@sema-agent/client-core 0.93.1 → 0.95.0

package/dist/displayUntrusted.js

@@ -1,4 +1,4 @@
-import { SETTINGS_SECRET_LITERAL_RE } from './generated/settingsSchemaTables.js';
+import { SETTINGS_PRIVATE_KEY_PEM_HEADER, SETTINGS_SECRET_LITERAL_RE } from './generated/settingsSchemaTables.js';
 export const REDACTION_MARKER_PREFIX = '\u00abredacted';
 const MARKER_RE = /^\u00abredacted(?::[a-z-]{1,16}){0,2}\u00bb$/;
 const REDACTED_USERINFO = '\u00abredacted:userinfo\u00bb';
@@ -28,9 +28,12 @@ const UNIT_NONE = 0;
 const UNIT_SEQUENCE = 1;
 const UNIT_SINGLE = 2;
 const SECRET_LITERAL_RE = SETTINGS_SECRET_LITERAL_RE;
+const PRIVATE_KEY_PEM_HEADER = SETTINGS_PRIVATE_KEY_PEM_HEADER;
 const SCHEME_TOKEN_RE = /(?:^|[^A-Za-z0-9_-])(?:bearer|basic)[ \t]+\S{8,4096}/i;
 const JWT_RE = /(?:^|[^A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{8,2048}\.[A-Za-z0-9_-]{8,2048}\.[A-Za-z0-9_-]{4,2048}/i;
 function scanForSecretLiteral(s) {
+    if (PRIVATE_KEY_PEM_HEADER.test(s))
+        return true;
     if (SECRET_LITERAL_RE.test(s) || SCHEME_TOKEN_RE.test(s) || JWT_RE.test(s))
         return true;
     return s.split(/[^A-Za-z0-9_-]+/).some(tok => tok !== '' && SECRET_LITERAL_RE.test(tok));
@@ -100,8 +103,8 @@ function valueIsWholeMarker(S, start, end, tokenInner = true) {
     return j >= end || !isKeyWordChar(text.charCodeAt(j)) || credentialWordStartsExactlyAt(text, j, tokenInner) || credentialPairAt(S, j);
 }
 const CREDENTIAL_NAME = /(?:(?:access|refresh|id|client|api|x[-_]api|session|auth)[-_]?)?(?:token|key|secret|password|authorization|credential)s?|bearer|basic/iy;
-const LABEL_SEPARATOR = /(?:\\*["'])?[\s\u115F\u1160\u3164\uFFA0\u2800]*[:=\uFF1A\uFF1D]/y;
-const SCHEME_SEPARATOR = /[\s:=\uFF1A\uFF1D\u115F\u1160\u3164\uFFA0\u2800]/y;
+const LABEL_SEPARATOR = /(?:\\*["'])?(?:[\s\u115F\u1160\u3164\uFFA0\u2800]|\\t)*[:=\uFF1A\uFF1D]/y;
+const SCHEME_SEPARATOR = /(?:[\s:=\uFF1A\uFF1D\u115F\u1160\u3164\uFFA0\u2800]|\\t)/y;
 function credentialPairAt(S, at) {
     const text = S.text;
     const re = new RegExp(CREDENTIAL_NAME.source, 'iy');
@@ -283,15 +286,22 @@ function pathCandidates(src, base, path, opaqueSegments, edits, soft) {
     for (const segment of path.split('/')) {
         const semi = segment.indexOf(';');
         const head = semi === -1 ? segment : segment.slice(0, semi);
-        if (opaqueSegments && isKnownSecretSegment(head)) {
+        if (opaqueSegments) {
             let a = 0;
             let b = head.length;
             while (a < b && !isKeyWordChar(head.charCodeAt(a)))
                 a++;
             while (b > a && !isKeyWordChar(head.charCodeAt(b - 1)))
                 b--;
-            if (b > a)
-                pushEdit(edits, src, pos + a, pos + b, REDACTED_SECRET);
+            if (isKnownSecretSegment(head)) {
+                if (b > a)
+                    pushEdit(edits, src, pos + a, pos + b, REDACTED_SECRET);
+            }
+            else if (b > a) {
+                const glued = gluedLiteralStart(head.slice(a, b));
+                if (glued > 0)
+                    pushEdit(edits, src, pos + a + glued, pos + b, REDACTED_SECRET);
+            }
         }
         if (semi !== -1) {
             let ppos = pos + semi + 1;
@@ -398,6 +408,7 @@ function urlCandidates(text, out, regions, unitPos = () => false, soft) {
             runStart--;
         if (runStart < end && !VALUE_BOUNDARY_TAIL.test(text.slice(start, runStart)))
             end = runStart;
+        end = trailingCloserEnd(text, start, mark + 3, end, unitPos);
         const tokenEdits = [];
         urlTokenCandidatesAt(text, start, end, tokenEdits, soft);
         editsToCandidates(tokenEdits, 'url', out, end);
@@ -417,6 +428,47 @@ function urlCandidates(text, out, regions, unitPos = () => false, soft) {
         mark = text.indexOf('://', end > mark + 3 ? end : mark + 3);
     }
 }
+function trailingCloserEnd(text, start, floor, end, unitPos) {
+    const opens = new Map();
+    const closes = new Map();
+    for (const [o, c] of BRACKET_PAIRS) {
+        opens.set(o, 0);
+        closes.set(c, 0);
+    }
+    for (let k = start; k < end; k++) {
+        if (unitPos(k))
+            continue;
+        const ch = text.charAt(k);
+        const o = opens.get(ch);
+        if (o !== undefined)
+            opens.set(ch, o + 1);
+        const c = closes.get(ch);
+        if (c !== undefined)
+            closes.set(ch, c + 1);
+    }
+    let e = end;
+    for (;;) {
+        if (e <= floor || unitPos(e - 1))
+            return e;
+        const ch = text.charAt(e - 1);
+        const c = closes.get(ch);
+        if (c === undefined)
+            return e;
+        let open = '';
+        for (const [o, cl] of BRACKET_PAIRS)
+            if (cl === ch)
+                open = o;
+        if (c <= (opens.get(open) ?? 0))
+            return e;
+        closes.set(ch, c - 1);
+        e--;
+        let runStart = e;
+        while (runStart > floor && TRAILING_PUNCTUATION.has(text.charAt(runStart - 1)))
+            runStart--;
+        if (runStart < e && !VALUE_BOUNDARY_TAIL.test(text.slice(start, runStart)))
+            e = runStart;
+    }
+}
 function atInAuthority(text, from) {
     for (let p = from; p < text.length; p++) {
         const ch = text.charAt(p);
@@ -760,9 +812,9 @@ const NAME_BLANK_RANGES = [
 const isNameBlank = (cp) => NAME_BLANK_RANGES.some(([a, b]) => cp >= a && cp <= b);
 const isFoldedBlank = (c) => isNameBlank(c) && isRegexSpace(c);
 const isUnicodeBlank = (c) => (c > 0x7f && isRegexSpace(c) && c !== 0xfeff) || isNameBlank(c);
-const SECRET_SCHEME_WORD = /(?:\b|(?<=\\[A-Za-z"']))(bearer|basic|token)[\s:=\uFF1A\uFF1D\u115F\u1160\u3164\uFFA0\u2800]+/gi;
+const SECRET_SCHEME_WORD = /(?:\b|(?<=\\[A-Za-z"']))(?!(?<=(?<!\\)\\)(?:bearer|basic|token)\\t)(bearer|basic|token)(?:[\s:=\uFF1A\uFF1D\u115F\u1160\u3164\uFFA0\u2800]|\\t)+/gi;
 const schemeWordIsInner = (word, tokenInner) => tokenInner || word.toLowerCase() !== 'token';
-const SECRET_LABELLED_WORD = /(?:\b|(?<=_)|(?<=\\[A-Za-z"']))((?:access[-_ ]?|refresh[-_ ]?|id[-_ ]?|client[-_ ]?|api[-_ ]?|x[-_]api[-_ ]?|session[-_ ]?|auth[-_ ]?)?(?:token|key|secret|password|authorization|credential)s?)(?:\\*["'])?[\s\u115F\u1160\u3164\uFFA0\u2800]*[:=\uFF1A\uFF1D][\s\u115F\u1160\u3164\uFFA0\u2800]*/gi;
+const SECRET_LABELLED_WORD = /(?:\b|(?<=_)|(?<=\\[A-Za-z"']))((?:access[-_ ]?|refresh[-_ ]?|id[-_ ]?|client[-_ ]?|api[-_ ]?|x[-_]api[-_ ]?|session[-_ ]?|auth[-_ ]?)?(?:token|key|secret|password|authorization|credential)s?)(?:\\*["'])?(?:[\s\u115F\u1160\u3164\uFFA0\u2800]|\\t)*[:=\uFF1A\uFF1D](?:[\s\u115F\u1160\u3164\uFFA0\u2800]|\\t)*/gi;
 const DIAGNOSTIC_VALUE_WORDS = new Set([
     'missing', 'required', 'invalid', 'expired', 'unauthorized', 'unauthenticated', 'authentication',
     'authorization', 'credential', 'credentials', 'unsupported', 'malformed', 'rejected', 'absent',
@@ -817,18 +869,67 @@ const AUTH_SCHEME_WORDS = new Set([
 const AUTH_SIGNATURE_SCHEME = /^[A-Z][A-Z0-9]*(?:-[A-Z0-9]+){2,}$/;
 const BARE_VALUE_STOP_CHARS = new Set([',', ';', '"', "'", '\\', '(', ')', '[', ']', '{', '}', '<', '>']);
 const isBareValueStop = (ch) => ch <= ' ' || BARE_VALUE_STOP_CHARS.has(ch);
+function isPlainAt(S, rawUnit, k) {
+    if (S.dropped(k) || S.painted(k) || S.unitAt(k) !== UNIT_NONE)
+        return false;
+    return rawUnit === null || rawUnit[S.rawStart(k)] !== 1;
+}
+function codeSpanClose(text, plain) {
+    const n = text.length;
+    const close = new Int32Array(n + 1).fill(-1);
+    let openLen = 0;
+    let spanFrom = -1;
+    let k = 0;
+    while (k < n) {
+        const c = text.charCodeAt(k);
+        if (c === 0x0a || c === 0x0d || c === 0x2028 || c === 0x2029) {
+            openLen = 0;
+            spanFrom = -1;
+            k++;
+            continue;
+        }
+        if (c !== 0x60 || !plain(k)) {
+            k++;
+            continue;
+        }
+        let e = k;
+        while (e < n && text.charCodeAt(e) === 0x60 && plain(e))
+            e++;
+        const len = e - k;
+        if (openLen === 0) {
+            openLen = len;
+            spanFrom = e;
+        }
+        else if (len === openLen) {
+            for (let x = spanFrom; x < k; x++)
+                close[x] = k;
+            openLen = 0;
+            spanFrom = -1;
+        }
+        k = e;
+    }
+    return close;
+}
+const BRACKET_PAIRS = new Map([['(', ')'], ['[', ']']]);
 class InnerWordIndex {
     text;
     tokenInner;
     probes;
-    constructor(text, tokenInner = true) {
+    plain;
+    spanClose = null;
+    constructor(text, tokenInner = true, plain = () => true) {
         this.text = text;
         this.tokenInner = tokenInner;
+        this.plain = plain;
         this.probes = [
             { re: new RegExp(SECRET_LABELLED_WORD.source, SECRET_LABELLED_WORD.flags), scheme: false, from: -1, hit: null },
             { re: new RegExp(SECRET_SCHEME_WORD.source, SECRET_SCHEME_WORD.flags), scheme: true, from: -1, hit: null },
         ];
     }
+    closingTickFrom(i) {
+        this.spanClose ??= codeSpanClose(this.text, this.plain);
+        return this.spanClose[i] ?? -1;
+    }
     next(q) {
         let best = null;
         for (const p of this.probes) {
@@ -854,6 +955,45 @@ class InnerWordIndex {
         return best;
     }
 }
+const WRAPPED_PLACEHOLDER = /^(?:[A-Z]{1,12}(?:_[A-Z]{1,12})*|[a-z]{1,12}(?:-[a-z]{1,12})*)$/;
+function wrappedValueAt(text, from, idx) {
+    let k = from;
+    while (k < text.length && text[k] === VIEW_SEPARATOR)
+        k++;
+    const close = BRACKET_PAIRS.get(text.charAt(k));
+    if (close === undefined || credentialWordStartsAt(text, k + 1, idx.tokenInner))
+        return null;
+    const inner = scanSecretValue(text, k + 1, idx);
+    if (inner === null || inner.start !== k + 1)
+        return null;
+    let c = inner.end;
+    while (c < text.length && text[c] === VIEW_SEPARATOR)
+        c++;
+    if (text.charAt(c) !== close || (close === ']' && text.charAt(c + 1) === '('))
+        return null;
+    return inner;
+}
+function tokenSchemeValueEnd(text, start, end, idx) {
+    if (withoutSeparators(text.slice(start, end)).toLowerCase() !== 'token')
+        return -1;
+    const re = new RegExp(SECRET_SCHEME_WORD.source, 'iy');
+    re.lastIndex = start;
+    const m = re.exec(text);
+    if (m === null || (m[1] ?? '').toLowerCase() !== 'token')
+        return -1;
+    const sepEnd = start + m[0].length;
+    if (/[\n\r\u2028\u2029:=\uFF1A\uFF1D]/.test(text.slice(start + (m[1] ?? '').length, sepEnd)))
+        return -1;
+    if (credentialWordStartsAt(text, sepEnd, idx.tokenInner))
+        return -1;
+    const iv = scanSecretValue(text, sepEnd, idx);
+    if (iv === null)
+        return -1;
+    const inner = withoutSeparators(text.slice(iv.start, iv.end));
+    if (schemeFollowerReleased('token', inner, false) || isDiagnosticWord(inner))
+        return -1;
+    return iv.end;
+}
 function innerWordFits(text, w) {
     for (let k = w.start; k <= w.sepAt && k < text.length; k++)
         if (isBareValueStop(text.charAt(k)))
@@ -909,6 +1049,7 @@ function scanSecretValue(text, from, idx) {
     let pending = cuttable ? idx.next(i + 1) : null;
     let cut = false;
     let j = i;
+    const closingTick = idx === undefined ? -1 : idx.closingTickFrom(i);
     while (j < text.length) {
         if (pending !== null && j >= pending.start) {
             if (j === pending.start && innerWordFits(text, pending)) {
@@ -933,6 +1074,18 @@ function scanSecretValue(text, from, idx) {
     }
     while (j > i && text[j - 1] === VIEW_SEPARATOR)
         j--;
+    if (closingTick > i && closingTick < j) {
+        let t = closingTick;
+        while (t < j && text.charCodeAt(t) === 0x60)
+            t++;
+        while (t < j && TRAILING_PUNCTUATION.has(text.charAt(t)))
+            t++;
+        if (t === j && text.charCodeAt(closingTick) === 0x60) {
+            j = closingTick;
+            while (j > i && text[j - 1] === VIEW_SEPARATOR)
+                j--;
+        }
+    }
     if (cut) {
         while (j > i && isCutDelimiter(text.charAt(j - 1))) {
             j--;
@@ -952,6 +1105,9 @@ function isDiagnosticValue(value, raw = value) {
         return true;
     if (ADDRESS_SCHEME_RE.test(raw))
         return true;
+    return isDiagnosticWord(value);
+}
+function isDiagnosticWord(value) {
     const bare = value.replace(/^\.+/, '').replace(/[.,;:!?)\]}'"]{0,8}$/, '').toLowerCase();
     return bare === '' || DIAGNOSTIC_VALUE_WORDS.has(bare);
 }
@@ -1011,6 +1167,26 @@ function isNamedNotValue(label, value) {
         return true;
     return isBacktickedCredentialName(value);
 }
+function schemeIsLabelValue(text, at) {
+    let k = at;
+    while (k > 0 && text[k - 1] === VIEW_SEPARATOR)
+        k--;
+    if (k > 0 && isQuoteChar(text.charAt(k - 1))) {
+        k--;
+        while (k > 0 && text.charCodeAt(k - 1) === 0x5c)
+            k--;
+    }
+    return k > 0 && labelEndsAt(text, k);
+}
+function labelQuotedAt(text, at, sep) {
+    const q = text.charAt(at - 1);
+    if (!isQuoteChar(q))
+        return false;
+    let k = 0;
+    while (sep.charCodeAt(k) === 0x5c)
+        k++;
+    return sep.charAt(k) === q;
+}
 function labelStartsAt(text, at) {
     const re = new RegExp(SECRET_LABELLED_WORD.source, 'iy');
     re.lastIndex = at;
@@ -1474,13 +1650,467 @@ function quotedAddressEnd(S, from, to) {
     }
     return to;
 }
+function isInlineBlank(ch) {
+    if (ch === VIEW_SEPARATOR)
+        return true;
+    const c = ch.charCodeAt(0);
+    if (c === 0x0a || c === 0x0d || c === 0x2028 || c === 0x2029)
+        return false;
+    return isRegexSpace(c) || isNameBlank(c);
+}
+const isAnyBlank = (ch) => ch === VIEW_SEPARATOR || isRegexSpace(ch.charCodeAt(0)) || isNameBlank(ch.charCodeAt(0));
+function nodePropertyEnd(text, at) {
+    const sigil = text.charAt(at);
+    let j = at + 1;
+    if (sigil === '!') {
+        if (text.charAt(j) === '<') {
+            const limit = Math.min(text.length, j + 512);
+            let k = j + 1;
+            while (k < limit && text.charAt(k) !== '>' && !isAnyBlank(text.charAt(k)))
+                k++;
+            if (text.charAt(k) !== '>' || k === j + 1)
+                return -1;
+            j = k + 1;
+        }
+        else {
+            while (j < text.length && !isBareValueStop(text.charAt(j)))
+                j++;
+        }
+    }
+    else if (sigil === '&') {
+        while (j < text.length && !isBareValueStop(text.charAt(j)))
+            j++;
+        if (j === at + 1)
+            return -1;
+    }
+    else
+        return -1;
+    return j < text.length && isInlineBlank(text.charAt(j)) ? j : -1;
+}
+function nodeProperties(text, from) {
+    let i = from;
+    while (text.charAt(i) === VIEW_SEPARATOR)
+        i++;
+    const start = i;
+    let end = -1;
+    for (;;) {
+        const c = text.charAt(i);
+        if (c !== '!' && c !== '&')
+            break;
+        const e = nodePropertyEnd(text, i);
+        if (e === -1)
+            break;
+        end = e;
+        i = e;
+        while (i < text.length && isInlineBlank(text.charAt(i)))
+            i++;
+    }
+    return end === -1 ? null : { start, end, next: i };
+}
+function propertiesSameLine(S, pr) {
+    if (pr.next >= S.text.length)
+        return false;
+    const a = S.rawStart(pr.start);
+    const b = S.rawStart(pr.next);
+    return b >= a && !/[\n\r\u2028\u2029\u0085]/.test(S.raw.slice(a, b));
+}
+function hasValueAt(text, at) {
+    if (at >= text.length)
+        return false;
+    const c = text.charAt(at);
+    if (c === '|' || c === '>' || c === '[' || c === '\\' || isQuoteChar(c))
+        return true;
+    return !isBareValueStop(c) && c !== VIEW_SEPARATOR;
+}
+const SGR_REMNANT = /^\[[0-9;]*m(?:\u00abredacted|\s|$)/;
+function bracketPairs(text) {
+    const pairs = new Int32Array(text.length).fill(-1);
+    const stack = [];
+    for (let i = 0; i < text.length; i++) {
+        const c = text.charCodeAt(i);
+        if (c === 0x5b)
+            stack.push(i);
+        else if (c === 0x5d) {
+            const o = stack.pop();
+            if (o !== undefined)
+                pairs[o] = i;
+        }
+    }
+    return pairs;
+}
+const LIST_NEUTRAL_ITEM = /^(?:object Object|Object|Array|Circular|Getter|Setter|Getter\/Setter|native code|hidden|masked|omitted|truncated)$/i;
+function afterClosingQuote(text, end) {
+    let k = end;
+    while (text.charAt(k) === VIEW_SEPARATOR)
+        k++;
+    let q = k;
+    while (text.charCodeAt(q) === 0x5c)
+        q++;
+    const c = text.charAt(q);
+    return isQuoteChar(c) ? q + 1 : end;
+}
+function matchBrace(text, open) {
+    let depth = 0;
+    let quote = '';
+    for (let i = open; i < text.length; i++) {
+        const c = text.charAt(i);
+        if (quote !== '') {
+            if (c === '\\')
+                i++;
+            else if (c === quote)
+                quote = '';
+            continue;
+        }
+        if (isQuoteChar(c))
+            quote = c;
+        else if (c === '{')
+            depth++;
+        else if (c === '}' && --depth === 0)
+            return i;
+    }
+    return text.length;
+}
+function flowListItems(text, open, idx, budget) {
+    if (budget.left <= 0 || SGR_REMNANT.test(text.slice(open, open + 32)))
+        return null;
+    budget.pairs ??= bracketPairs(text);
+    const plainClose = budget.pairs[open] ?? -1;
+    if (plainClose >= 0 && text.charAt(plainClose + 1) === '(')
+        return null;
+    const out = flowListScan(text, open, idx);
+    budget.left -= out.end - open;
+    return out.link ? null : { items: out.items, end: out.end };
+}
+function flowListScan(text, open, idx) {
+    const items = [];
+    const n = text.length;
+    let depth = 0;
+    let i = open;
+    while (i < n) {
+        const ch = text.charAt(i);
+        if (ch === '[') {
+            depth++;
+            i++;
+            continue;
+        }
+        if (ch === ']') {
+            depth--;
+            i++;
+            if (depth <= 0)
+                return { items, end: i, link: text.charAt(i) === '(' };
+            continue;
+        }
+        if (ch === ',' || ch === '}' || isAnyBlank(ch) || ch === '\n' || ch === '\r') {
+            i++;
+            continue;
+        }
+        const escapedBreak = ch === '\\' ? lineBreakLengthAt(text, i) : 0;
+        if (escapedBreak > 0) {
+            i += escapedBreak;
+            continue;
+        }
+        if (ch === '{') {
+            const e = matchBrace(text, i);
+            if (e > i + 1)
+                items.push({ start: i + 1, end: e });
+            i = Math.min(n, e + 1);
+            continue;
+        }
+        let q = i;
+        while (text.charCodeAt(q) === 0x5c)
+            q++;
+        if (isQuoteChar(text.charAt(q))) {
+            const v = scanSecretValue(text, i, idx);
+            if (v === null) {
+                i = q + 1;
+                continue;
+            }
+            items.push({ start: v.start, end: v.end, quoted: true });
+            i = Math.max(afterClosingQuote(text, v.end), i + 1);
+            continue;
+        }
+        let j = i;
+        while (j < n) {
+            const c = text.charAt(j);
+            if (c === ',' || c === ']' || c === '[' || c === '{' || c === '}' || c === '\n' || c === '\r' || (c === '\\' && lineBreakLengthAt(text, j) > 0))
+                break;
+            j++;
+        }
+        let e = j;
+        while (e > i && isAnyBlank(text.charAt(e - 1)))
+            e--;
+        if (e > i)
+            items.push({ start: i, end: e });
+        i = j > i ? j : i + 1;
+    }
+    return { items, end: n, link: false };
+}
+const PAIR_ITEM = /^[A-Za-z_][A-Za-z0-9_.-]*(?:=|:(?!\/))[^\s,;]/;
+function lineBreakAtView(S, k) {
+    const ch = S.text.charAt(k);
+    if (ch === '\n' || ch === '\r' || ch === '\u2028' || ch === '\u2029')
+        return true;
+    if (ch !== VIEW_SEPARATOR)
+        return false;
+    const a = S.rawStart(k);
+    return /[\n\r\u2028\u2029\u0085]/.test(S.raw.slice(a, Math.max(a + 1, S.rawEnd(k))));
+}
+function scanListItem(S, i, idx) {
+    const text = S.text;
+    const v = scanSecretValue(text, i, idx);
+    if (v === null)
+        return null;
+    let q = i;
+    while (text.charCodeAt(q) === 0x5c)
+        q++;
+    if (isQuoteChar(text.charAt(q)))
+        return v;
+    for (let k = v.start; k < v.end; k++) {
+        if (text.charAt(k) !== VIEW_SEPARATOR || !lineBreakAtView(S, k))
+            continue;
+        let e = k;
+        while (e > v.start && text.charAt(e - 1) === VIEW_SEPARATOR)
+            e--;
+        return e > v.start ? { start: v.start, end: e } : null;
+    }
+    return v;
+}
+function commaListTail(S, from, idx) {
+    const text = S.text;
+    const items = [];
+    const n = text.length;
+    let i = from;
+    let end = from;
+    for (;;) {
+        let k = i;
+        while (k < n && isInlineBlank(text.charAt(k)) && !lineBreakAtView(S, k))
+            k++;
+        if (text.charAt(k) !== ',')
+            break;
+        k++;
+        while (k < n && isInlineBlank(text.charAt(k)) && !lineBreakAtView(S, k))
+            k++;
+        if (k >= n || credentialWordStartsAt(text, k, idx.tokenInner) || PAIR_ITEM.test(text.slice(k, k + 256)))
+            break;
+        let q = k;
+        while (text.charCodeAt(q) === 0x5c)
+            q++;
+        const quotedItem = isQuoteChar(text.charAt(q));
+        if (q > k && !quotedItem)
+            break;
+        const v = scanListItem(S, k, idx);
+        if (v === null)
+            break;
+        const after = quotedItem ? afterClosingQuote(text, v.end) : v.end;
+        let t = after;
+        let lineEnd = false;
+        while (t < n && isInlineBlank(text.charAt(t))) {
+            if (lineBreakAtView(S, t)) {
+                lineEnd = true;
+                break;
+            }
+            t++;
+        }
+        const term = text.charAt(t);
+        const stops = lineEnd || t >= n || term === ',' || term === ';' || term === ')' || term === ']' || term === '}' || term === '\\' || isQuoteChar(term) || term === '\n' || term === '\r';
+        if (!stops)
+            break;
+        items.push(v);
+        i = after;
+        end = after;
+    }
+    return { items, end };
+}
+function viewIndexOfRaw(S, p) {
+    let lo = 0;
+    let hi = S.text.length;
+    while (lo < hi) {
+        const mid = (lo + hi) >> 1;
+        if (S.rawStart(mid) < p)
+            lo = mid + 1;
+        else
+            hi = mid;
+    }
+    while (lo < S.text.length && S.text.charAt(lo) === VIEW_SEPARATOR)
+        lo++;
+    return lo;
+}
+function dotsBeforeMarker(raw, p) {
+    let k = p;
+    while (raw.charCodeAt(k) === 0x2e)
+        k++;
+    if (k === p)
+        return p;
+    let m = k;
+    while (m < k + 3 && (raw.charCodeAt(m) === 0x5c || raw.charCodeAt(m) === 0x22 || raw.charCodeAt(m) === 0x27))
+        m++;
+    if (raw.startsWith(REDACTION_MARKER_PREFIX, m) || /^\[[0-9;]{0,12}m\u00abredacted/.test(raw.slice(k, k + 24)))
+        return k;
+    return p;
+}
+function escapedBlankLen(raw, p) {
+    if (raw.charCodeAt(p) !== 0x5c || raw.charCodeAt(p + 1) !== 0x75)
+        return 0;
+    const hex = raw.slice(p + 2, p + 6);
+    return /^[0-9A-Fa-f]{4}$/.test(hex) && isRawBlank(Number.parseInt(hex, 16)) ? 6 : 0;
+}
+function dotsBeforeDash(raw, p) {
+    let k = p;
+    while (raw.charCodeAt(k) === 0x2e)
+        k++;
+    return k > p && raw.charCodeAt(k) === 0x2d ? k : p;
+}
+function dashEntryAt(scan, p, escaped) {
+    const raw = scan.raw;
+    if (raw.charCodeAt(p) !== 0x2d)
+        return false;
+    if (p + 1 >= raw.length)
+        return true;
+    return isRawBlank(raw.charCodeAt(p + 1)) || scan.view.rawUnit[p + 1] === 1 || blockBreakAt(raw, p + 1, escaped) > 0 || escapedBlankLen(raw, p + 1) > 0 || dotsBeforeMarker(raw, p + 1) !== p + 1;
+}
+function lineContentStart(scan, lines, i, skipDots = true) {
+    const raw = scan.raw;
+    const unit = scan.view.rawUnit;
+    const { seq, payload } = blockMarks(scan);
+    const end = lines.ends[i] ?? raw.length;
+    let k = lines.starts[i] ?? 0;
+    while (k < end) {
+        if (payload[k] === 1)
+            break;
+        if (seq[k] === 1 || isRawBlank(raw.charCodeAt(k)) || unit[k] === 1)
+            k++;
+        else if (escapedBlankLen(raw, k) > 0)
+            k += 6;
+        else
+            break;
+    }
+    return skipDots && k < end ? dotsBeforeDash(raw, k) : k;
+}
+function seqLineIndent(scan, lines, i) {
+    const base = lines.indent[i] ?? -1;
+    if (base < 0)
+        return base;
+    const raw = scan.raw;
+    const unit = scan.view.rawUnit;
+    const { seq, payload } = blockMarks(scan);
+    const end = lines.ends[i] ?? raw.length;
+    let k = lines.starts[i] ?? 0;
+    let width = 0;
+    while (k < end) {
+        if (payload[k] === 1)
+            break;
+        if (escapedBlankLen(raw, k) > 0) {
+            width++;
+            k += 6;
+        }
+        else if (seq[k] === 1)
+            k++;
+        else if (isRawBlank(raw.charCodeAt(k))) {
+            width++;
+            k++;
+        }
+        else if (unit[k] === 1)
+            k++;
+        else
+            break;
+    }
+    if (k < end) {
+        const d = dotsBeforeDash(raw, k);
+        width += d - k;
+    }
+    return width;
+}
+function blockSeqEntries(scan, rawFrom, rawLabel) {
+    const raw = scan.raw;
+    const unit = scan.view.rawUnit;
+    let p = dotsBeforeDash(raw, rawFrom);
+    let escaped = false;
+    if (raw.charCodeAt(p) === 0x5c && lineBreakLengthAt(raw, p) > 0) {
+        escaped = true;
+        for (;;) {
+            const n = lineBreakLengthAt(raw, p);
+            if (n === 0 || raw.charCodeAt(p) !== 0x5c)
+                break;
+            p += n;
+            while (p < raw.length && (isRawBlank(raw.charCodeAt(p)) || unit[p] === 1 || escapedBlankLen(raw, p) > 0)) {
+                const n = escapedBlankLen(raw, p);
+                p += n > 0 ? n : 1;
+            }
+            p = dotsBeforeDash(raw, p);
+        }
+    }
+    if (!dashEntryAt(scan, p, escaped))
+        return null;
+    const lines = blockLines(scan, escaped);
+    const first = blockLineOf(lines, p);
+    const labelLine = blockLineOf(lines, rawLabel);
+    const labelIndent = Math.max(0, lines.indent[labelLine] ?? 0);
+    const entryIndent = seqLineIndent(scan, lines, first);
+    const labelHead = lineContentStart(scan, lines, labelLine, false);
+    const labelFirst = rawLabel >= labelHead && !/\s/.test(raw.slice(labelHead, rawLabel));
+    if (lineContentStart(scan, lines, first) !== p || entryIndent < 0 || (labelFirst ? entryIndent < labelIndent : entryIndent <= labelIndent))
+        return null;
+    const out = [];
+    const work = [first];
+    const total = lines.starts.length;
+    while (work.length > 0) {
+        let i = work.pop() ?? total;
+        const ind = seqLineIndent(scan, lines, i);
+        while (i < total) {
+            const dash = lineContentStart(scan, lines, i);
+            const end = lines.ends[i] ?? raw.length;
+            let v = dash + 1;
+            while (v < end && (isRawBlank(raw.charCodeAt(v)) || unit[v] === 1 || escapedBlankLen(raw, v) > 0)) {
+                const n = escapedBlankLen(raw, v);
+                v += n > 0 ? n : 1;
+            }
+            v = dotsBeforeMarker(raw, v);
+            if (v < end) {
+                let whole = -1;
+                if (dashEntryAt(scan, v, escaped)) {
+                    let last = (lines.outOf[i] ?? total) - 1;
+                    while (last > i && (lines.indent[last] ?? -1) === -1)
+                        last--;
+                    whole = lines.ends[last] ?? end;
+                }
+                out.push({ dash, value: v, whole });
+            }
+            else {
+                const k = lines.nextContent[i + 1] ?? total;
+                if (k < total && seqLineIndent(scan, lines, k) > ind) {
+                    const kp = lineContentStart(scan, lines, k);
+                    if (dashEntryAt(scan, kp, escaped)) {
+                        out.push({ dash, value: -1, whole: -1 });
+                        work.push(k);
+                    }
+                    else
+                        out.push({ dash, value: kp, whole: -1 });
+                }
+                else
+                    out.push({ dash, value: -1, whole: -1 });
+            }
+            const j = lines.outOf[i] ?? total;
+            if (j >= total || seqLineIndent(scan, lines, j) !== ind || !dashEntryAt(scan, lineContentStart(scan, lines, j), escaped))
+                break;
+            i = j;
+        }
+    }
+    return out;
+}
 function labelCandidates(S, pass, regions, out, blocks) {
     const text = S.text;
     const unitAt = (k) => S.unitAt(k);
     const re = pass === 'label' ? SECRET_LABELLED_WORD : SECRET_SCHEME_WORD;
     const schemePass = pass !== 'label';
     const tokenPass = pass === 'token';
-    const idx = new InnerWordIndex(text, tokenPass);
+    const rawUnitMap = blocks?.view.rawUnit ?? null;
+    const plainAt = (k) => isPlainAt(S, rawUnitMap, k);
+    const idx = new InnerWordIndex(text, tokenPass, plainAt);
+    let listIdx = null;
+    const listIndex = () => (listIdx ??= new InnerWordIndex(text, idx.tokenInner, plainAt));
+    let skipFrom = -1;
+    let skipTo = -1;
+    const flowBudget = { left: 4 * text.length + 4096, pairs: null };
     const extensionCache = new Map();
     let stops;
     const push = (start, end, kindText, te = -1, cls) => {
@@ -1603,6 +2233,88 @@ function labelCandidates(S, pass, regions, out, blocks) {
             r0++;
         maskGaps(r0, outerEnd);
     };
+    const itemNeutral = (a, b) => {
+        const rawItem = text.slice(a, b);
+        const item = withoutSeparators(rawItem).trim();
+        if (item === '')
+            return true;
+        return valueIsWholeMarker(S, a, b, idx.tokenInner) || MARKER_WITH_DOTS.test(item) || isDiagnosticValue(item, rawItem) || LIST_NEUTRAL_ITEM.test(item);
+    };
+    const flowListLike = (label, items) => {
+        if (/s$/i.test(label) || items.length !== 1)
+            return true;
+        const only = items[0];
+        return only === undefined || only.quoted === true || !/\s/.test(withoutSeparators(text.slice(only.start, only.end)).trim());
+    };
+    const listMask = (label, spans, valueLike) => {
+        const neutral = spans.map((s) => itemNeutral(s.start, s.end));
+        const names = !valueLike && spans.every((s, i) => neutral[i] === true || isNamedNotValue(label, withoutSeparators(text.slice(s.start, s.end)).trim()));
+        return spans.map((_, i) => !names && neutral[i] !== true);
+    };
+    const seqItems = (scan, ents, label) => {
+        const li = listIndex();
+        const spans = [];
+        let valueLike = false;
+        for (const e of ents) {
+            if (e.value < 0)
+                continue;
+            if (e.whole >= 0) {
+                scan.out.push({ start: e.value, end: e.whole, kind: 'secret', cls: 'word', tokenEnd: e.whole, pretrimmed: true });
+                valueLike = true;
+                continue;
+            }
+            let vi = viewIndexOfRaw(S, e.value);
+            if (vi >= text.length)
+                continue;
+            const pr = nodeProperties(text, vi);
+            if (pr !== null && hasValueAt(text, pr.next) && propertiesSameLine(S, pr)) {
+                push(pr.start, pr.end, REDACTED_SECRET);
+                vi = pr.next;
+            }
+            const c = text.charAt(vi);
+            if (c === '|' || c === '>') {
+                const blk = blockScalarExtent(scan, S.rawStart(vi), e.dash);
+                if (blk !== null) {
+                    scan.out.push({ start: blk.start, end: blk.end, kind: 'secret', cls: 'word', tokenEnd: blk.end, pretrimmed: true });
+                    valueLike = true;
+                    continue;
+                }
+            }
+            if (c === '[') {
+                const fl = flowListItems(text, vi, li, flowBudget);
+                if (fl !== null && flowListLike(label, fl.items)) {
+                    for (const it of fl.items)
+                        spans.push(it);
+                    continue;
+                }
+            }
+            if (c === '{') {
+                const close = matchBrace(text, vi);
+                if (close > vi + 1)
+                    spans.push({ start: vi + 1, end: close });
+                continue;
+            }
+            if (c === '*')
+                continue;
+            let q = vi;
+            while (text.charCodeAt(q) === 0x5c)
+                q++;
+            const quotedItem = isQuoteChar(text.charAt(q));
+            const v = scanListItem(S, vi, li);
+            if (v === null)
+                continue;
+            const keyAt = quotedItem ? afterClosingQuote(text, v.end) : v.end - 1;
+            const keyNext = text.charAt(keyAt + 1);
+            if (text.charAt(keyAt) === ':' && (keyAt + 1 >= text.length || isAnyBlank(keyNext) || keyNext === '\n' || keyNext === '\r'))
+                continue;
+            spans.push(v);
+        }
+        const flags = listMask(label, spans, valueLike);
+        spans.forEach((s, i) => {
+            if (flags[i] === true)
+                push(s.start, s.end, REDACTED_SECRET);
+        });
+    };
     const regionKind = regions.length === 0 ? null : new Uint8Array(text.length);
     if (regionKind !== null)
         for (const r of regions)
@@ -1632,8 +2344,10 @@ function labelCandidates(S, pass, regions, out, blocks) {
         return a;
     };
     re.lastIndex = 0;
-    for (let hit = re.exec(text); hit !== null; hit = re.exec(text)) {
+    hits: for (let hit = re.exec(text); hit !== null; hit = re.exec(text)) {
         const label = hit[1] ?? '';
+        if (hit.index >= skipFrom && hit.index < skipTo)
+            continue;
         if (schemePass && (label.toLowerCase() === 'token') !== tokenPass)
             continue;
         if (isTokenCountLabel(text, hit.index, label))
@@ -1642,18 +2356,89 @@ function labelCandidates(S, pass, regions, out, blocks) {
             continue;
         if (schemePass && labelStartsAt(text, hit.index))
             continue;
-        const from = hit.index + hit[0].length;
-        if (blocks !== undefined && (text.charCodeAt(from) === 0x7c || text.charCodeAt(from) === 0x3e) && isColonSeparator(hit[0].slice((hit[1] ?? '').length))) {
-            const blk = blockScalarExtent(blocks, S.rawStart(from), S.rawStart(hit.index));
-            if (blk !== null)
-                blocks.out.push({ start: blk.start, end: blk.end, kind: 'secret', cls: 'word', tokenEnd: blk.end, pretrimmed: true });
-        }
-        if (credentialWordStartsAt(text, from, idx.tokenInner)) {
-            pushInnerRemainder(from);
-            re.lastIndex = from;
-            continue;
+        let from = hit.index + hit[0].length;
+        if (!schemePass && text.charCodeAt(from) === 0x3e && text.charCodeAt(from - 1) === 0x3d && labelQuotedAt(text, hit.index, hit[0].slice(label.length))) {
+            let k = from + 1;
+            while (k < text.length && isInlineBlank(text.charAt(k)))
+                k++;
+            let q = k;
+            while (text.charCodeAt(q) === 0x5c)
+                q++;
+            if (isQuoteChar(text.charAt(q)))
+                from = k;
+        }
+        const colonSep = isColonSeparator(hit[0].slice((hit[1] ?? '').length));
+        let bulletSkipped = false;
+        for (;;) {
+            if (colonSep) {
+                const pr = nodeProperties(text, from);
+                if (pr !== null && hasValueAt(text, pr.next) && propertiesSameLine(S, pr) && !credentialWordStartsAt(text, pr.next, idx.tokenInner)) {
+                    push(pr.start, pr.end, REDACTED_SECRET);
+                    from = pr.next;
+                }
+            }
+            if (blocks !== undefined && (text.charCodeAt(from) === 0x7c || text.charCodeAt(from) === 0x3e) && colonSep) {
+                const blk = blockScalarExtent(blocks, S.rawStart(from), S.rawStart(hit.index));
+                if (blk !== null)
+                    blocks.out.push({ start: blk.start, end: blk.end, kind: 'secret', cls: 'word', tokenEnd: blk.end, pretrimmed: true });
+            }
+            if (credentialWordStartsAt(text, from, idx.tokenInner)) {
+                pushInnerRemainder(from);
+                re.lastIndex = from;
+                continue hits;
+            }
+            if (!schemePass && text.charAt(from) === '[') {
+                const fl = flowListItems(text, from, listIndex(), flowBudget);
+                if (fl !== null && flowListLike(label, fl.items)) {
+                    const flags = listMask(label, fl.items, false);
+                    fl.items.forEach((s, i) => {
+                        if (flags[i] === true)
+                            push(s.start, s.end, REDACTED_SECRET);
+                    });
+                    re.lastIndex = Math.max(fl.end, from);
+                    continue hits;
+                }
+            }
+            if (!schemePass && colonSep && blocks !== undefined && (text.charAt(from) === '-' || text.charAt(from) === '\\' || text.charAt(from) === '.')) {
+                const ents = blockSeqEntries(blocks, S.rawStart(from), S.rawStart(hit.index));
+                if (ents !== null) {
+                    seqItems(blocks, ents, label);
+                    re.lastIndex = from;
+                    continue hits;
+                }
+            }
+            if (!(colonSep && text.charAt(from) === '-' && from + 1 < text.length))
+                break;
+            const afterDots = dotsBeforeMarker(text, from + 1);
+            if (!(isInlineBlank(text.charAt(from + 1)) || S.gapAfter(from) || afterDots !== from + 1))
+                break;
+            let b = afterDots;
+            while (b < text.length && isInlineBlank(text.charAt(b)))
+                b++;
+            if (b >= text.length || isAnyBlank(text.charAt(b)))
+                break;
+            from = b;
+            bulletSkipped = true;
+        }
+        if (bulletSkipped) {
+            const first = scanListItem(S, from, listIndex());
+            const j = first === null ? from : first.end;
+            if (j > from + 1 && text.charAt(j - 1) === ':' && (j >= text.length || isAnyBlank(text.charAt(j)))) {
+                re.lastIndex = from;
+                continue;
+            }
         }
         let v0s = scanSecretValue(text, from, idx);
+        let wrapEnd = -1;
+        if (v0s === null) {
+            const w = wrappedValueAt(text, from, idx);
+            if (w !== null) {
+                if (WRAPPED_PLACEHOLDER.test(withoutSeparators(text.slice(w.start, w.end))))
+                    continue;
+                v0s = w;
+                wrapEnd = w.end;
+            }
+        }
         if (v0s === null) {
             let k = from;
             while (k < text.length && text[k] === VIEW_SEPARATOR)
@@ -1702,6 +2487,23 @@ function labelCandidates(S, pass, regions, out, blocks) {
                 continue;
             }
         }
+        let forceFirstMask = false;
+        if (!schemePass && /s$/i.test(label) && !inQuery(v.start)) {
+            const afterFirst = quoted ? afterClosingQuote(text, v0.end) : v0.end;
+            const tail = commaListTail(S, afterFirst, listIndex());
+            if (tail.items.length > 0) {
+                const spans = [{ start: v.start, end: v.end }, ...tail.items];
+                const flags = listMask(label, spans, false);
+                for (let i = 1; i < spans.length; i++) {
+                    const s = spans[i];
+                    if (s !== undefined && flags[i] === true)
+                        push(s.start, s.end, REDACTED_SECRET);
+                }
+                forceFirstMask = flags[0] === true;
+                skipFrom = afterFirst;
+                skipTo = tail.end;
+            }
+        }
         if (valueIsWholeMarker(S, v.start, v.end, idx.tokenInner)) {
             re.lastIndex = quoted ? from : v.end;
             continue;
@@ -1733,6 +2535,13 @@ function labelCandidates(S, pass, regions, out, blocks) {
             if (a !== -1)
                 v.end = a;
         }
+        if (wrapEnd !== -1 && v.end > wrapEnd)
+            v.end = wrapEnd;
+        if (!schemePass && !quoted && wrapEnd === -1 && !inQuery(v.start) && !/authorizations?$/i.test(label)) {
+            const ext = tokenSchemeValueEnd(text, v.start, v.end, idx);
+            if (ext > v.end)
+                v.end = ext;
+        }
         if (!quoted) {
             const trailing = trailingLabelStart(text, v.start, v.end, idx.tokenInner);
             if (trailing > 0 && innerWordHasValue(text, v.start + trailing, idx)) {
@@ -1757,7 +2566,7 @@ function labelCandidates(S, pass, regions, out, blocks) {
             re.lastIndex = v.end;
             continue;
         }
-        if (!schemePass && isNamedNotValue(label, value)) {
+        if (!schemePass && !forceFirstMask && isNamedNotValue(label, value)) {
             re.lastIndex = v.end;
             continue;
         }
@@ -1795,6 +2604,11 @@ function labelCandidates(S, pass, regions, out, blocks) {
                 const trailing = trailingLabelStart(text, v.start, end, idx.tokenInner);
                 if (trailing !== -1)
                     end = v.start + trailing;
+                if (schemePass && schemeIsLabelValue(text, hit.index)) {
+                    push(v.start, Math.max(end, v.end), REDACTED_SECRET);
+                    re.lastIndex = quoted ? from : Math.max(end, v.end);
+                    continue;
+                }
                 if (gluedToSingleUnit(v.start, hit.index, unitAt) || userinfoHostHidden(text, v.start, unitAt)) {
                     const cut = trailing !== -1 ? end : Math.max(end, v.end);
                     const schemeHit = ADDRESS_SCHEME_RE.exec(text.slice(v.start, v.start + 20))?.[0] ?? '';
@@ -1866,8 +2680,20 @@ function longestAlnumRun(word) {
     return best;
 }
 const JWT_WORD = /^eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}$/;
-const PEM_BEGIN_SOURCE = '-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----';
+const PEM_BEGIN_SOURCE = `${PRIVATE_KEY_PEM_HEADER.source}(?: BLOCK)?-----`;
+const PEM_CASE_FLAGS = PRIVATE_KEY_PEM_HEADER.flags.includes('i') ? 'i' : '';
+const PEM_LEAD = '-----BEGIN';
 const PEM_END_MARK = '-----END';
+function pemEndIndex(text, from) {
+    const re = new RegExp(PEM_END_MARK, `g${PEM_CASE_FLAGS}`);
+    re.lastIndex = from;
+    const m = re.exec(text);
+    return m === null ? -1 : m.index;
+}
+function pemLeadAt(s, at) {
+    const seg = s.slice(at, at + PEM_LEAD.length);
+    return PEM_CASE_FLAGS === 'i' ? seg.toUpperCase() === PEM_LEAD : seg === PEM_LEAD;
+}
 function lineBreakLengthAt(text, at) {
     if (text.startsWith('\r\n', at))
         return 2;
@@ -1971,7 +2797,18 @@ function blockLines(scan, escaped) {
     nextContent[starts.length] = starts.length;
     for (let i = starts.length - 1; i >= 0; i--)
         nextContent[i] = (indent[i] ?? -1) !== -1 ? i : (nextContent[i + 1] ?? starts.length);
-    const built = { starts, ends, indent, nextContent, memo: new Map() };
+    const outOf = new Int32Array(starts.length + 1).fill(starts.length);
+    const stack = [];
+    for (let i = starts.length - 1; i >= 0; i--) {
+        const ind = indent[i] ?? -1;
+        if (ind === -1)
+            continue;
+        while (stack.length > 0 && (indent[stack[stack.length - 1] ?? 0] ?? -1) > ind)
+            stack.pop();
+        outOf[i] = stack.length > 0 ? (stack[stack.length - 1] ?? starts.length) : starts.length;
+        stack.push(i);
+    }
+    const built = { starts, ends, indent, nextContent, outOf, memo: new Map() };
     scan.lines[slot] = built;
     return built;
 }
@@ -2068,11 +2905,11 @@ function pemBodyEndWithoutTrailer(text, from) {
 }
 function pemBlocks(text, soft = () => false) {
     const out = [];
-    if (!text.includes('-----BEGIN'))
+    if (!(PEM_CASE_FLAGS === 'i' ? text.toUpperCase().includes(PEM_LEAD) : text.includes(PEM_LEAD)))
         return out;
     const head = pemHeadView(text, soft);
-    const begin = new RegExp(PEM_BEGIN_SOURCE, 'g');
-    const trailer = /-----END[A-Z0-9 ]*-----/y;
+    const begin = new RegExp(PEM_BEGIN_SOURCE, `g${PEM_CASE_FLAGS}`);
+    const trailer = new RegExp(`${PEM_END_MARK}[A-Z0-9 ]*-----`, `y${PEM_CASE_FLAGS}`);
     let nextEnd = -2;
     for (let b = begin.exec(head); b !== null; b = begin.exec(head)) {
         let bodyStart = b.index + b[0].length;
@@ -2083,7 +2920,7 @@ function pemBlocks(text, soft = () => false) {
             while (bodyStart < text.length && (text[bodyStart] === ' ' || text[bodyStart] === '\t'))
                 bodyStart++;
         if (nextEnd !== -1 && nextEnd < bodyStart)
-            nextEnd = text.indexOf(PEM_END_MARK, bodyStart);
+            nextEnd = pemEndIndex(text, bodyStart);
         let bodyEnd;
         let regionEnd;
         if (nextEnd === -1) {
@@ -2114,8 +2951,8 @@ function pemHeadView(text, soft) {
     return chars === null ? text : chars.join('');
 }
 function pemBeginAt(S, at) {
-    const k = at + '-----BEGIN'.length;
-    return S.text.startsWith('-----BEGIN', at) && (S.text[k] === ' ' || (k < S.text.length && pemSoft(S, k)));
+    const k = at + PEM_LEAD.length;
+    return pemLeadAt(S.text, at) && (S.text[k] === ' ' || (k < S.text.length && pemSoft(S, k)));
 }
 const pemSoft = (S, k) => S.dropped(k) || S.painted(k);
 function pemBlockToRaw(S, blk) {
@@ -2169,6 +3006,90 @@ function authParamEdits(text) {
     }
     return edits;
 }
+const LITERAL_PROBE_WINDOW = 64;
+function gluedLiteralStart(word) {
+    const n = word.length;
+    if (n < PROSE_LITERAL_MIN_RUN + 2)
+        return 0;
+    const runFrom = new Int32Array(n + 1);
+    let best = 0;
+    let run = 0;
+    for (let k = n - 1; k >= 0; k--) {
+        if (isAlnumCode(word.charCodeAt(k))) {
+            run++;
+            if (run > best)
+                best = run;
+        }
+        else
+            run = 0;
+        runFrom[k] = best;
+    }
+    for (let k = 1; k < n; k++) {
+        const left = word.charCodeAt(k - 1);
+        if ((left !== 0x5f && left !== 0x2d) || !isAlnumCode(word.charCodeAt(k)))
+            continue;
+        if ((runFrom[k] ?? 0) < PROSE_LITERAL_MIN_RUN)
+            return 0;
+        if (SECRET_LITERAL_RE.test(word.slice(k, k + LITERAL_PROBE_WINDOW)))
+            return k;
+    }
+    return 0;
+}
+const OPAQUE_MIN_LENGTH = 24;
+const OPAQUE_MIN_ENTROPY = 3.5;
+const OPAQUE_MAX_AVG_SEGMENT = 2.5;
+const BASE64_FILE_SIGNATURES = ['iVBORw0KGgo', 'R0lGOD', 'UklGR', 'JVBERi0', 'UEsDB', 'H4sI', 'PHN2Zy', 'PD94bWwg', 'AAABAA'];
+const NON_SECRET_ID_PREFIXES = new Set(['toolu', 'srvtoolu', 'msg', 'msgbatch', 'req', 'file', 'chatcmpl', 'call', 'resp']);
+function isOpaqueWord(text, i, end) {
+    if (end - i < OPAQUE_MIN_LENGTH)
+        return false;
+    const prev = text.charAt(i - 1);
+    const next = text.charAt(end);
+    if (prev === '+' || prev === '@' || next === '+' || next === '/' || next === '=' || next === '@')
+        return false;
+    if (next === '.' && isKeyWordChar(text.charCodeAt(end + 1)))
+        return false;
+    if (text.slice(Math.max(0, i - 7), i).toLowerCase() === 'base64,')
+        return false;
+    const word = text.slice(i, end);
+    if (/^[0-9A-Fa-f_-]+$/.test(word) || /^sha(?:1|256|384|512)-/i.test(word))
+        return false;
+    if (BASE64_FILE_SIGNATURES.some((sig) => word.startsWith(sig)))
+        return false;
+    const typed = /^([a-z]+)[_-]/.exec(word);
+    if (typed !== null && NON_SECRET_ID_PREFIXES.has(typed[1] ?? ''))
+        return false;
+    let upper = false;
+    let lower = false;
+    let digit = false;
+    const counts = new Map();
+    for (let k = 0; k < word.length; k++) {
+        const c = word.charCodeAt(k);
+        if (c >= 0x41 && c <= 0x5a)
+            upper = true;
+        else if (c >= 0x61 && c <= 0x7a)
+            lower = true;
+        else if (c >= 0x30 && c <= 0x39)
+            digit = true;
+        counts.set(c, (counts.get(c) ?? 0) + 1);
+    }
+    if (!upper || !lower || !digit)
+        return false;
+    let entropy = 0;
+    for (const n of counts.values()) {
+        const p = n / word.length;
+        entropy -= p * Math.log2(p);
+    }
+    if (entropy < OPAQUE_MIN_ENTROPY)
+        return false;
+    let segments = 0;
+    let segmentChars = 0;
+    for (const m of word.matchAll(/[A-Z]?[a-z]+|[A-Z]+(?![a-z])|[0-9]+/g)) {
+        segments++;
+        segmentChars += m[0].length;
+    }
+    return segments > 0 && segmentChars / segments <= OPAQUE_MAX_AVG_SEGMENT;
+}
 function proseLiteralEdits(text) {
     const edits = [];
     let i = 0;
@@ -2203,6 +3124,13 @@ function proseLiteralEdits(text) {
         if (!pathish && SECRET_LITERAL_RE.test(word) && longestAlnumRun(word) >= PROSE_LITERAL_MIN_RUN) {
             pushEdit(edits, text, i, end, REDACTED_SECRET);
         }
+        else if (!pathish) {
+            const glued = gluedLiteralStart(word);
+            if (glued > 0)
+                pushEdit(edits, text, i + glued, end, REDACTED_SECRET);
+            else if (!hostSlot && isOpaqueWord(text, i, end))
+                pushEdit(edits, text, i, end, REDACTED_SECRET);
+        }
         i = end;
     }
     return edits;
@@ -3451,6 +4379,10 @@ export function displayUntrusted(text, opts = {}) {
     const out = renderUntrusted(text, opts, null);
     return typeof out === 'string' ? out : out.text;
 }
+export function quoteUntrustedForSentence(text, max) {
+    const shown = displayUntrusted(text, { max, blanks: true, escapeBackslashes: true });
+    return shown.trim() === '' ? undefined : `"${shown.replace(/"/g, '\\"')}"`;
+}
 export function displayUntrustedMarks(text, opts = {}) {
     const ledger = { cps: [], lens: [] };
     const out = renderUntrusted(text, opts, ledger);
@@ -3458,3 +4390,4 @@ export function displayUntrustedMarks(text, opts = {}) {
         return { text: out, marks: [] };
     return { text: out.text, marks: collectMarks(out, ledger) };
 }
+const isQuoteChar = (c) => c.charCodeAt(0) === 0x22 || c.charCodeAt(0) === 0x27;