tokenInner) && !isDiagnosticValue(rest))
+                        push(p, cut, REDACTED_SECRET);
+                }
+                if (markerHit && marker !== null) {
+                    p = marker.index + marker[0].length;
+                    continue;
+                }
+            }
+            if (!hasInner || inner === null)
+                return;
+            const m = innerWordMatchAt(text, inner.start, idx.tokenInner);
+            if (m === null)
+                return;
+            const after = inner.start + m[0].length;
+            const iv = scanSecretValue(text, after, idx);
+            let next = iv === null ? after : iv.end;
+            if (next < end && (text[next] === '"' || text[next] === "'"))
+                next++;
+            if (next <= p)
+                return;
+            p = next;
+        }
+    };
+    const pushInnerRemainder = (from) => {
+        let open = from;
+        while (text.charCodeAt(open) === 0x5c)
+            open++;
+        let q = text.charAt(open);
+        let at = open + 1;
+        let outerEnd;
+        if (q === '"' || q === "'") {
+            const outer = scanSecretValue(text, from);
+            if (outer === null)
+                return;
+            outerEnd = outer.end;
+        }
+        else {
+            q = quoteSwallowedBefore(S, from);
+            if (q === '')
+                return;
+            at = from;
+            const close = text.indexOf(q, from);
+            outerEnd = close === -1 ? text.length : close;
+        }
+        const m = innerWordMatchAt(text, at, idx.tokenInner);
+        if (m === null)
+            return;
+        const inner = { start: at };
+        const iv = scanSecretValue(text, inner.start + m[0].length, idx);
+        if (iv === null)
+            return;
+        let r0 = iv.end;
+        if (r0 < text.length && (text[r0] === '"' || text[r0] === "'") && text[r0] !== q)
+            r0++;
+        maskGaps(r0, outerEnd);
+    };
+    const regionKind = regions.length === 0 ? null : new Uint8Array(text.length);
+    if (regionKind !== null)
+        for (const r of regions)
+            for (let k = r[0]; k < r[1] && k < text.length; k++)
+                regionKind[k] = r[2] === 'query' ? 1 : 2;
+    const inQuery = (k) => regionKind !== null && k < text.length && regionKind[k] === 1;
+    const forbiddenTailAt = (p) => {
+        if (!PASSWORD_FORBIDDEN.has(text.charAt(p)))
+            return -1;
+        const st = (stops ??= userinfoStops(text));
+        const a = st.brk[p] ?? text.length;
+        if (a >= text.length || text[a] !== '@' || S.gapAfter(a))
+            return -1;
+        const inner = idx.next(p);
+        if (inner !== null && inner.start < a)
+            return -1;
+        const hostEnd = schemelessHostEnd(text, a + 1);
+        if (hostEnd === -1)
+            return -1;
+        let q = -1;
+        for (let k = a - 1; k >= p && q === -1; k--)
+            if (PASSWORD_FORBIDDEN.has(text.charAt(k)))
+                q = k;
+        const closer = forbiddenCloser(text.charAt(q));
+        if (closer !== '' && q < a - 1 && text.charCodeAt(q - 1) !== 0x5c && text.charAt(hostEnd) === closer)
+            return -1;
+        return a;
+    };
     re.lastIndex = 0;
     for (let hit = re.exec(text); hit !== null; hit = re.exec(text)) {
         const label = hit[1] ?? '';
+        if (schemePass && (label.toLowerCase() === 'token') !== tokenPass)
+            continue;
         if (isTokenCountLabel(text, hit.index, label))
             continue;
+        if (schemePass && isParserDiagnosticToken(text, hit.index, label))
+            continue;
+        if (schemePass && labelStartsAt(text, hit.index))
+            continue;
         const from = hit.index + hit[0].length;
-        if (credentialWordStartsAt(text, from)) {
+        if (credentialWordStartsAt(text, from, idx.tokenInner)) {
+            pushInnerRemainder(from);
             re.lastIndex = from;
             continue;
         }
-        const v = scanSecretValue(text, from, idx);
-        if (v === null)
-            continue;
-        if (text.startsWith('-----BEGIN ', v.start)) {
-            re.lastIndex = v.end;
+        let v0s = scanSecretValue(text, from, idx);
+        if (v0s === null) {
+            let k = from;
+            while (k < text.length && text[k] === VIEW_SEPARATOR)
+                k++;
+            const a = inQuery(k) ? -1 : forbiddenTailAt(k);
+            if (a === -1)
+                continue;
+            v0s = { start: k, end: a };
+        }
+        const v0 = { start: v0s.start, end: v0s.end };
+        let open = from;
+        while (text.charCodeAt(open) === 0x5c)
+            open++;
+        let quoted = text[open] === '"' || text[open] === "'";
+        if (!quoted) {
+            const q = quoteSwallowedBefore(S, v0.start);
+            if (q !== '') {
+                quoted = true;
+                let j = v0.start;
+                while (j < text.length && text[j] !== q)
+                    j += text[j] === '\\' ? 2 : 1;
+                v0.end = Math.min(j, text.length);
+            }
+        }
+        let keptSepEnd = -1;
+        if (quoted) {
+            let close = v0.end;
+            while (close < text.length && text[close] === VIEW_SEPARATOR)
+                close++;
+            const ext = close < text.length ? quotedExtensionEnd(text, close, extensionCache) : close;
+            if (ext > close) {
+                const from = extensionMaskStart(text, close);
+                if (from > close)
+                    keptSepEnd = from;
+                push(from, ext, REDACTED_SECRET);
+            }
+        }
+        const v = { start: v0.start, end: v0.end };
+        if (quoted) {
+            while (v.start < v.end && unitAt(v.start) !== UNIT_NONE)
+                v.start++;
+            while (v.end > v.start && unitAt(v.end - 1) !== UNIT_NONE)
+                v.end--;
+            if (v.start >= v.end) {
+                re.lastIndex = from;
+                continue;
+            }
+        }
+        if (valueIsWholeMarker(S, v.start, v.end, idx.tokenInner)) {
+            re.lastIndex = quoted ? from : v.end;
             continue;
         }
-        if (literalBlanks) {
-            if (literalBlankLeadJudgedAsBlank(text, v, label, schemePass)) {
-                re.lastIndex = v.end;
+        if (!quoted && inQuery(v.start)) {
+            for (let k = v.start; k < v.end; k++) {
+                const ch = text[k];
+                if (ch === '&' || ch === '#') {
+                    v.end = k;
+                    break;
+                }
+            }
+            if (v.end <= v.start) {
+                re.lastIndex = v0.end;
                 continue;
             }
         }
+        let forbiddenAt = -1;
+        if (!quoted && !inQuery(v.start)) {
+            forbiddenAt = forbiddenUserinfoAt(text, v.start, text.length, (k) => S.gapAfter(k), stops ??= userinfoStops(text), unitAt);
+            if (forbiddenAt !== -1)
+                v.end = Math.max(v.end, addressExtentEnd(text, forbiddenAt));
+        }
+        else if (quoted) {
+            forbiddenAt = forbiddenUserinfoAt(text, v.start, v.end, (k) => S.gapAfter(k), stops ??= userinfoStops(text), unitAt);
+        }
+        if (!quoted && forbiddenAt === -1 && !inQuery(v.start)) {
+            const a = forbiddenTailAt(v.end);
+            if (a !== -1)
+                v.end = a;
+        }
+        if (!quoted) {
+            const trailing = trailingLabelStart(text, v.start, v.end, idx.tokenInner);
+            if (trailing > 0 && innerWordHasValue(text, v.start + trailing, idx)) {
+                let e = v.start + trailing;
+                while (e > v.start && (isCutDelimiter(text.charAt(e - 1)) || text[e - 1] === VIEW_SEPARATOR))
+                    e--;
+                if (e > v.start)
+                    v.end = e;
+            }
+        }
+        if (pemBeginAt(S, v.start)) {
+            re.lastIndex = v.end;
+            continue;
+        }
         const rawValue = text.slice(v.start, v.end);
         const value = withoutSeparators(rawValue);
-        const quoted = v.start > 0 && (text[v.start - 1] === '"' || text[v.start - 1] === "'");
-        if (schemePass && !quoted && SCHEME_FOLLOWER_WORDS.has(value.replace(/[.,;:!?)]+$/, '').toLowerCase())) {
+        if (MARKER_WITH_DOTS.test(value)) {
+            re.lastIndex = quoted ? from : v.end;
+            continue;
+        }
+        if (schemePass && !quoted && schemeFollowerReleased(label, value, text.charCodeAt(hit.index - 1) === 0x2f)) {
             re.lastIndex = v.end;
             continue;
         }
@@ -927,75 +1763,69 @@ function labelEdits(text, re, literalBlanks = false, unitAt = NO_UNITS) {
                 re.lastIndex = v.end;
                 continue;
             }
-            const cred = j > v.end && !labelStartsAt(text, j) ? scanSecretValue(text, j, idx) : null;
+            let cred = j > v.end && !labelStartsAt(text, j) ? scanSecretValue(text, j, idx) : null;
+            if (j > v.end && !inQuery(j)) {
+                const a = forbiddenTailAt(cred === null ? j : cred.end);
+                if (a !== -1)
+                    cred = { start: cred === null ? j : cred.start, end: a };
+            }
             if (cred !== null) {
                 const credValue = withoutSeparators(text.slice(cred.start, cred.end));
                 const keep = isMarker(credValue) || DIAGNOSTIC_VALUE_WORDS.has(credValue.replace(/[.,;:!?)\]}\x27\x22]+$/, '').toLowerCase());
                 if (!keep)
-                    pushEdit(edits, text, cred.start, cred.end, REDACTED_SECRET);
+                    push(cred.start, cred.end, REDACTED_SECRET);
                 re.lastIndex = cred.end;
                 continue;
             }
             re.lastIndex = v.end;
             continue;
         }
-        if (isDiagnosticValue(value, rawValue)) {
-            if (isAddressShaped(value, rawValue)) {
-                let end = quoted ? v.end : addressExtentEnd(text, v.start);
-                const trailing = trailingLabelStart(text, v.start, end);
+        const forbiddenAddress = forbiddenAt !== -1 && text[v.start] !== ':';
+        const rawAddress = forbiddenAddress || rawUserinfoAddressAt(text, v.start, quoted ? v.end : text.length, (k) => S.gapAfter(k), stops ??= userinfoStops(text));
+        if (isDiagnosticValue(value, rawValue) || rawAddress) {
+            if (isAddressShaped(value, rawValue) || rawAddress) {
+                const extentFrom = forbiddenAddress ? forbiddenAt : v.start;
+                let end = quoted ? quotedAddressEnd(S, extentFrom, v.end) : addressExtentEnd(text, extentFrom);
+                const trailing = trailingLabelStart(text, v.start, end, idx.tokenInner);
                 if (trailing !== -1)
                     end = v.start + trailing;
                 if (gluedToSingleUnit(v.start, hit.index, unitAt) || userinfoHostHidden(text, v.start, unitAt)) {
                     const cut = trailing !== -1 ? end : Math.max(end, v.end);
-                    const keep = ADDRESS_SCHEME_RE.exec(text.slice(v.start, v.start + 20))?.[0].length ?? 0;
+                    const schemeHit = ADDRESS_SCHEME_RE.exec(text.slice(v.start, v.start + 20))?.[0] ?? '';
+                    const keep = schemeHit !== '' && schemeHit.length - 3 <= 12 ? schemeHit.length : 0;
                     const q = text.slice(v.start, cut).search(/[?#]/);
                     const bodyEnd = q === -1 ? cut : v.start + q;
                     if (withoutSeparators(text.slice(v.start + keep, bodyEnd)) !== '')
-                        pushEdit(edits, text, v.start + keep, bodyEnd, REDACTED_SECRET);
+                        push(v.start + keep, bodyEnd, REDACTED_SECRET, -1, 'glued');
                     if (q !== -1 && v.start + q + 1 < cut)
-                        pushEdit(edits, text, v.start + q + 1, cut, text.charAt(v.start + q) === '#' ? REDACTED_FRAGMENT : REDACTED_QUERY);
-                    re.lastIndex = cut;
+                        push(v.start + q + 1, cut, text.charAt(v.start + q) === '#' ? REDACTED_FRAGMENT : REDACTED_QUERY, cut, 'glued');
+                    re.lastIndex = quoted ? from : cut;
                     continue;
                 }
-                exemptAddressEdits(text, v.start, end, edits);
-                re.lastIndex = end;
+                const edits = [];
+                exemptAddressEdits(text, v.start, end, edits, (a, b) => (b > a ? S.raw.slice(S.rawStart(a), S.rawEnd(b - 1)) : ''));
+                pushEdits(edits, end);
+                if (rawAddress) {
+                    const limit = quoted ? end : Math.min(end, v.end);
+                    const junk = addressJunkStart(text, v.start, limit);
+                    if (junk !== -1) {
+                        const rest = withoutSeparators(text.slice(junk, limit)).replace(new RegExp(MARKER_ANYWHERE.source, 'g'), '');
+                        if (/[A-Za-z0-9]/.test(rest))
+                            push(junk, limit, REDACTED_SECRET);
+                    }
+                }
+                if (quoted && end < v.end) {
+                    maskGaps(end, v.end);
+                }
+                re.lastIndex = quoted ? from : end;
                 continue;
             }
         }
         else {
-            pushEdit(edits, text, v.start, v.end, REDACTED_SECRET);
+            push(v.start, keptSepEnd !== -1 && withoutSeparators(text.slice(v.end, keptSepEnd)).search(/[^"'\\:=\uFF1A\uFF1D \t]/) === -1 ? keptSepEnd : v.end, REDACTED_SECRET);
         }
-        re.lastIndex = v.end;
+        re.lastIndex = quoted ? from : v.end;
     }
-    return edits;
-}
-function literalBlankLeadJudgedAsBlank(text, v, label, schemePass) {
-    let restStart;
-    if (v.start > 0 && text.charCodeAt(v.start - 1) === 0x5c && nameBlankTokenAt(text, v.start - 1) !== -1)
-        restStart = v.start + 5;
-    else if (nameBlankTokenAt(text, v.start) !== -1)
-        restStart = v.start + 6;
-    else if (eatenBlankTokenTailAt(text, v.start))
-        restStart = v.start + 5;
-    else
-        return false;
-    const rest = withoutSeparators(text.slice(restStart, v.end));
-    const bare = rest.replace(/[.,;:!?)\]}'"]+$/, '');
-    if (bare === '')
-        return true;
-    if (credentialWordStartsAt(' ' + text.slice(restStart, Math.min(text.length, v.end + 64)), 1))
-        return true;
-    if (schemePass && SCHEME_FOLLOWER_WORDS.has(bare.toLowerCase()))
-        return true;
-    if (!schemePass && isNamedNotValue(label, rest))
-        return true;
-    if (!schemePass && /authorizations?$/i.test(label) && isAuthScheme(bare))
-        return true;
-    return !isAddressShaped(rest) && isDiagnosticValue(rest);
-}
-function eatenBlankTokenTailAt(text, at) {
-    const hit = /^u([0-9A-Fa-f]{4})/.exec(text.slice(at, at + 5));
-    return hit !== null && isNameBlank(Number.parseInt(hit[1] ?? '', 16));
 }
 function isAuthParamAt(text, j, scheme) {
     const p = /^[A-Za-z][A-Za-z0-9_-]*([ \t\ufeff]*)=([ \t\ufeff]*)("|[^\s=,"]+)([ \t\ufeff]*,)?/.exec(text.slice(j, j + 512));
@@ -1087,13 +1917,15 @@ function pemBodyEndWithoutTrailer(text, from) {
     }
     return end;
 }
-function pemEdits(text) {
-    const edits = [];
-    if (!text.includes('-----BEGIN '))
-        return edits;
+function pemBlocks(text, soft = () => false) {
+    const out = [];
+    if (!text.includes('-----BEGIN'))
+        return out;
+    const head = pemHeadView(text, soft);
     const begin = new RegExp(PEM_BEGIN_SOURCE, 'g');
+    const trailer = /-----END[A-Z0-9 ]*-----/y;
     let nextEnd = -2;
-    for (let b = begin.exec(text); b !== null; b = begin.exec(text)) {
+    for (let b = begin.exec(head); b !== null; b = begin.exec(head)) {
         let bodyStart = b.index + b[0].length;
         const lead = lineBreakLengthAt(text, bodyStart);
         if (lead > 0)
@@ -1104,18 +1936,56 @@ function pemEdits(text) {
         if (nextEnd !== -1 && nextEnd < bodyStart)
             nextEnd = text.indexOf(PEM_END_MARK, bodyStart);
         let bodyEnd;
-        if (nextEnd === -1)
+        let regionEnd;
+        if (nextEnd === -1) {
             bodyEnd = pemBodyEndWithoutTrailer(text, bodyStart);
+            regionEnd = bodyEnd + lineBreakLengthAt(text, bodyEnd);
+        }
         else {
             bodyEnd = nextEnd;
             const back = lineBreakLengthBefore(text, bodyEnd);
             if (back > 0 && bodyEnd - back >= bodyStart)
                 bodyEnd -= back;
+            trailer.lastIndex = nextEnd;
+            regionEnd = trailer.test(head) ? trailer.lastIndex : nextEnd + PEM_END_MARK.length;
         }
-        if (bodyEnd > bodyStart)
-            pushEdit(edits, text, bodyStart, bodyEnd, REDACTED_SECRET);
+        out.push({ begin: b.index, bodyStart, bodyEnd, regionEnd });
         begin.lastIndex = Math.max(begin.lastIndex, bodyEnd);
     }
+    return out;
+}
+function pemHeadView(text, soft) {
+    let chars = null;
+    for (let k = 0; k < text.length; k++) {
+        if (!soft(k) || text[k] === ' ')
+            continue;
+        chars ??= text.split('');
+        chars[k] = ' ';
+    }
+    return chars === null ? text : chars.join('');
+}
+function pemBeginAt(S, at) {
+    const k = at + '-----BEGIN'.length;
+    return S.text.startsWith('-----BEGIN', at) && (S.text[k] === ' ' || (k < S.text.length && pemSoft(S, k)));
+}
+const pemSoft = (S, k) => S.dropped(k) || S.painted(k);
+function pemBlockToRaw(S, blk) {
+    const n = S.text.length;
+    const at = (k) => (k < n ? S.rawStart(k) : S.raw.length);
+    const begin = at(blk.begin);
+    const bodyStart = at(blk.bodyStart);
+    const bodyEnd = blk.bodyEnd > blk.bodyStart ? Math.max(bodyStart, S.rawEnd(blk.bodyEnd - 1)) : bodyStart;
+    const regionEnd = blk.regionEnd > blk.begin ? Math.max(begin, S.rawEnd(blk.regionEnd - 1)) : begin;
+    return { begin, bodyStart, bodyEnd, regionEnd };
+}
+function pemEdits(S, onBlock) {
+    const text = S.text;
+    const edits = [];
+    for (const blk of pemBlocks(text, (k) => pemSoft(S, k))) {
+        onBlock(blk);
+        if (blk.bodyEnd > blk.bodyStart)
+            pushEdit(edits, text, blk.bodyStart, blk.bodyEnd, REDACTED_SECRET);
+    }
     return edits;
 }
 function authParamEdits(text) {
@@ -1188,21 +2058,6 @@ function proseLiteralEdits(text) {
     }
     return edits;
 }
-function washWordNets(target, literalBlanks = false) {
-    const unitAt = (k) => target.unitAt(k);
-    target.apply(pemEdits(target.text));
-    target.apply(labelEdits(target.text, SECRET_SCHEME_WORD, literalBlanks, unitAt));
-    target.apply(labelEdits(target.text, SECRET_LABELLED_WORD, literalBlanks, unitAt));
-    target.apply(authParamEdits(target.text));
-    target.apply(proseLiteralEdits(target.text));
-}
-function runCredentialNets(target, urls, words, literalBlanks = false) {
-    if (urls)
-        washUrlNets(target);
-    if (words)
-        washWordNets(target, literalBlanks);
-}
-const NEEDS_VIEW = /[\u0000-\u0008\u000E-\u001F\u007F-\u009F\uD800-\uDFFF]|\p{Cf}|\\u/u;
 const FORMAT_CHAR = /^\p{Cf}$/u;
 const isStrippableControl = (c) => (c <= 0x1f && (c < 0x09 || c > 0x0d)) || (c >= 0x7f && c <= 0x9f);
 class SequenceReader {
@@ -1215,10 +2070,12 @@ class SequenceReader {
     termHit = null;
     breakFrom = -1;
     breakAt = -1;
-    constructor(text, atomicBlanks, foldBlanks = false) {
+    foldSpaces;
+    constructor(text, atomicBlanks, foldBlanks = false, foldSpaces = false) {
         this.text = text;
         this.atomicBlanks = atomicBlanks;
         this.foldBlanks = foldBlanks;
+        this.foldSpaces = foldSpaces;
         this.terminator = /[\u0007\u009c]|\u001b\\|\\u(?:0007|009[cC]|001[bB]\\)/g;
         this.lineBreak = /[\n\r]/g;
     }
@@ -1236,6 +2093,8 @@ class SequenceReader {
         const c = this.text.charCodeAt(at);
         if (c >= 0x20 && c <= 0x2f)
             return 1;
+        if (this.foldSpaces && ((c >= 0x09 && c <= 0x0d) || c === 0x2028 || c === 0x2029))
+            return 1;
         if (!this.foldBlanks)
             return 0;
         if (isFoldedBlank(c))
@@ -1351,41 +2210,38 @@ function nameBlankTokenAt(text, at) {
     const cp = Number.parseInt(hit[1] ?? '', 16);
     return isNameBlank(cp) ? cp : -1;
 }
-function buildCredentialView(text, separated, wordLetters = false, blankTokens = 'off') {
-    const folding = blankTokens === 'fold' || blankTokens === 'foldlit';
-    if (!NEEDS_VIEW.test(text) && !(folding && hasRawFoldedBlank(text)))
-        return null;
+function buildScanView(text, o) {
     const chars = [];
     const starts = [];
     const ends = [];
     const units = [];
-    let changed = false;
-    let splitAny = false;
-    const seq = new SequenceReader(text, blankTokens === 'blank' || blankTokens === 'fold' ? 'all' : blankTokens === 'foldlit' ? 'folded' : 'none', folding);
+    const dropped = [];
+    const spaceUnits = [];
+    const contents = [];
+    const seq = new SequenceReader(text, o.blanks ? 'all' : 'none', o.blanks || o.fold, o.fold);
     const keep = (ch, s, e, unit = UNIT_NONE) => {
         chars.push(ch);
         starts.push(s);
         ends.push(e);
         units.push(unit);
+        dropped.push(0);
+        spaceUnits.push(0);
     };
-    const drop = (s, e, placeholder = VIEW_SEPARATOR, unit = UNIT_SINGLE) => {
-        changed = true;
-        if (separated)
-            keep(placeholder, s, e, unit);
+    const drop = (s, e, placeholder = VIEW_SEPARATOR, unit = UNIT_SINGLE, space = 0) => {
+        chars.push(placeholder);
+        starts.push(s);
+        ends.push(e);
+        units.push(unit);
+        dropped.push(1);
+        spaceUnits.push(space);
     };
     const dropUnit = (s, unit) => {
         const last = unit.end - 1;
-        if ((blankTokens === 'literal' || blankTokens === 'foldlit') && last > s && text.charCodeAt(last) === 0x5c && nameBlankTokenAt(text, last) !== -1) {
-            drop(s, last, VIEW_SEPARATOR, UNIT_SEQUENCE);
-            keep(text.charAt(last + 1), last, last + 6);
-            for (let u = 2; u < 6; u++)
-                keep(text.charAt(last + u), last + 6, last + 6);
-            return last + 6;
-        }
-        if (wordLetters && unit.content === undefined && last > s && (credentialWordBeginsWith(text, last) || finalIsStructural(text, last))) {
+        if (unit.content !== undefined)
+            contents.push([unit.content[0], unit.content[1]]);
+        if (unit.content === undefined && last > s && (credentialWordBeginsWith(text, last) || finalIsStructural(text, last))) {
             drop(s, last, VIEW_SEPARATOR, UNIT_SEQUENCE);
             keep(text.charAt(last), last, unit.end);
-            splitAny = true;
             return unit.end;
         }
         drop(s, unit.end, VIEW_SEPARATOR, UNIT_SEQUENCE);
@@ -1394,12 +2250,6 @@ function buildCredentialView(text, separated, wordLetters = false, blankTokens =
     let i = 0;
     while (i < text.length) {
         const c = text.charCodeAt(i);
-        if (folding && isFoldedBlank(c)) {
-            changed = true;
-            keep(' ', i, i + 1);
-            i++;
-            continue;
-        }
         if (c === 0x1b || c === 0x9b || c === 0x9d || c === 0x90 || c === 0x98 || c === 0x9e || c === 0x9f) {
             const unit = c === 0x1b ? escapeSequenceAfterEsc(text, i + 1, seq) : c1SequenceAfter(text, c, i + 1, seq);
             if (unit !== null) {
@@ -1422,30 +2272,33 @@ function buildCredentialView(text, separated, wordLetters = false, blankTokens =
                     i = dropUnit(i, unit);
                     continue;
                 }
-                drop(i, tok.end, ' ', isRegexSpace(tok.cp) && tok.cp !== 0xfeff ? UNIT_NONE : UNIT_SINGLE);
+                if (isRegexSpace(tok.cp) && tok.cp !== 0xfeff) {
+                    if (o.escapeSpaces !== null && o.escapeSpaces.has(tok.cp))
+                        drop(i, tok.end, VIEW_SEPARATOR, UNIT_SINGLE, 1);
+                    else
+                        drop(i, tok.end, ' ', UNIT_NONE);
+                }
+                else
+                    drop(i, tok.end);
                 i = tok.end;
                 continue;
             }
-            if (blankTokens !== 'off') {
-                const cp = nameBlankTokenAt(text, i);
-                if (cp !== -1) {
-                    changed = true;
-                    if (blankTokens === 'blank')
-                        keep(String.fromCharCode(cp), i, i + 6);
-                    else if (blankTokens === 'fold')
-                        keep(isFoldedBlank(cp) ? ' ' : String.fromCharCode(cp), i, i + 6);
-                    else if (blankTokens === 'foldlit' && isFoldedBlank(cp))
-                        keep(' ', i, i + 6);
-                    else {
-                        keep(text.charAt(i), i, i + 6);
-                        for (let u = 1; u < 6; u++)
-                            keep(text.charAt(i + u), i + 6, i + 6);
-                    }
-                    i += 6;
-                    continue;
-                }
+            if (nameBlankTokenAt(text, i) !== -1) {
+                drop(i, i + 6);
+                i += 6;
+                continue;
             }
         }
+        if (o.blanks && isNameBlank(c)) {
+            drop(i, i + 1);
+            i++;
+            continue;
+        }
+        if (o.escapeSpaces !== null && o.escapeSpaces.has(c)) {
+            drop(i, i + 1, VIEW_SEPARATOR, UNIT_SINGLE, 1);
+            i++;
+            continue;
+        }
         if (isStrippableControl(c)) {
             drop(i, i + 1);
             i++;
@@ -1467,9 +2320,195 @@ function buildCredentialView(text, separated, wordLetters = false, blankTokens =
         keep(text.charAt(i), i, i + 1);
         i++;
     }
-    if (!changed || (wordLetters && !splitAny))
+    const rawUnit = new Uint8Array(text.length);
+    for (let k = 0; k < chars.length; k++) {
+        if (dropped[k] !== 1)
+            continue;
+        for (let x = starts[k] ?? 0; x < (ends[k] ?? 0); x++)
+            rawUnit[x] = 1;
+    }
+    return {
+        view: chars.join(''),
+        starts: Int32Array.from(starts),
+        ends: Int32Array.from(ends),
+        units: Uint8Array.from(units),
+        dropped: Uint8Array.from(dropped),
+        spaceUnits: Uint8Array.from(spaceUnits),
+        contents,
+        rawUnit,
+    };
+}
+const viewRawStart = (V, M, k) => {
+    const s = V.starts[k] ?? 0;
+    return M === null ? s : (M.ps[s] ?? 0);
+};
+const viewRawEnd = (V, M, k) => {
+    const e = V.ends[k] ?? 0;
+    return M === null ? e : (M.pe[Math.max(0, e - 1)] ?? 0);
+};
+const viewPainted = (V, M, k) => {
+    if (M === null)
+        return false;
+    for (let x = V.starts[k] ?? 0; x < (V.ends[k] ?? 0); x++)
+        if (M.pdot[x] === 1)
+            return true;
+    return false;
+};
+function separatedSurface(raw, V, M = null) {
+    return {
+        text: V.view,
+        raw,
+        unitAt: (k) => V.units[k] ?? UNIT_NONE,
+        rawStart: (k) => viewRawStart(V, M, k),
+        rawEnd: (k) => viewRawEnd(V, M, k),
+        dropped: (k) => V.dropped[k] === 1,
+        painted: (k) => viewPainted(V, M, k),
+        gapAfter: (k) => V.dropped[k + 1] === 1,
+        spaceGapBefore: () => false,
+        rawDot: M === null ? null : M.rawDot,
+    };
+}
+function joinedSurface(raw, V, spacesKept = false, M = null) {
+    const map = [];
+    const chars = [];
+    const spaceBefore = [];
+    let pendingSpace = 0;
+    let keptAny = false;
+    for (let k = 0; k < V.view.length; k++) {
+        if (V.dropped[k] === 1) {
+            if (V.spaceUnits[k] === 1) {
+                if (spacesKept) {
+                    map.push(k);
+                    chars.push(' ');
+                    spaceBefore.push(0);
+                    keptAny = true;
+                    continue;
+                }
+                pendingSpace = 1;
+            }
+            continue;
+        }
+        map.push(k);
+        chars.push(V.view.charAt(k));
+        spaceBefore.push(pendingSpace);
+        pendingSpace = 0;
+    }
+    if (map.length === V.view.length || (spacesKept && !keptAny))
         return null;
-    return { view: chars.join(''), starts: Int32Array.from(starts), ends: Int32Array.from(ends), units: Uint8Array.from(units) };
+    const arr = Int32Array.from(map);
+    const gapSpace = Uint8Array.from(spaceBefore);
+    return {
+        text: chars.join(''),
+        raw,
+        unitAt: () => UNIT_NONE,
+        rawStart: (k) => viewRawStart(V, M, arr[k] ?? 0),
+        rawEnd: (k) => viewRawEnd(V, M, arr[k] ?? 0),
+        dropped: () => false,
+        painted: (k) => viewPainted(V, M, arr[k] ?? 0),
+        gapAfter: (k) => k + 1 < arr.length && arr[k + 1] !== (arr[k] ?? 0) + 1,
+        spaceGapBefore: (k) => gapSpace[k] === 1,
+        rawDot: M === null ? null : M.rawDot,
+    };
+}
+function screenSurfaces(text, o) {
+    const face = o.face;
+    if (face === null)
+        return { surfaces: [], rawSoft: null, rawPlain: null, contents: [] };
+    const unsafe = face.unsafe === null ? null : new RegExp(face.unsafe.source, 'u');
+    const keepBlanks = face.keepBlanks === true;
+    const chars = [];
+    const ps = [];
+    const pe = [];
+    const pdot = [];
+    const rawDot = new Uint8Array(text.length);
+    const rawPlain = new Uint8Array(text.length);
+    let changed = false;
+    const foldable = (at) => {
+        const c = text.codePointAt(at) ?? 0;
+        return isRegexSpace(c) && !(keepBlanks && isNameBlank(c));
+    };
+    let lo = 0;
+    let hi = text.length;
+    if (face.fold) {
+        while (lo < hi && foldable(lo))
+            lo++;
+        while (hi > lo && foldable(hi - 1))
+            hi--;
+        if (lo > 0 || hi < text.length)
+            changed = true;
+    }
+    for (let i = lo; i < hi;) {
+        const cp = text.codePointAt(i) ?? 0;
+        const w = cp > 0xffff ? 2 : 1;
+        const ch = text.slice(i, i + w);
+        let form = null;
+        let dotted = false;
+        if (face.fold && foldable(i)) {
+            let j = i + 1;
+            while (j < hi && foldable(j))
+                j++;
+            if (j - i > 1 || cp !== 0x20)
+                changed = true;
+            chars.push(' ');
+            ps.push(i);
+            pe.push(j);
+            pdot.push(cp === 0xfeff || j - i > 1 ? 1 : 0);
+            for (let x = i; x < j; x++)
+                if (text.charCodeAt(x) === 0xfeff)
+                    rawDot[x] = 1;
+            i = j;
+            continue;
+        }
+        else if (unsafe !== null && unsafe.test(ch) && !faceHitKept(ch, i, text)) {
+            form = markOf(ch, face.mark);
+            dotted = face.mark !== 'escape';
+        }
+        if (form === null || form === ch) {
+            for (let u = 0; u < w; u++) {
+                chars.push(text.charAt(i + u));
+                ps.push(i + u);
+                pe.push(i + u + 1);
+                pdot.push(0);
+                rawPlain[i + u] = 1;
+            }
+        }
+        else {
+            changed = true;
+            for (let u = 0; u < form.length; u++) {
+                chars.push(form.charAt(u));
+                ps.push(i);
+                pe.push(i + w);
+                pdot.push(dotted ? 1 : 0);
+            }
+            if (dotted)
+                for (let x = i; x < i + w; x++)
+                    rawDot[x] = 1;
+        }
+        i += w;
+    }
+    if (!changed)
+        return { surfaces: [], rawSoft: null, rawPlain: null, contents: [] };
+    const screen = chars.join('');
+    const M = { ps: Int32Array.from(ps), pe: Int32Array.from(pe), pdot: Uint8Array.from(pdot), rawDot };
+    const V = buildScanView(screen, o);
+    const rawSoft = Uint8Array.from(rawDot);
+    for (let k = 0; k < V.view.length; k++) {
+        if (V.dropped[k] !== 1)
+            continue;
+        for (let x = viewRawStart(V, M, k); x < viewRawEnd(V, M, k); x++) {
+            rawSoft[x] = 1;
+            rawPlain[x] = 0;
+        }
+    }
+    const out = [separatedSurface(text, V, M)];
+    const joined = joinedSurface(text, V, false, M);
+    if (joined !== null)
+        out.push(joined);
+    const joinedSpaced = o.escapeSpaces !== null ? joinedSurface(text, V, true, M) : null;
+    if (joinedSpaced !== null)
+        out.push(joinedSpaced);
+    const contents = V.contents.map(([a, b]) => ({ sub: screen.slice(a, b), rawAt: (k) => M.ps[a + k] ?? 0, rawEndAt: (k) => M.pe[a + k] ?? 0 }));
+    return { surfaces: out, rawSoft, rawPlain, contents };
 }
 function finalIsStructural(text, at) {
     if (text.charCodeAt(at) !== 0x5c)
@@ -1497,260 +2536,350 @@ function credentialWordBeginsWith(text, at) {
     let end = Math.min(text.length, at + 64);
     while (end < text.length && isProbeFiller(text.charCodeAt(end - 1)))
         end++;
-    const probe = ' ' + text.slice(at, Math.min(text.length, end + 2));
+    const probe = ' ' + text.slice(at, Math.min(text.length, end + 2)) + (end + 2 >= text.length ? ' ' : '');
     if (letter)
         return credentialWordStartsAt(probe, 1);
     return credentialWordStartsAt(probe, 2) || credentialWordStartsAt(probe, 3);
 }
-function rebuildFromView(original, view, target, trace = false) {
+function editsToCandidates(edits, cls, out, te = -1) {
+    for (const e of edits) {
+        const kind = KIND_BY_TEXT.get(e.text);
+        if (kind === undefined || e.end <= e.start)
+            continue;
+        out.push({ a: e.start, b: e.end, kind, cls, te });
+    }
+}
+function pemRegions(recognized) {
+    const seen = new Set();
     const out = [];
-    const origin = trace ? [] : null;
-    const fromOriginal = (a, b) => {
-        out.push(original.slice(a, b));
-        if (origin !== null)
-            for (let x = a; x < b; x++)
-                origin.push(x);
-    };
-    const inserted = (s) => {
-        out.push(s);
-        if (origin !== null)
-            for (let x = 0; x < s.length; x++)
-                origin.push(-1);
-    };
-    const viewLength = view.view.length;
-    let cursor = 0;
-    let k = 0;
-    const text = target.text;
-    while (k < text.length) {
-        const s = target.src[k] ?? 0;
-        if (s >= 0) {
-            const end = view.ends[s] ?? cursor;
-            if ((view.starts[s] ?? 0) >= cursor) {
-                fromOriginal(cursor, end);
-                cursor = end;
-            }
-            else
-                inserted(text.charAt(k));
-            k++;
+    for (const blk of recognized) {
+        if (blk.regionEnd <= blk.begin)
+            continue;
+        const key = `${blk.begin}:${blk.bodyStart}:${blk.bodyEnd}:${blk.regionEnd}`;
+        if (seen.has(key))
             continue;
+        seen.add(key);
+        out.push(blk);
+    }
+    return out;
+}
+function resolveCandidates(text, cands, rawUnit, rawDot, pems, rawSoft = rawDot, rawPlain = null) {
+    const items = [];
+    for (const c of cands) {
+        let a = c.start;
+        let b = c.end;
+        if (c.cls === 'pem') {
         }
-        let j = k + 1;
-        while (j < text.length && (target.src[j] ?? 0) < 0)
-            j++;
-        let a = target.rangeStart(k);
-        let b = target.rangeEnd(k);
-        for (let t = k + 1; t < j; t++) {
-            a = Math.min(a, target.rangeStart(t));
-            b = Math.max(b, target.rangeEnd(t));
-        }
-        const from = a < viewLength ? (view.starts[a] ?? original.length) : original.length;
-        const to = b > a ? (view.ends[b - 1] ?? from) : from;
-        if (from > cursor)
-            fromOriginal(cursor, from);
-        inserted(text.slice(k, j));
-        cursor = Math.max(cursor, to);
-        k = j;
+        else if (c.dotted === true) {
+            while (a < b && rawDot !== null && rawDot[a] === 1)
+                a++;
+            if (a >= b)
+                a = c.start;
+            else if (rawDot !== null && b < text.length && isKeyWordChar(text.charCodeAt(b))) {
+                while (b > a && rawDot[b - 1] === 1)
+                    b--;
+            }
+        }
+        else if (c.pretrimmed !== true) {
+            while (a < b && rawUnit[a] === 1)
+                a++;
+            while (b > a && rawUnit[b - 1] === 1)
+                b--;
+            if (rawPlain !== null && rawDot !== null) {
+                let k = a;
+                while (k > 0 && rawUnit[k - 1] === 1 && rawPlain[k - 1] === 1 && isKeyWordChar(text.charCodeAt(k - 1)))
+                    k--;
+                if (k < a && k > 0 && (rawDot[k - 1] === 1 || isRegexSpace(text.charCodeAt(k - 1))))
+                    a = k;
+            }
+        }
+        if (a >= b)
+            continue;
+        const body = text.slice(a, b);
+        if (isMarker(body) || MARKER_WITH_DOTS.test(body))
+            continue;
+        items.push({ start: a, end: b, kind: c.kind, cls: c.cls, tokenEnd: c.tokenEnd, origin: c.dotted === true ? c.start : a });
     }
-    fromOriginal(cursor, original.length);
-    const rebuilt = out.join('');
-    return origin === null ? { text: rebuilt } : { text: rebuilt, origin: Int32Array.from(origin) };
-}
-function washThroughView(original, view, urls, words, trace = false, literalBlanks = false) {
-    const target = new TrackedTarget(view.view, view.view.length, view.units);
-    runCredentialNets(target, urls, words, literalBlanks);
-    return target.text === view.view ? { text: original } : rebuildFromView(original, view, target, trace);
-}
-function washCredentialNetsOnce(text, urls, words, nested, blankTokens, trace) {
-    const contents = nested ? { text } : washControlStringContents(text, urls, words, blankTokens, trace);
-    if (blankTokens === 'off')
-        return washThroughViews(contents, urls, words, 'off', trace);
-    const tokens = hasNameBlankToken(contents.text);
-    const readings = [];
-    if (tokens)
-        readings.push('literal');
-    const rawFolded = blankTokens === 'fold' && hasRawFoldedBlank(contents.text);
-    if (blankTokens === 'fold' && (tokens || rawFolded))
-        readings.push('fold');
-    if (blankTokens === 'fold' && tokens && hasNameBlankToken(contents.text, false) && (rawFolded || hasNameBlankToken(contents.text, true)))
-        readings.push('foldlit');
-    readings.push('blank');
-    if (readings.length === 1)
-        return washThroughViews(contents, urls, words, 'blank', trace);
-    const base = { text: contents.text };
-    const union = unionMaskedRanges(base.text, readings.map((r) => washThroughViews(base, urls, words, r, true)));
-    return traced(union.text, composeOrigin(contents.origin, union.origin));
-}
-function unionMaskedRanges(text, results) {
-    const ranges = [];
-    for (const r of results) {
-        if (r.text === text || r.origin === undefined)
+    items.sort((x, y) => (x.start !== y.start ? x.start - y.start : y.end - x.end));
+    let maxTokenEnd = null;
+    for (const x of items) {
+        if (!isStructuralKind(x.kind) || x.cls !== 'url')
             continue;
-        const origin = r.origin;
-        let lastKept = -1;
-        let k = 0;
-        while (k < origin.length) {
-            if ((origin[k] ?? -1) >= 0) {
-                lastKept = origin[k] ?? lastKept;
-                k++;
+        if (maxTokenEnd === null)
+            maxTokenEnd = new Int32Array(text.length).fill(-1);
+        for (let k = x.start; k < x.end && k < text.length; k++)
+            if (x.tokenEnd > (maxTokenEnd[k] ?? -1))
+                maxTokenEnd[k] = x.tokenEnd;
+    }
+    const p2Drops = (x) => !isStructuralKind(x.kind) && x.cls !== 'pem' && x.cls !== 'glued' && maxTokenEnd !== null && x.end <= (maxTokenEnd[x.start] ?? -1);
+    let pemCover = null;
+    if (pems.length > 0) {
+        const reachBefore = new Int32Array(text.length + 1).fill(-1);
+        for (const x of items)
+            if (x.cls !== 'pem' && !p2Drops(x) && x.origin < text.length && x.end > (reachBefore[x.origin + 1] ?? -1))
+                reachBefore[x.origin + 1] = x.end;
+        for (let k = 1; k <= text.length; k++)
+            if ((reachBefore[k - 1] ?? -1) > (reachBefore[k] ?? -1))
+                reachBefore[k] = reachBefore[k - 1] ?? -1;
+        let pemMask = null;
+        for (const x of items) {
+            if (x.cls !== 'pem')
                 continue;
+            pemMask ??= new Uint8Array(text.length);
+            for (let k = x.start; k < x.end && k < text.length; k++)
+                pemMask[k] = 1;
+        }
+        for (const blk of pems) {
+            const a = blk.begin;
+            const b = blk.regionEnd;
+            if ((reachBefore[a] ?? -1) > a)
+                continue;
+            pemCover ??= new Uint8Array(text.length);
+            for (let k = a; k < b && k < text.length; k++) {
+                if (k >= blk.bodyStart && k < blk.bodyEnd && rawUnit[k] === 1 && pemMask?.[k] !== 1)
+                    continue;
+                pemCover[k] = 1;
             }
-            let j = k;
-            while (j < origin.length && (origin[j] ?? -1) < 0)
-                j++;
-            const next = j < origin.length ? (origin[j] ?? text.length) : text.length;
-            ranges.push({ start: lastKept + 1, end: next, text: r.text.slice(k, j) });
-            k = j;
         }
     }
-    if (ranges.length === 0)
-        return { text };
-    ranges.sort((a, b) => (a.start !== b.start ? a.start - b.start : b.end - a.end));
-    const merged = [];
-    for (const m of ranges) {
-        const last = merged[merged.length - 1];
-        if (last !== undefined && (m.start < last.end || (m.start === last.start && m.end === last.end))) {
-            if (m.end > last.end) {
-                if (m.end - m.start > last.end - last.start)
-                    last.text = m.text;
-                last.end = m.end;
-            }
+    const kept = items.filter((x) => {
+        if (x.cls !== 'pem' && pemCover !== null && pemCover[x.origin] === 1)
+            return false;
+        if (p2Drops(x))
+            return false;
+        return true;
+    });
+    const groups = [];
+    for (const it of kept) {
+        const g = groups[groups.length - 1];
+        if (g !== undefined && it.start < g.end) {
+            if (it.end > g.end)
+                g.end = it.end;
+            g.members.push(it);
             continue;
         }
-        if (last !== undefined && m.start === m.end && m.start > last.start && m.start < last.end)
+        groups.push({ start: it.start, end: it.end, members: [it] });
+    }
+    const out = [];
+    for (const g of groups) {
+        let structStart = Infinity;
+        let structEnd = -Infinity;
+        let firstStructKind = null;
+        let firstStructStart = Infinity;
+        let anySecret = false;
+        const secretLike = (m) => !isStructuralKind(m.kind) || m.cls === 'userinfo-hidden';
+        for (const m of g.members) {
+            if (!secretLike(m)) {
+                if (m.start < structStart)
+                    structStart = m.start;
+                if (m.end > structEnd)
+                    structEnd = m.end;
+                if (m.start < firstStructStart) {
+                    firstStructStart = m.start;
+                    firstStructKind = m.kind;
+                }
+            }
+            else
+                anySecret = true;
+        }
+        let secretWider = false;
+        if (anySecret)
+            for (const m of g.members)
+                if (secretLike(m) && (m.start < structStart || m.end > structEnd))
+                    secretWider = true;
+        const onlyHidden = g.members.every((m) => m.cls === 'userinfo-hidden');
+        const kind = onlyHidden ? 'userinfo' : firstStructKind === null || secretWider ? 'secret' : firstStructKind;
+        const value = g.members.some((m) => m.cls === 'word' || m.cls === 'glued' || m.cls === 'param' || (m.kind !== 'userinfo' && m.kind !== 'secret' && (m.cls === 'url' || m.cls === 'structural')));
+        out.push({ start: g.start, end: g.end, kind, value });
+    }
+    return continueValues(text, out, rawSoft ?? rawUnit);
+}
+function continueValues(text, drafts, rawSoft) {
+    const out = [];
+    const soft = (k) => rawSoft[k] === 1;
+    let i = 0;
+    while (i < drafts.length) {
+        const cur = drafts[i];
+        i++;
+        if (cur === undefined)
             continue;
-        merged.push({ ...m });
+        const d = { start: cur.start, end: cur.end, kind: cur.kind, value: cur.value };
+        for (;;) {
+            let k = d.end;
+            if (!d.value || k >= text.length || !soft(k))
+                break;
+            while (k < text.length && soft(k))
+                k++;
+            if (k >= text.length || !isKeyWordChar(text.charCodeAt(k)) || credentialWordStartsAt(text, k))
+                break;
+            let e = k;
+            while (e < text.length && (soft(e) || !isBareValueStop(text.charAt(e))))
+                e++;
+            d.end = e;
+            while (i < drafts.length && (drafts[i]?.start ?? Infinity) < d.end) {
+                const next = drafts[i];
+                i++;
+                if (next === undefined)
+                    continue;
+                if (next.end > d.end)
+                    d.end = next.end;
+                if (next.kind !== d.kind)
+                    d.kind = 'secret';
+            }
+        }
+        out.push(d);
     }
+    return out;
+}
+function materialize(text, intervals, trace) {
+    if (intervals.length === 0)
+        return { text };
     const parts = [];
-    const origin = [];
+    const origin = trace ? [] : null;
     let cursor = 0;
-    for (const m of merged) {
-        parts.push(text.slice(cursor, m.start), m.text);
-        for (let x = cursor; x < m.start; x++)
-            origin.push(x);
-        for (let x = 0; x < m.text.length; x++)
-            origin.push(-1);
-        cursor = m.end;
+    for (const iv of intervals) {
+        const token = TEXT_BY_KIND[iv.kind];
+        parts.push(text.slice(cursor, iv.start), token);
+        if (origin !== null) {
+            for (let x = cursor; x < iv.start; x++)
+                origin.push(x);
+            for (let x = 0; x < token.length; x++)
+                origin.push(-1);
+        }
+        cursor = iv.end;
     }
     parts.push(text.slice(cursor));
-    for (let x = cursor; x < text.length; x++)
-        origin.push(x);
-    return { text: parts.join(''), origin: Int32Array.from(origin) };
-}
-function hasRawFoldedBlank(text) {
-    for (let k = 0; k < text.length; k++)
-        if (isFoldedBlank(text.charCodeAt(k)))
-            return true;
-    return false;
+    if (origin !== null)
+        for (let x = cursor; x < text.length; x++)
+            origin.push(x);
+    return origin === null ? { text: parts.join('') } : { text: parts.join(''), origin: Int32Array.from(origin) };
 }
-function hasNameBlankToken(text, folded) {
-    if (!text.includes('\\u'))
-        return false;
-    for (const hit of text.matchAll(/\\u([0-9A-Fa-f]{4})/g)) {
-        const cp = Number.parseInt(hit[1] ?? '', 16);
-        if (isNameBlank(cp) && (folded === undefined || isFoldedBlank(cp) === folded))
-            return true;
+function toRaw(S, c) {
+    let a = c.a;
+    let b = c.b;
+    while (a < b && S.dropped(a))
+        a++;
+    while (b > a && S.dropped(b - 1))
+        b--;
+    if (a >= b)
+        return null;
+    const te = c.te > b ? S.rawEnd(c.te - 1) : S.rawEnd(b - 1);
+    return { start: S.rawStart(a), end: S.rawEnd(b - 1), kind: c.kind, cls: c.cls, tokenEnd: te };
+}
+function collectCandidates(text, o, nested) {
+    const V = buildScanView(text, o);
+    const separated = separatedSurface(text, V);
+    const surfaces = [separated];
+    const joined = joinedSurface(text, V);
+    if (joined !== null)
+        surfaces.push(joined);
+    const joinedSpaced = o.escapeSpaces !== null ? joinedSurface(text, V, true) : null;
+    if (joinedSpaced !== null)
+        surfaces.push(joinedSpaced);
+    const screen = screenSurfaces(text, o);
+    surfaces.push(...screen.surfaces);
+    const raw = [];
+    const regionSurface = screen.surfaces[0] ?? separated;
+    const pemBlocksSeen = [];
+    for (const S of surfaces) {
+        const cands = [];
+        const regions = [];
+        if (o.urls) {
+            const unitPos = (k) => S.dropped(k) || V.rawUnit[S.rawStart(k)] === 1;
+            urlCandidates(S.text, cands, regions, unitPos, (k) => unitPos(k) || S.painted(k));
+            userinfoCandidates(S, cands, o.words);
+        }
+        if (o.words) {
+            editsToCandidates(pemEdits(S, (blk) => { if (S === regionSurface)
+                pemBlocksSeen.push(pemBlockToRaw(S, blk)); }), 'pem', cands);
+            labelCandidates(S, 'scheme', regions, cands);
+            labelCandidates(S, 'token', regions, cands);
+            labelCandidates(S, 'label', regions, cands);
+            editsToCandidates(authParamEdits(S.text), 'param', cands);
+            editsToCandidates(proseLiteralEdits(S.text), 'prose', cands);
+        }
+        for (const c of cands) {
+            const r = toRaw(S, c);
+            if (r !== null)
+                raw.push(S.rawDot !== null ? { ...r, dotted: true } : r);
+        }
     }
-    return false;
-}
-function washThroughViews(input, urls, words, blankRead, trace) {
-    const start = input.text;
-    const literal = blankRead === 'literal' || blankRead === 'foldlit';
-    const lettered = buildCredentialView(start, true, true, blankRead);
-    const letteredWashed = lettered === null ? { text: start } : washThroughView(start, lettered, urls, words, trace, literal);
-    const pre = letteredWashed.text;
-    let origin = composeOrigin(input.origin, letteredWashed.origin);
-    const separated = buildCredentialView(pre, true, false, blankRead);
-    if (separated === null) {
-        const target = new PlainTarget(pre, trace);
-        runCredentialNets(target, urls, words, literal);
-        return traced(target.text, composeOrigin(origin, target.origin));
-    }
-    const afterSeparated = washThroughView(pre, separated, urls, words, trace, literal);
-    origin = composeOrigin(origin, afterSeparated.origin);
-    const joined = buildCredentialView(afterSeparated.text, false, false, blankRead);
-    if (joined === null)
-        return traced(afterSeparated.text, origin);
-    const afterJoined = washThroughView(afterSeparated.text, joined, urls, words, trace, literal);
-    return traced(afterJoined.text, composeOrigin(origin, afterJoined.origin));
-}
-function washControlStringContents(text, urls, words, blankTokens, trace) {
-    if (!/[\u001b\u0090\u0098\u009d-\u009f]|\\u/.test(text))
-        return { text };
-    const ends = new SequenceReader(text, 'none');
-    const parts = [];
-    const origin = trace ? [] : null;
-    const keptUpTo = (a, b) => {
-        if (origin !== null)
-            for (let x = a; x < b; x++)
-                origin.push(x);
-    };
-    let cursor = 0;
-    let i = 0;
-    while (i < text.length) {
-        const c = text.charCodeAt(i);
-        let unit = null;
-        let next = i + 1;
-        if (c === 0x1b)
-            unit = escapeSequenceAfterEsc(text, i + 1, ends);
-        else if (c >= 0x90 && c <= 0x9f)
-            unit = c1SequenceAfter(text, c, i + 1, ends);
-        else if (c === 0x5c && text.charCodeAt(i + 1) === 0x75) {
-            const tok = escapeTokenAt(text, i);
-            if (tok !== null) {
-                next = tok.end;
-                unit = tok.cp === 0x1b ? escapeSequenceAfterEsc(text, tok.end, ends) : tok.cp >= 0x90 && tok.cp <= 0x9f ? c1SequenceAfter(text, tok.cp, tok.end, ends) : null;
+    if (!nested) {
+        for (const [a, b] of V.contents) {
+            const sub = text.slice(a, b);
+            const inner = collectCandidates(sub, o, true);
+            for (const iv of resolveCandidates(sub, inner.cands, inner.rawUnit, inner.rawDot, o.words ? pemRegions(inner.pemBlocksSeen) : [], inner.rawSoft, inner.rawPlain)) {
+                raw.push({ start: a + iv.start, end: a + iv.end, kind: iv.kind, cls: 'nested', tokenEnd: a + iv.end, pretrimmed: true });
             }
         }
-        if (unit === null) {
-            i = next;
-            continue;
-        }
-        if (unit.content !== undefined) {
-            const [a, b] = unit.content;
-            const inner = text.slice(a, b);
-            const washed = washNets(inner, urls, words, true, blankTokens, trace);
-            if (washed.text !== inner) {
-                parts.push(text.slice(cursor, a), washed.text);
-                keptUpTo(cursor, a);
-                if (origin !== null) {
-                    const w = washed.origin;
-                    for (let x = 0; x < washed.text.length; x++) {
-                        const s = w === undefined ? x : (w[x] ?? -1);
-                        origin.push(s < 0 ? -1 : a + s);
-                    }
-                }
-                cursor = b;
+        for (const c of screen.contents) {
+            const inner = collectCandidates(c.sub, o, true);
+            for (const iv of resolveCandidates(c.sub, inner.cands, inner.rawUnit, inner.rawDot, o.words ? pemRegions(inner.pemBlocksSeen) : [], inner.rawSoft, inner.rawPlain)) {
+                const start = c.rawAt(iv.start);
+                const end = c.rawEndAt(iv.end - 1);
+                if (end > start)
+                    raw.push({ start, end, kind: iv.kind, cls: 'nested', tokenEnd: end, pretrimmed: true });
             }
         }
-        i = Math.max(unit.end, i + 1);
     }
-    if (cursor === 0)
-        return { text };
-    parts.push(text.slice(cursor));
-    keptUpTo(cursor, text.length);
-    const joined = parts.join('');
-    return origin === null ? { text: joined } : { text: joined, origin: Int32Array.from(origin) };
+    return { cands: raw, rawUnit: V.rawUnit, rawDot: screen.surfaces[0]?.rawDot ?? null, rawSoft: screen.rawSoft, rawPlain: screen.rawPlain, pemBlocksSeen };
 }
-const MAX_SETTLE_ROUNDS = 4;
-function washNets(text, urls, words, nested, blankTokens, trace) {
-    if (!urls && !words)
-        return { text };
-    let current = { text };
-    for (let round = 0; round < MAX_SETTLE_ROUNDS; round++) {
-        const next = washCredentialNetsOnce(current.text, urls, words, nested, blankTokens, trace);
-        if (next.text === current.text)
-            return current;
-        current = traced(next.text, composeOrigin(current.origin, next.origin));
+function scanOnce(text, o, trace) {
+    const { cands, rawUnit, rawDot, rawSoft, rawPlain, pemBlocksSeen } = collectCandidates(text, o, false);
+    const intervals = resolveCandidates(text, cands, rawUnit, rawDot, o.words ? pemRegions(pemBlocksSeen) : [], rawSoft, rawPlain);
+    return materialize(text, intervals, trace);
+}
+const MAX_WASH_REWRITES = 8;
+function composeOrigin(first, second) {
+    if (second === undefined)
+        return first;
+    if (first === undefined)
+        return second;
+    const out = new Int32Array(second.length);
+    for (let k = 0; k < second.length; k++) {
+        const s = second[k] ?? -1;
+        out[k] = s < 0 ? -1 : (first[s] ?? -1);
     }
-    return current;
+    return out;
 }
-function washCredentialNets(text, urls, words, nested = false, blankTokens = 'off') {
-    return washNets(text, urls, words, nested, blankTokens, false).text;
+function scanAndMask(text, o, trace, stats) {
+    if (!o.urls && !o.words) {
+        if (stats !== undefined) {
+            stats.passes = 0;
+            stats.capped = false;
+        }
+        return { text };
+    }
+    let cur = scanOnce(text, o, trace);
+    let passes = 1;
+    let rewrites = cur.text !== text ? 1 : 0;
+    let changed = rewrites > 0;
+    while (changed && rewrites < MAX_WASH_REWRITES) {
+        const next = scanOnce(cur.text, o, trace);
+        passes++;
+        changed = next.text !== cur.text;
+        if (!changed)
+            break;
+        rewrites++;
+        const origin = trace ? composeOrigin(cur.origin, next.origin) : undefined;
+        cur = origin === undefined ? { text: next.text } : { text: next.text, origin };
+    }
+    if (stats !== undefined) {
+        let capped = false;
+        if (changed) {
+            passes++;
+            capped = scanOnce(cur.text, o, false).text !== cur.text;
+        }
+        stats.passes = passes;
+        stats.capped = capped;
+    }
+    return cur;
 }
+const WASH_OPTIONS = Object.freeze({ urls: true, words: true, blanks: false, fold: false, face: null, escapeSpaces: null });
 export function washCredentials(text) {
     if (typeof text !== 'string')
         return text;
-    return washCredentialNets(text, true, true);
+    return scanAndMask(text, WASH_OPTIONS, false).text;
 }
 const C0_ALL = '\\u0000-\\u001F';
 const C0_KEEP_LAYOUT = '\\u0000-\\u0008\\u000B-\\u001F';
@@ -2089,42 +3218,64 @@ function capDisplay(text, max, mark) {
 }
 const MAX_CAP_SETTLE_ROUNDS = 4;
 function runDisplaySteps(start, steps) {
-    const settle = (s) => {
-        let current = steps.paint(steps.wash(s));
-        if (steps.text(current) === steps.text(s))
-            return current;
-        for (let round = 1; round < MAX_SETTLE_ROUNDS; round++) {
-            const next = steps.paint(steps.wash(current));
-            if (steps.text(next) === steps.text(current))
-                return current;
-            current = next;
-        }
-        return current;
-    };
-    const settled = settle(start);
+    const once = (s) => steps.paint(steps.wash(s));
+    const settled = once(start);
     let out = steps.cap(settled);
     if (steps.text(out) === steps.text(settled))
         return out;
     for (let round = 0; round < MAX_CAP_SETTLE_ROUNDS; round++) {
-        const again = steps.cap(settle(out));
+        const again = steps.cap(once(out));
         if (steps.text(again) === steps.text(out))
             break;
         out = again;
     }
     return out;
 }
+function escapeSpacesFor(o, face) {
+    if (face.mark !== 'escape' || face.fold)
+        return null;
+    const set = new Set();
+    if (o.controls !== false) {
+        for (const c of [0x09, 0x0a, 0x0b, 0x0c, 0x0d])
+            set.add(c);
+        if (o.keepLayout === true) {
+            set.delete(0x09);
+            set.delete(0x0a);
+        }
+    }
+    if (o.bidi !== false) {
+        set.add(0x2028);
+        set.add(0x2029);
+    }
+    return set.size === 0 ? null : set;
+}
+function scanOptionsOf(o, face) {
+    return {
+        urls: o.credentialUrls !== false,
+        words: o.credentialWords !== false,
+        blanks: face.keepBlanks === true,
+        fold: face.fold,
+        face,
+        escapeSpaces: escapeSpacesFor(o, face),
+    };
+}
+export function credentialWashPasses(text, opts = {}) {
+    const input = typeof text === 'string' ? text : String(text ?? '');
+    const stats = { passes: 0, capped: false };
+    const scan = opts === null ? WASH_OPTIONS : scanOptionsOf(opts, publicFace(opts));
+    scanAndMask(input, scan, false, stats);
+    return { passes: stats.passes, capped: stats.capped };
+}
 function renderUntrusted(text, opts, ledger) {
     const input = typeof text === 'string' ? text : String(text ?? '');
     const o = opts ?? {};
-    const urls = o.credentialUrls !== false;
-    const words = o.credentialWords !== false;
     const face = publicFace(o);
-    const blankTokens = face.keepBlanks !== true ? 'off' : face.fold ? 'fold' : 'keep';
+    const scan = scanOptionsOf(o, face);
     const pairBackslashes = o.escapeBackslashes === true && face.mark !== 'dot' && face.mark !== 'space';
     const book = ledger ?? (pairBackslashes ? { cps: [], lens: [] } : null);
     if (book === null) {
         return runDisplaySteps(input, {
-            wash: (s) => washCredentialNets(s, urls, words, false, blankTokens),
+            wash: (s) => scanAndMask(s, scan, false).text,
             paint: (s) => applyDisplayFace(s, face),
             cap: (s) => capDisplay(s, o.max, face.mark),
             text: (s) => s,
@@ -2132,7 +3283,7 @@ function renderUntrusted(text, opts, ledger) {
     }
     const out = runDisplaySteps({ text: input, ids: new Int32Array(input.length).fill(-1) }, {
         wash: (t) => {
-            const r = washNets(t.text, urls, words, false, blankTokens, true);
+            const r = scanAndMask(t.text, scan, true);
             return r.text === t.text ? t : { text: r.text, ids: carryIds(t.ids, r.origin) };
         },
         paint: (t) => faceTracked(t, face, book),