@sema-agent/client-core 0.94.0 → 0.96.0

package/dist/displayUntrusted.js

@@ -38,18 +38,12 @@ function scanForSecretLiteral(s) {
         return true;
     return s.split(/[^A-Za-z0-9_-]+/).some(tok => tok !== '' && SECRET_LITERAL_RE.test(tok));
 }
-function decodeAsciiEscapes(s) {
-    return s.replace(/%[0-9A-Fa-f]{2}/g, esc => {
-        const code = Number.parseInt(esc.slice(1), 16);
-        return code < 0x80 ? String.fromCharCode(code) : esc;
-    });
-}
 export function looksLikeKnownSecret(s) {
     let cur = s;
     for (let layer = 0; layer < 4; layer++) {
         if (scanForSecretLiteral(cur))
             return true;
-        const next = decodeAsciiEscapes(cur);
+        const next = percentDecodeForMatching(cur).decoded;
         if (next === cur)
             break;
         cur = next;
@@ -103,8 +97,8 @@ function valueIsWholeMarker(S, start, end, tokenInner = true) {
     return j >= end || !isKeyWordChar(text.charCodeAt(j)) || credentialWordStartsExactlyAt(text, j, tokenInner) || credentialPairAt(S, j);
 }
 const CREDENTIAL_NAME = /(?:(?:access|refresh|id|client|api|x[-_]api|session|auth)[-_]?)?(?:token|key|secret|password|authorization|credential)s?|bearer|basic/iy;
-const LABEL_SEPARATOR = /(?:\\*["'])?[\s\u115F\u1160\u3164\uFFA0\u2800]*[:=\uFF1A\uFF1D]/y;
-const SCHEME_SEPARATOR = /[\s:=\uFF1A\uFF1D\u115F\u1160\u3164\uFFA0\u2800]/y;
+const LABEL_SEPARATOR = /(?:\\*["'])?(?:[\s\u115F\u1160\u3164\uFFA0\u2800]|\\t)*[:=\uFF1A\uFF1D]/y;
+const SCHEME_SEPARATOR = /(?:[\s:=\uFF1A\uFF1D\u115F\u1160\u3164\uFFA0\u2800]|\\t)/y;
 function credentialPairAt(S, at) {
     const text = S.text;
     const re = new RegExp(CREDENTIAL_NAME.source, 'iy');
@@ -261,21 +255,23 @@ function isKnownSecretSegment(value) {
     const core = valueCoreForJudging(value);
     return core.length > 0 && looksLikeKnownSecret(core);
 }
-function queryCandidates(src, base, query, edits, soft) {
+function queryCandidates(src, base, query, edits, soft, byShape = false) {
+    const relax = byShape === 'relaxed';
     let pos = base;
     for (const part of query.split('&')) {
         if (part.length > 0) {
             const eq = part.indexOf('=');
             if (eq === -1) {
                 const at = pos;
-                if (!slotIsWholeMarker(part, soft && ((i) => soft(at + i))))
+                if (!slotIsWholeMarker(part, soft && ((i) => soft(at + i))) && (!byShape || queryPartCarriesCredential(null, part, relax)))
                     pushEdit(edits, src, pos, pos + part.length, REDACTED_QUERY);
             }
             else {
                 const value = part.slice(eq + 1);
                 const at = pos + eq + 1;
-                if (value.length > 0 && !slotIsWholeMarker(value, soft && ((i) => soft(at + i))))
+                if (value.length > 0 && !slotIsWholeMarker(value, soft && ((i) => soft(at + i))) && (!byShape || queryPartCarriesCredential(part.slice(0, eq), value, relax))) {
                     pushEdit(edits, src, pos + eq + 1, pos + part.length, REDACTED_QUERY);
+                }
             }
         }
         pos += part.length + 1;
@@ -286,15 +282,22 @@ function pathCandidates(src, base, path, opaqueSegments, edits, soft) {
     for (const segment of path.split('/')) {
         const semi = segment.indexOf(';');
         const head = semi === -1 ? segment : segment.slice(0, semi);
-        if (opaqueSegments && isKnownSecretSegment(head)) {
+        if (opaqueSegments) {
             let a = 0;
             let b = head.length;
             while (a < b && !isKeyWordChar(head.charCodeAt(a)))
                 a++;
             while (b > a && !isKeyWordChar(head.charCodeAt(b - 1)))
                 b--;
-            if (b > a)
-                pushEdit(edits, src, pos + a, pos + b, REDACTED_SECRET);
+            if (isKnownSecretSegment(head)) {
+                if (b > a)
+                    pushEdit(edits, src, pos + a, pos + b, REDACTED_SECRET);
+            }
+            else if (b > a) {
+                const glued = gluedLiteralStart(head.slice(a, b));
+                if (glued > 0)
+                    pushEdit(edits, src, pos + a + glued, pos + b, REDACTED_SECRET);
+            }
         }
         if (semi !== -1) {
             let ppos = pos + semi + 1;
@@ -312,7 +315,7 @@ function pathCandidates(src, base, path, opaqueSegments, edits, soft) {
         pos += segment.length + 1;
     }
 }
-function urlTokenCandidatesAt(src, start, end, edits, soft) {
+function urlTokenCandidatesAt(src, start, end, edits, soft, byShape = false) {
     const token = src.slice(start, end);
     const schemeEnd = token.indexOf('://') + '://'.length;
     const scheme = token.slice(0, schemeEnd);
@@ -330,7 +333,7 @@ function urlTokenCandidatesAt(src, start, end, edits, soft) {
     const path = question === -1 ? beforeHash : beforeHash.slice(0, question);
     pathCandidates(src, start + tailStart, path, !/^file:/i.test(scheme), edits, soft);
     if (question !== -1)
-        queryCandidates(src, start + tailStart + question + 1, beforeHash.slice(question + 1), edits, soft);
+        queryCandidates(src, start + tailStart + question + 1, beforeHash.slice(question + 1), edits, soft, byShape);
     if (hash !== -1) {
         const rawFragment = tail.slice(hash + 1);
         const at = start + tailStart + hash + 1;
@@ -338,7 +341,7 @@ function urlTokenCandidatesAt(src, start, end, edits, soft) {
             pushEdit(edits, src, start + tailStart + hash + 1, end, REDACTED_FRAGMENT);
     }
 }
-function urlCandidates(text, out, regions, unitPos = () => false, soft) {
+function urlCandidates(text, out, regions, unitPos = () => false, soft, byShape = false) {
     let mark = text.indexOf('://');
     while (mark !== -1) {
         let start = mark;
@@ -401,8 +404,9 @@ function urlCandidates(text, out, regions, unitPos = () => false, soft) {
             runStart--;
         if (runStart < end && !VALUE_BOUNDARY_TAIL.test(text.slice(start, runStart)))
             end = runStart;
+        end = trailingCloserEnd(text, start, mark + 3, end, unitPos);
         const tokenEdits = [];
-        urlTokenCandidatesAt(text, start, end, tokenEdits, soft);
+        urlTokenCandidatesAt(text, start, end, tokenEdits, soft, byShape);
         editsToCandidates(tokenEdits, 'url', out, end);
         const token = text.slice(start, end);
         const schemeEnd = token.indexOf('://') + 3;
@@ -420,6 +424,47 @@ function urlCandidates(text, out, regions, unitPos = () => false, soft) {
         mark = text.indexOf('://', end > mark + 3 ? end : mark + 3);
     }
 }
+function trailingCloserEnd(text, start, floor, end, unitPos) {
+    const opens = new Map();
+    const closes = new Map();
+    for (const [o, c] of BRACKET_PAIRS) {
+        opens.set(o, 0);
+        closes.set(c, 0);
+    }
+    for (let k = start; k < end; k++) {
+        if (unitPos(k))
+            continue;
+        const ch = text.charAt(k);
+        const o = opens.get(ch);
+        if (o !== undefined)
+            opens.set(ch, o + 1);
+        const c = closes.get(ch);
+        if (c !== undefined)
+            closes.set(ch, c + 1);
+    }
+    let e = end;
+    for (;;) {
+        if (e <= floor || unitPos(e - 1))
+            return e;
+        const ch = text.charAt(e - 1);
+        const c = closes.get(ch);
+        if (c === undefined)
+            return e;
+        let open = '';
+        for (const [o, cl] of BRACKET_PAIRS)
+            if (cl === ch)
+                open = o;
+        if (c <= (opens.get(open) ?? 0))
+            return e;
+        closes.set(ch, c - 1);
+        e--;
+        let runStart = e;
+        while (runStart > floor && TRAILING_PUNCTUATION.has(text.charAt(runStart - 1)))
+            runStart--;
+        if (runStart < e && !VALUE_BOUNDARY_TAIL.test(text.slice(start, runStart)))
+            e = runStart;
+    }
+}
 function atInAuthority(text, from) {
     for (let p = from; p < text.length; p++) {
         const ch = text.charAt(p);
@@ -763,9 +808,17 @@ const NAME_BLANK_RANGES = [
 const isNameBlank = (cp) => NAME_BLANK_RANGES.some(([a, b]) => cp >= a && cp <= b);
 const isFoldedBlank = (c) => isNameBlank(c) && isRegexSpace(c);
 const isUnicodeBlank = (c) => (c > 0x7f && isRegexSpace(c) && c !== 0xfeff) || isNameBlank(c);
-const SECRET_SCHEME_WORD = /(?:\b|(?<=\\[A-Za-z"']))(bearer|basic|token)[\s:=\uFF1A\uFF1D\u115F\u1160\u3164\uFFA0\u2800]+/gi;
+const SECRET_SCHEME_WORD = /(?:\b|(?<=\\[A-Za-z"']))(?!(?<=(?<!\\)\\)(?:bearer|basic|token)\\t)(bearer|basic|token)(?:[\s:=\uFF1A\uFF1D\u115F\u1160\u3164\uFFA0\u2800]|\\t)+/gi;
+const SCHEME_LEFT_STRICT = String.raw `(?:\b|(?<=\\[A-Za-z"']))`;
+const SCHEME_WORD_OUTER_SOURCE = widenLeft(SECRET_SCHEME_WORD.source, SCHEME_LEFT_STRICT, String.raw `(?=bearer|basic)`);
 const schemeWordIsInner = (word, tokenInner) => tokenInner || word.toLowerCase() !== 'token';
-const SECRET_LABELLED_WORD = /(?:\b|(?<=_)|(?<=\\[A-Za-z"']))((?:access[-_ ]?|refresh[-_ ]?|id[-_ ]?|client[-_ ]?|api[-_ ]?|x[-_]api[-_ ]?|session[-_ ]?|auth[-_ ]?)?(?:token|key|secret|password|authorization|credential)s?)(?:\\*["'])?[\s\u115F\u1160\u3164\uFFA0\u2800]*[:=\uFF1A\uFF1D][\s\u115F\u1160\u3164\uFFA0\u2800]*/gi;
+const SECRET_LABELLED_WORD = /(?:\b|(?<=_)|(?<=\\[A-Za-z"']))((?:access[-_ ]?|refresh[-_ ]?|id[-_ ]?|client[-_ ]?|api[-_ ]?|x[-_]api[-_ ]?|session[-_ ]?|auth[-_ ]?)?(?:token|key|secret|password|authorization|credential)s?)(?:\\*["'])?(?:[\s\u115F\u1160\u3164\uFFA0\u2800]|\\t)*[:=\uFF1A\uFF1D](?:[\s\u115F\u1160\u3164\uFFA0\u2800]|\\t)*/gi;
+function widenLeft(source, strictLeft, extraAlt) {
+    return source.startsWith(strictLeft) ? `${strictLeft.slice(0, -1)}|${extraAlt})${source.slice(strictLeft.length)}` : source;
+}
+const LABEL_LEFT_STRICT = String.raw `(?:\b|(?<=_)|(?<=\\[A-Za-z"']))`;
+const LABEL_LEFT_GLUED_ALT = String.raw `(?<=[A-Za-z0-9])(?:(?=(?:token|secret|password|authorization|credential)(?!s))|(?<!mon|tur|don|hoc|whis|joc|lac)(?=key(?!s)))`;
+const LABEL_WORD_OUTER_SOURCE = widenLeft(SECRET_LABELLED_WORD.source, LABEL_LEFT_STRICT, LABEL_LEFT_GLUED_ALT);
 const DIAGNOSTIC_VALUE_WORDS = new Set([
     'missing', 'required', 'invalid', 'expired', 'unauthorized', 'unauthenticated', 'authentication',
     'authorization', 'credential', 'credentials', 'unsupported', 'malformed', 'rejected', 'absent',
@@ -820,18 +873,67 @@ const AUTH_SCHEME_WORDS = new Set([
 const AUTH_SIGNATURE_SCHEME = /^[A-Z][A-Z0-9]*(?:-[A-Z0-9]+){2,}$/;
 const BARE_VALUE_STOP_CHARS = new Set([',', ';', '"', "'", '\\', '(', ')', '[', ']', '{', '}', '<', '>']);
 const isBareValueStop = (ch) => ch <= ' ' || BARE_VALUE_STOP_CHARS.has(ch);
+function isPlainAt(S, rawUnit, k) {
+    if (S.dropped(k) || S.painted(k) || S.unitAt(k) !== UNIT_NONE)
+        return false;
+    return rawUnit === null || rawUnit[S.rawStart(k)] !== 1;
+}
+function codeSpanClose(text, plain) {
+    const n = text.length;
+    const close = new Int32Array(n + 1).fill(-1);
+    let openLen = 0;
+    let spanFrom = -1;
+    let k = 0;
+    while (k < n) {
+        const c = text.charCodeAt(k);
+        if (c === 0x0a || c === 0x0d || c === 0x2028 || c === 0x2029) {
+            openLen = 0;
+            spanFrom = -1;
+            k++;
+            continue;
+        }
+        if (c !== 0x60 || !plain(k)) {
+            k++;
+            continue;
+        }
+        let e = k;
+        while (e < n && text.charCodeAt(e) === 0x60 && plain(e))
+            e++;
+        const len = e - k;
+        if (openLen === 0) {
+            openLen = len;
+            spanFrom = e;
+        }
+        else if (len === openLen) {
+            for (let x = spanFrom; x < k; x++)
+                close[x] = k;
+            openLen = 0;
+            spanFrom = -1;
+        }
+        k = e;
+    }
+    return close;
+}
+const BRACKET_PAIRS = new Map([['(', ')'], ['[', ']']]);
 class InnerWordIndex {
     text;
     tokenInner;
     probes;
-    constructor(text, tokenInner = true) {
+    plain;
+    spanClose = null;
+    constructor(text, tokenInner = true, plain = () => true) {
         this.text = text;
         this.tokenInner = tokenInner;
+        this.plain = plain;
         this.probes = [
             { re: new RegExp(SECRET_LABELLED_WORD.source, SECRET_LABELLED_WORD.flags), scheme: false, from: -1, hit: null },
             { re: new RegExp(SECRET_SCHEME_WORD.source, SECRET_SCHEME_WORD.flags), scheme: true, from: -1, hit: null },
         ];
     }
+    closingTickFrom(i) {
+        this.spanClose ??= codeSpanClose(this.text, this.plain);
+        return this.spanClose[i] ?? -1;
+    }
     next(q) {
         let best = null;
         for (const p of this.probes) {
@@ -857,6 +959,45 @@ class InnerWordIndex {
         return best;
     }
 }
+const WRAPPED_PLACEHOLDER = /^(?:[A-Z]{1,12}(?:_[A-Z]{1,12})*|[a-z]{1,12}(?:-[a-z]{1,12})*)$/;
+function wrappedValueAt(text, from, idx) {
+    let k = from;
+    while (k < text.length && text[k] === VIEW_SEPARATOR)
+        k++;
+    const close = BRACKET_PAIRS.get(text.charAt(k));
+    if (close === undefined || credentialWordStartsAt(text, k + 1, idx.tokenInner))
+        return null;
+    const inner = scanSecretValue(text, k + 1, idx);
+    if (inner === null || inner.start !== k + 1)
+        return null;
+    let c = inner.end;
+    while (c < text.length && text[c] === VIEW_SEPARATOR)
+        c++;
+    if (text.charAt(c) !== close || (close === ']' && text.charAt(c + 1) === '('))
+        return null;
+    return inner;
+}
+function tokenSchemeValueEnd(text, start, end, idx) {
+    if (withoutSeparators(text.slice(start, end)).toLowerCase() !== 'token')
+        return -1;
+    const re = new RegExp(SECRET_SCHEME_WORD.source, 'iy');
+    re.lastIndex = start;
+    const m = re.exec(text);
+    if (m === null || (m[1] ?? '').toLowerCase() !== 'token')
+        return -1;
+    const sepEnd = start + m[0].length;
+    if (/[\n\r\u2028\u2029:=\uFF1A\uFF1D]/.test(text.slice(start + (m[1] ?? '').length, sepEnd)))
+        return -1;
+    if (credentialWordStartsAt(text, sepEnd, idx.tokenInner))
+        return -1;
+    const iv = scanSecretValue(text, sepEnd, idx);
+    if (iv === null)
+        return -1;
+    const inner = withoutSeparators(text.slice(iv.start, iv.end));
+    if (schemeFollowerReleased('token', inner, false) || isDiagnosticWord(inner))
+        return -1;
+    return iv.end;
+}
 function innerWordFits(text, w) {
     for (let k = w.start; k <= w.sepAt && k < text.length; k++)
         if (isBareValueStop(text.charAt(k)))
@@ -912,6 +1053,7 @@ function scanSecretValue(text, from, idx) {
     let pending = cuttable ? idx.next(i + 1) : null;
     let cut = false;
     let j = i;
+    const closingTick = idx === undefined ? -1 : idx.closingTickFrom(i);
     while (j < text.length) {
         if (pending !== null && j >= pending.start) {
             if (j === pending.start && innerWordFits(text, pending)) {
@@ -936,6 +1078,18 @@ function scanSecretValue(text, from, idx) {
     }
     while (j > i && text[j - 1] === VIEW_SEPARATOR)
         j--;
+    if (closingTick > i && closingTick < j) {
+        let t = closingTick;
+        while (t < j && text.charCodeAt(t) === 0x60)
+            t++;
+        while (t < j && TRAILING_PUNCTUATION.has(text.charAt(t)))
+            t++;
+        if (t === j && text.charCodeAt(closingTick) === 0x60) {
+            j = closingTick;
+            while (j > i && text[j - 1] === VIEW_SEPARATOR)
+                j--;
+        }
+    }
     if (cut) {
         while (j > i && isCutDelimiter(text.charAt(j - 1))) {
             j--;
@@ -955,6 +1109,9 @@ function isDiagnosticValue(value, raw = value) {
         return true;
     if (ADDRESS_SCHEME_RE.test(raw))
         return true;
+    return isDiagnosticWord(value);
+}
+function isDiagnosticWord(value) {
     const bare = value.replace(/^\.+/, '').replace(/[.,;:!?)\]}'"]{0,8}$/, '').toLowerCase();
     return bare === '' || DIAGNOSTIC_VALUE_WORDS.has(bare);
 }
@@ -1014,6 +1171,26 @@ function isNamedNotValue(label, value) {
         return true;
     return isBacktickedCredentialName(value);
 }
+function schemeIsLabelValue(text, at) {
+    let k = at;
+    while (k > 0 && text[k - 1] === VIEW_SEPARATOR)
+        k--;
+    if (k > 0 && isQuoteChar(text.charAt(k - 1))) {
+        k--;
+        while (k > 0 && text.charCodeAt(k - 1) === 0x5c)
+            k--;
+    }
+    return k > 0 && labelEndsAt(text, k);
+}
+function labelQuotedAt(text, at, sep) {
+    const q = text.charAt(at - 1);
+    if (!isQuoteChar(q))
+        return false;
+    let k = 0;
+    while (sep.charCodeAt(k) === 0x5c)
+        k++;
+    return sep.charAt(k) === q;
+}
 function labelStartsAt(text, at) {
     const re = new RegExp(SECRET_LABELLED_WORD.source, 'iy');
     re.lastIndex = at;
@@ -1093,6 +1270,35 @@ function percentDecodeForMatching(text) {
     offsets.push(text.length);
     return { decoded: chars.join(''), offsets };
 }
+const PERCENT_ESCAPE_ASCII = /%[0-7][0-9A-Fa-f]/;
+const MAX_PERCENT_VIEW_LAYERS = 3;
+function percentLayers(text) {
+    const out = [];
+    if (!PERCENT_ESCAPE_ASCII.test(text))
+        return out;
+    let cur = text;
+    let ps = null;
+    let pe = null;
+    for (let layer = 0; layer < MAX_PERCENT_VIEW_LAYERS; layer++) {
+        const { decoded, offsets } = percentDecodeForMatching(cur);
+        if (decoded === cur)
+            break;
+        const n = decoded.length;
+        const nps = new Int32Array(n);
+        const npe = new Int32Array(n);
+        for (let k = 0; k < n; k++) {
+            const a = offsets[k] ?? 0;
+            const b = offsets[k + 1] ?? cur.length;
+            nps[k] = ps === null ? a : (ps[a] ?? 0);
+            npe[k] = pe === null ? b : (pe[b - 1] ?? 0);
+        }
+        out.push({ text: decoded, ps: nps, pe: npe });
+        cur = decoded;
+        ps = nps;
+        pe = npe;
+    }
+    return out;
+}
 function firstLabelCutInPath(path) {
     let cut = -1;
     for (const src of [SECRET_SCHEME_WORD, SECRET_LABELLED_WORD]) {
@@ -1347,7 +1553,7 @@ function quoteSwallowedBefore(S, at) {
         return '';
     return dq === -1 ? "'" : sq === -1 ? '"' : dq < sq ? '"' : "'";
 }
-function labelEndsAt(text, end, atLeast = false) {
+function labelEndsAt(text, end, atLeast = false, outer = false) {
     let k = end;
     while (k > 0 && isRegexSpace(text.charCodeAt(k - 1)))
         k--;
@@ -1366,7 +1572,7 @@ function labelEndsAt(text, end, atLeast = false) {
     let w = k;
     while (w > 0 && isIdentOrDash(text.charAt(w - 1)))
         w--;
-    const re = new RegExp(SECRET_LABELLED_WORD.source, 'iy');
+    const re = new RegExp(outer ? LABEL_WORD_OUTER_SOURCE : SECRET_LABELLED_WORD.source, 'iy');
     for (let s = w; s < k; s++) {
         re.lastIndex = s;
         const m = re.exec(text);
@@ -1924,15 +2130,19 @@ function blockSeqEntries(scan, rawFrom, rawLabel) {
     }
     return out;
 }
-function labelCandidates(S, pass, regions, out, blocks) {
+function labelCandidates(S, pass, regions, out, blocks, outer = false) {
     const text = S.text;
     const unitAt = (k) => S.unitAt(k);
-    const re = pass === 'label' ? SECRET_LABELLED_WORD : SECRET_SCHEME_WORD;
+    const strictSource = pass === 'label' ? SECRET_LABELLED_WORD.source : SECRET_SCHEME_WORD.source;
+    const re = new RegExp(outer ? (pass === 'label' ? LABEL_WORD_OUTER_SOURCE : SCHEME_WORD_OUTER_SOURCE) : strictSource, 'gi');
+    const strictAt = outer ? new RegExp(strictSource, 'iy') : null;
     const schemePass = pass !== 'label';
     const tokenPass = pass === 'token';
-    const idx = new InnerWordIndex(text, tokenPass);
+    const rawUnitMap = blocks?.view.rawUnit ?? null;
+    const plainAt = (k) => isPlainAt(S, rawUnitMap, k);
+    const idx = new InnerWordIndex(text, tokenPass, plainAt);
     let listIdx = null;
-    const listIndex = () => (listIdx ??= new InnerWordIndex(text, idx.tokenInner));
+    const listIndex = () => (listIdx ??= new InnerWordIndex(text, idx.tokenInner, plainAt));
     let skipFrom = -1;
     let skipTo = -1;
     const flowBudget = { left: 4 * text.length + 4096, pairs: null };
@@ -2171,6 +2381,11 @@ function labelCandidates(S, pass, regions, out, blocks) {
     re.lastIndex = 0;
     hits: for (let hit = re.exec(text); hit !== null; hit = re.exec(text)) {
         const label = hit[1] ?? '';
+        if (strictAt !== null) {
+            strictAt.lastIndex = hit.index;
+            if (strictAt.test(text))
+                continue;
+        }
         if (hit.index >= skipFrom && hit.index < skipTo)
             continue;
         if (schemePass && (label.toLowerCase() === 'token') !== tokenPass)
@@ -2182,6 +2397,16 @@ function labelCandidates(S, pass, regions, out, blocks) {
         if (schemePass && labelStartsAt(text, hit.index))
             continue;
         let from = hit.index + hit[0].length;
+        if (!schemePass && text.charCodeAt(from) === 0x3e && text.charCodeAt(from - 1) === 0x3d && labelQuotedAt(text, hit.index, hit[0].slice(label.length))) {
+            let k = from + 1;
+            while (k < text.length && isInlineBlank(text.charAt(k)))
+                k++;
+            let q = k;
+            while (text.charCodeAt(q) === 0x5c)
+                q++;
+            if (isQuoteChar(text.charAt(q)))
+                from = k;
+        }
         const colonSep = isColonSeparator(hit[0].slice((hit[1] ?? '').length));
         let bulletSkipped = false;
         for (;;) {
@@ -2244,6 +2469,16 @@ function labelCandidates(S, pass, regions, out, blocks) {
             }
         }
         let v0s = scanSecretValue(text, from, idx);
+        let wrapEnd = -1;
+        if (v0s === null) {
+            const w = wrappedValueAt(text, from, idx);
+            if (w !== null) {
+                if (WRAPPED_PLACEHOLDER.test(withoutSeparators(text.slice(w.start, w.end))))
+                    continue;
+                v0s = w;
+                wrapEnd = w.end;
+            }
+        }
         if (v0s === null) {
             let k = from;
             while (k < text.length && text[k] === VIEW_SEPARATOR)
@@ -2340,6 +2575,13 @@ function labelCandidates(S, pass, regions, out, blocks) {
             if (a !== -1)
                 v.end = a;
         }
+        if (wrapEnd !== -1 && v.end > wrapEnd)
+            v.end = wrapEnd;
+        if (!schemePass && !quoted && wrapEnd === -1 && !inQuery(v.start) && !/authorizations?$/i.test(label)) {
+            const ext = tokenSchemeValueEnd(text, v.start, v.end, idx);
+            if (ext > v.end)
+                v.end = ext;
+        }
         if (!quoted) {
             const trailing = trailingLabelStart(text, v.start, v.end, idx.tokenInner);
             if (trailing > 0 && innerWordHasValue(text, v.start + trailing, idx)) {
@@ -2402,6 +2644,11 @@ function labelCandidates(S, pass, regions, out, blocks) {
                 const trailing = trailingLabelStart(text, v.start, end, idx.tokenInner);
                 if (trailing !== -1)
                     end = v.start + trailing;
+                if (schemePass && schemeIsLabelValue(text, hit.index)) {
+                    push(v.start, Math.max(end, v.end), REDACTED_SECRET);
+                    re.lastIndex = quoted ? from : Math.max(end, v.end);
+                    continue;
+                }
                 if (gluedToSingleUnit(v.start, hit.index, unitAt) || userinfoHostHidden(text, v.start, unitAt)) {
                     const cut = trailing !== -1 ? end : Math.max(end, v.end);
                     const schemeHit = ADDRESS_SCHEME_RE.exec(text.slice(v.start, v.start + 20))?.[0] ?? '';
@@ -2458,6 +2705,19 @@ function isAuthScheme(value) {
 const isKeyWordChar = (c) => (c >= 0x30 && c <= 0x39) || (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a) || c === 0x5f || c === 0x2d;
 const isAlnumCode = (c) => (c >= 0x30 && c <= 0x39) || (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a);
 const PROSE_LITERAL_MIN_RUN = 16;
+const PROSE_SHORT_LITERAL_MIN_TAIL = 6;
+function shortLiteralTail(word) {
+    const lit = SECRET_LITERAL_RE.exec(word);
+    if (lit === null)
+        return false;
+    const tail = word.slice(lit[0].length);
+    if (tail.length < PROSE_SHORT_LITERAL_MIN_TAIL)
+        return false;
+    for (let k = 0; k < tail.length; k++)
+        if (!isAlnumCode(tail.charCodeAt(k)))
+            return false;
+    return true;
+}
 function longestAlnumRun(word) {
     let best = 0;
     let run = 0;
@@ -2799,8 +3059,112 @@ function authParamEdits(text) {
     }
     return edits;
 }
+const LITERAL_PROBE_WINDOW = 64;
+function gluedLiteralStart(word) {
+    const n = word.length;
+    if (n < PROSE_SHORT_LITERAL_MIN_TAIL + 4)
+        return 0;
+    const runFrom = new Int32Array(n + 1);
+    let best = 0;
+    let run = 0;
+    for (let k = n - 1; k >= 0; k--) {
+        if (isAlnumCode(word.charCodeAt(k))) {
+            run++;
+            if (run > best)
+                best = run;
+        }
+        else
+            run = 0;
+        runFrom[k] = best;
+    }
+    for (let k = 1; k < n; k++) {
+        const left = word.charCodeAt(k - 1);
+        if ((left !== 0x5f && left !== 0x2d) || !isAlnumCode(word.charCodeAt(k)))
+            continue;
+        const run = runFrom[k] ?? 0;
+        if (run < PROSE_SHORT_LITERAL_MIN_TAIL)
+            return 0;
+        if (SECRET_LITERAL_RE.test(word.slice(k, k + LITERAL_PROBE_WINDOW)) && (run >= PROSE_LITERAL_MIN_RUN || shortLiteralTail(word.slice(k))))
+            return k;
+    }
+    return 0;
+}
+const OPAQUE_MIN_LENGTH = 24;
+const OPAQUE_MIN_ENTROPY = 3.5;
+const OPAQUE_MAX_AVG_SEGMENT = 2.5;
+const BASE64_FILE_SIGNATURES = ['iVBORw0KGgo', 'R0lGOD', 'UklGR', 'JVBERi0', 'UEsDB', 'H4sI', 'PHN2Zy', 'PD94bWwg', 'AAABAA'];
+const NON_SECRET_ID_PREFIXES = new Set(['toolu', 'srvtoolu', 'msg', 'msgbatch', 'req', 'file', 'chatcmpl', 'call', 'resp']);
+function isOpaqueWord(text, i, end) {
+    if (end - i < OPAQUE_MIN_LENGTH)
+        return false;
+    const prev = text.charAt(i - 1);
+    const next = text.charAt(end);
+    if (prev === '+' || prev === '@' || next === '+' || next === '/' || next === '=' || next === '@')
+        return false;
+    if (next === '.' && isKeyWordChar(text.charCodeAt(end + 1)))
+        return false;
+    if (text.slice(Math.max(0, i - 7), i).toLowerCase() === 'base64,')
+        return false;
+    const word = text.slice(i, end);
+    if (/^[0-9A-Fa-f_-]+$/.test(word) || /^sha(?:1|256|384|512)-/i.test(word))
+        return false;
+    if (BASE64_FILE_SIGNATURES.some((sig) => word.startsWith(sig)))
+        return false;
+    const typed = /^([a-z]+)[_-]/.exec(word);
+    if (typed !== null && NON_SECRET_ID_PREFIXES.has(typed[1] ?? ''))
+        return false;
+    let upper = false;
+    let lower = false;
+    let digit = false;
+    const counts = new Map();
+    for (let k = 0; k < word.length; k++) {
+        const c = word.charCodeAt(k);
+        if (c >= 0x41 && c <= 0x5a)
+            upper = true;
+        else if (c >= 0x61 && c <= 0x7a)
+            lower = true;
+        else if (c >= 0x30 && c <= 0x39)
+            digit = true;
+        counts.set(c, (counts.get(c) ?? 0) + 1);
+    }
+    if (!upper || !lower || !digit)
+        return false;
+    let entropy = 0;
+    for (const n of counts.values()) {
+        const p = n / word.length;
+        entropy -= p * Math.log2(p);
+    }
+    if (entropy < OPAQUE_MIN_ENTROPY)
+        return false;
+    let segments = 0;
+    let segmentChars = 0;
+    for (const m of word.matchAll(/[A-Z]?[a-z]+|[A-Z]+(?![a-z])|[0-9]+/g)) {
+        segments++;
+        segmentChars += m[0].length;
+    }
+    return segments > 0 && segmentChars / segments <= OPAQUE_MAX_AVG_SEGMENT;
+}
+const FILE_URL_OPENERS = new Set(['(', '[', '<', "'", ',', ';']);
+function fileUrlPositions(text) {
+    let marks = null;
+    const re = /file:/gi;
+    for (let hit = re.exec(text); hit !== null; hit = re.exec(text)) {
+        const s = hit.index;
+        if (s > 0 && !endsUrlFragmentAt(text, s - 1) && !FILE_URL_OPENERS.has(text.charAt(s - 1)))
+            continue;
+        let e = s + hit[0].length;
+        while (e < text.length && !endsUrlFragmentAt(text, e))
+            e++;
+        marks ??= new Uint8Array(text.length);
+        for (let k = s; k < e; k++)
+            marks[k] = 1;
+        re.lastIndex = e;
+    }
+    return marks;
+}
 function proseLiteralEdits(text) {
     const edits = [];
+    let fileAt;
     let i = 0;
     while (i < text.length) {
         const c = text.charCodeAt(i);
@@ -2811,6 +3175,7 @@ function proseLiteralEdits(text) {
         let end = i;
         while (end < text.length && isKeyWordChar(text.charCodeAt(end)))
             end++;
+        const escHead = i > 0 && text.charCodeAt(i - 1) === 0x25 && PERCENT_ESCAPE_ASCII.test(text.slice(i - 1, i + 2)) && i + 2 < end ? 2 : 0;
         const word = text.slice(i, end);
         if (word.startsWith('eyJ')) {
             let segEnd = end;
@@ -2829,15 +3194,33 @@ function proseLiteralEdits(text) {
         }
         const prev = i > 0 ? text.charAt(i - 1) : '';
         const hostSlot = prev === '/' && i > 1 && text.charAt(i - 2) === '/';
-        const pathish = (prev === '/' && !hostSlot) || prev === '\\' || prev === '.';
-        if (!pathish && SECRET_LITERAL_RE.test(word) && longestAlnumRun(word) >= PROSE_LITERAL_MIN_RUN) {
-            pushEdit(edits, text, i, end, REDACTED_SECRET);
+        const slashSegment = prev === '/' && !hostSlot;
+        if (slashSegment && fileAt === undefined)
+            fileAt = fileUrlPositions(text);
+        const localPath = prev === '\\' || prev === '.' || (slashSegment && fileAt != null && fileAt[i] === 1);
+        const pathish = slashSegment || localPath;
+        if (!localPath && SECRET_LITERAL_RE.test(word) && (longestAlnumRun(word) >= PROSE_LITERAL_MIN_RUN || shortLiteralTail(word))) {
+            pushEdit(edits, text, i + escHead, end, REDACTED_SECRET);
+        }
+        else if (!localPath) {
+            const glued = gluedLiteralStart(word);
+            if (glued > 0)
+                pushEdit(edits, text, i + Math.max(glued, escHead), end, REDACTED_SECRET);
+            else if (!pathish && !hostSlot && isOpaqueWord(text, i, end))
+                pushEdit(edits, text, i + escHead, end, REDACTED_SECRET);
         }
         i = end;
     }
     return edits;
 }
+const C0_ALL = '\\u0000-\\u001F';
+const C0_KEEP_LAYOUT = '\\u0000-\\u0008\\u000B-\\u001F';
+const DEL_C1 = '\\u007F-\\u009F';
+const LONE_SURROGATE = '\\uD800-\\uDFFF';
+const LINE_SEPARATORS = '\\u2028\\u2029';
 const FORMAT_CHAR = /^\p{Cf}$/u;
+const FORMAT_CLASS = FORMAT_CHAR.source.slice(1, -1);
+const FACE_MARKED_CHAR = new RegExp(`^(?:[${C0_ALL}${DEL_C1}${LONE_SURROGATE}${LINE_SEPARATORS}]|${FORMAT_CLASS})$`, 'u');
 const isStrippableControl = (c) => (c <= 0x1f && (c < 0x09 || c > 0x0d)) || (c >= 0x7f && c <= 0x9f);
 class SequenceReader {
     text;
@@ -2965,13 +3348,7 @@ function c1SequenceAfter(text, c1, at, seq) {
     return null;
 }
 function isFaceMarkedCodePoint(cp) {
-    if (cp <= 0x1f || (cp >= 0x7f && cp <= 0x9f))
-        return true;
-    if (cp >= 0xd800 && cp <= 0xdfff)
-        return true;
-    if (cp === 0x2028 || cp === 0x2029)
-        return true;
-    return cp >= 0xad && cp <= 0x10ffff && FORMAT_CHAR.test(String.fromCodePoint(cp));
+    return cp >= 0 && cp <= 0x10ffff && FACE_MARKED_CHAR.test(String.fromCodePoint(cp));
 }
 function escapeTokenAt(text, at) {
     const four = /^\\u([0-9A-Fa-f]{4})/.exec(text.slice(at, at + 6));
@@ -3287,8 +3664,39 @@ function screenSurfaces(text, o) {
     if (joinedSpaced !== null)
         out.push(joinedSpaced);
     const contents = V.contents.map(([a, b]) => ({ sub: screen.slice(a, b), rawAt: (k) => M.ps[a + k] ?? 0, rawEndAt: (k) => M.pe[a + k] ?? 0 }));
+    const decoded = percentSurfaces(text, screen, M, o);
+    out.push(...decoded.surfaces);
+    contents.push(...decoded.contents);
     return { surfaces: out, rawSoft, rawPlain, contents };
 }
+function percentSurfaces(raw, text, base, o) {
+    const surfaces = [];
+    const contents = [];
+    for (const layer of percentLayers(text)) {
+        const n = layer.text.length;
+        const ps = new Int32Array(n);
+        const pe = new Int32Array(n);
+        const pdot = new Uint8Array(n);
+        for (let k = 0; k < n; k++) {
+            const a = layer.ps[k] ?? 0;
+            const b = layer.pe[k] ?? 0;
+            ps[k] = base === null ? a : (base.ps[a] ?? 0);
+            pe[k] = base === null ? b : (base.pe[b - 1] ?? 0);
+            if (base !== null && b - a === 1)
+                pdot[k] = base.pdot[a] ?? 0;
+        }
+        const M = { ps, pe, pdot, rawDot: base === null ? new Uint8Array(raw.length) : base.rawDot };
+        const VD = buildScanView(layer.text, o);
+        const sep = separatedSurface(raw, VD, M);
+        surfaces.push(base === null ? { ...sep, rawDot: null } : sep);
+        const joined = joinedSurface(raw, VD, false, M);
+        if (joined !== null)
+            surfaces.push(base === null ? { ...joined, rawDot: null } : joined);
+        for (const [a, b] of VD.contents)
+            contents.push({ sub: layer.text.slice(a, b), rawAt: (k) => ps[a + k] ?? 0, rawEndAt: (k) => pe[a + k] ?? 0 });
+    }
+    return { surfaces, contents };
+}
 function finalIsStructural(text, at) {
     if (text.charCodeAt(at) !== 0x5c)
         return false;
@@ -3557,6 +3965,9 @@ function collectCandidates(text, o, nested) {
         surfaces.push(joinedSpaced);
     const screen = screenSurfaces(text, o);
     surfaces.push(...screen.surfaces);
+    const decoded = percentSurfaces(text, text, null, o);
+    surfaces.push(...decoded.surfaces);
+    const decodedContents = decoded.contents;
     const raw = [];
     const blocks = { raw: text, view: V, out: raw, lines: [null, null], marks: null };
     const regionSurface = screen.surfaces[0] ?? separated;
@@ -3566,7 +3977,7 @@ function collectCandidates(text, o, nested) {
         const regions = [];
         if (o.urls) {
             const unitPos = (k) => S.dropped(k) || V.rawUnit[S.rawStart(k)] === 1;
-            urlCandidates(S.text, cands, regions, unitPos, (k) => unitPos(k) || S.painted(k));
+            urlCandidates(S.text, cands, regions, unitPos, (k) => unitPos(k) || S.painted(k), o.queryByShape ?? false);
             userinfoCandidates(S, cands, o.words);
         }
         if (o.words) {
@@ -3575,6 +3986,8 @@ function collectCandidates(text, o, nested) {
             labelCandidates(S, 'scheme', regions, cands, blocks);
             labelCandidates(S, 'token', regions, cands, blocks);
             labelCandidates(S, 'label', regions, cands, blocks);
+            labelCandidates(S, 'scheme', regions, cands, blocks, true);
+            labelCandidates(S, 'label', regions, cands, blocks, true);
             editsToCandidates(authParamEdits(S.text), 'param', cands);
             editsToCandidates(proseLiteralEdits(S.text), 'prose', cands);
         }
@@ -3592,7 +4005,7 @@ function collectCandidates(text, o, nested) {
                 raw.push({ start: a + iv.start, end: a + iv.end, kind: iv.kind, cls: 'nested', tokenEnd: a + iv.end, pretrimmed: true });
             }
         }
-        for (const c of screen.contents) {
+        for (const c of [...screen.contents, ...decodedContents]) {
             const inner = collectCandidates(c.sub, o, true);
             for (const iv of resolveCandidates(c.sub, inner.cands, inner.rawUnit, inner.rawDot, o.words ? pemRegions(inner.pemBlocksSeen) : [], inner.rawSoft, inner.rawPlain)) {
                 const start = c.rawAt(iv.start);
@@ -3661,11 +4074,6 @@ export function washCredentials(text) {
         return text;
     return scanAndMask(text, WASH_OPTIONS, false).text;
 }
-const C0_ALL = '\\u0000-\\u001F';
-const C0_KEEP_LAYOUT = '\\u0000-\\u0008\\u000B-\\u001F';
-const DEL_C1 = '\\u007F-\\u009F';
-const LONE_SURROGATE = '\\uD800-\\uDFFF';
-const LINE_SEPARATORS = '\\u2028\\u2029';
 const NAME_BLANKS = NAME_BLANK_RANGES.map(([a, b]) => (a === b ? classEscape(a) : `${classEscape(a)}-${classEscape(b)}`)).join('');
 function classEscape(cp) {
     return `\\u${cp.toString(16).toUpperCase().padStart(4, '0')}`;
@@ -3770,9 +4178,7 @@ function faceHitKept(ch, at, text) {
     const c = ch.charCodeAt(0);
     return ch.length === 1 && (c === 0x200d || c === 0x200c) && joinerKept(text, at, c === 0x200d);
 }
-const FORMAT_CLASS = '\\p{Cf}';
 const RGI_TAG_FLAG = '\\u{1F3F4}\\u{E0067}\\u{E0062}(?:\\u{E0065}\\u{E006E}\\u{E0067}|\\u{E0073}\\u{E0063}\\u{E0074}|\\u{E0077}\\u{E006C}\\u{E0073})\\u{E007F}';
-const BIDI_REORDER = '\\u061C\\u200E\\u200F\\u2028\\u2029\\u202A-\\u202E\\u2066-\\u2069';
 function unsafeClass(members, withFormatClass) {
     if (members === '' && !withFormatClass)
         return null;
@@ -3783,17 +4189,6 @@ function unsafeClass(members, withFormatClass) {
     ];
     return new RegExp(parts.join('|'), 'gu');
 }
-export const LEGACY_ESCAPE_FACE = Object.freeze({
-    unsafe: unsafeClass(`${C0_ALL}${DEL_C1}${BIDI_REORDER}${LONE_SURROGATE}`, false),
-    fold: false,
-    mark: 'escape',
-});
-export const LEGACY_LABEL_FACE = Object.freeze({ ...LEGACY_ESCAPE_FACE, fold: true });
-export const LEGACY_NAME_FACE = Object.freeze({
-    unsafe: unsafeClass(`${C0_ALL}\\u007F${LINE_SEPARATORS}`, false),
-    fold: true,
-    mark: 'space',
-});
 function markOf(ch, mark) {
     if (mark === 'dot')
         return '.';
@@ -3971,8 +4366,11 @@ function publicFace(opts) {
     const index = (opts.controls !== false ? 8 : 0) + (opts.bidi !== false ? 4 : 0) + (keep ? 2 : 0) + (blanks ? 1 : 0);
     return { unsafe: PUBLIC_UNSAFE_BY_NETS[index] ?? null, fold, mark: opts.mark ?? 'escape', keepBlanks: blanks };
 }
+export const ESCAPE_FACE = Object.freeze({ ...publicFace({ foldLines: false }) });
+export const LABEL_FACE = Object.freeze({ ...publicFace({}) });
+export const PEER_NAME_FACE = Object.freeze({ ...publicFace({ mark: 'space' }) });
 const ESCAPE_TOKEN_AT = /^\\u(?:[0-9A-F]{4}|\{[0-9A-F]{1,6}\})/;
-function capDisplay(text, max, mark) {
+export function capDisplay(text, max, mark) {
     if (typeof max !== 'number' || !Number.isFinite(max))
         return text;
     const limit = Math.max(0, Math.floor(max));
@@ -4011,6 +4409,14 @@ function runDisplaySteps(start, steps) {
     }
     return out;
 }
+export function paintAndCap(text, face, max) {
+    return runDisplaySteps(text, {
+        wash: (s) => s,
+        paint: (s) => applyDisplayFace(s, face),
+        cap: (s) => capDisplay(s, max, face.mark),
+        text: (s) => s,
+    });
+}
 function escapeSpacesFor(o, face) {
     if (face.mark !== 'escape' || face.fold)
         return null;
@@ -4029,9 +4435,10 @@ function escapeSpacesFor(o, face) {
     }
     return set.size === 0 ? null : set;
 }
-function scanOptionsOf(o, face) {
+function scanOptionsOf(o, face, queryByShape = false) {
     return {
         urls: o.credentialUrls !== false,
+        queryByShape,
         words: o.credentialWords !== false,
         blanks: face.keepBlanks === true,
         fold: face.fold,
@@ -4046,11 +4453,11 @@ export function credentialWashPasses(text, opts = {}) {
     scanAndMask(input, scan, false, stats);
     return { passes: stats.passes, capped: stats.capped };
 }
-function renderUntrusted(text, opts, ledger) {
+function renderUntrusted(text, opts, ledger, queryByShape = false) {
     const input = typeof text === 'string' ? text : String(text ?? '');
     const o = opts ?? {};
     const face = publicFace(o);
-    const scan = scanOptionsOf(o, face);
+    const scan = scanOptionsOf(o, face, queryByShape);
     const pairBackslashes = o.escapeBackslashes === true && face.mark !== 'dot' && face.mark !== 'space';
     const book = ledger ?? (pairBackslashes ? { cps: [], lens: [] } : null);
     if (book === null) {
@@ -4081,6 +4488,197 @@ export function displayUntrusted(text, opts = {}) {
     const out = renderUntrusted(text, opts, null);
     return typeof out === 'string' ? out : out.text;
 }
+const NON_SECRET_FIELD_NAMES = new Set([
+    'deployment', 'deploymentname', 'deploymentid', 'name', 'tenant', 'tenantname', 'tenantid', 'region', 'location', 'zone',
+    'project', 'projectname', 'projectid', 'workspace', 'workspacename', 'workspaceid', 'resource', 'resourcename', 'resourcegroup',
+    'model', 'modelname', 'modelid', 'apiversion', 'version', 'env', 'environment', 'stage', 'cluster', 'namespace', 'instance',
+    'service', 'servicename', 'app', 'appname', 'application', 'team', 'site', 'org', 'organization',
+]);
+function isNonSecretFieldName(key) {
+    const view = percentDecodeForMatching(key).decoded;
+    return NON_SECRET_FIELD_NAMES.has(view.toLowerCase().replace(/[-_]/g, ''));
+}
+function isCredentialLabelName(name) {
+    if (name.length === 0)
+        return false;
+    const decoded = percentDecodeForMatching(name).decoded;
+    for (const view of decoded === name ? [name] : [name, decoded]) {
+        const probe = `${view}=`;
+        if (labelEndsAt(probe, probe.length, false, true))
+            return true;
+    }
+    return false;
+}
+const WORD_CHAIN_MAX_SUFFIX_DIGITS = 4;
+const WORD_CHAIN_MAX_DIGIT_RUN = 8;
+function isReadableWordChain(value) {
+    const core = valueCoreForJudging(value);
+    if (core.length === 0 || !core.includes('-'))
+        return false;
+    const segments = core.split('-');
+    if (segments.length < 2)
+        return false;
+    if (!segments.some((seg) => seg.length >= 3 && [...seg].every(isAlpha)))
+        return false;
+    if ([...core].every((ch) => ch === '-' || isHexDigit(ch)))
+        return false;
+    for (const seg of segments) {
+        const letters = seg.replace(/[0-9]+$/, '').toLowerCase();
+        if (/[bcdfghjklmnpqrstvwxz]{4,}/.test(letters))
+            return false;
+        if (letters.length >= 5 && !/[aeiouy]/.test(letters))
+            return false;
+    }
+    for (const seg of segments) {
+        if (seg.length === 0)
+            return false;
+        let i = 0;
+        while (i < seg.length && isAlpha(seg.charAt(i)))
+            i++;
+        const letters = seg.slice(0, i);
+        const digits = seg.slice(i);
+        for (const ch of digits)
+            if (ch < '0' || ch > '9')
+                return false;
+        if (letters.length === 0) {
+            if (digits.length === 0 || digits.length > WORD_CHAIN_MAX_DIGIT_RUN)
+                return false;
+            continue;
+        }
+        const caseOk = letters === letters.toLowerCase() || letters === letters.toUpperCase() ||
+            (letters.charAt(0) === letters.charAt(0).toUpperCase() && letters.slice(1) === letters.slice(1).toLowerCase());
+        if (!caseOk)
+            return false;
+        if (digits.length > 0 && (letters.length < 2 || digits.length > WORD_CHAIN_MAX_SUFFIX_DIGITS))
+            return false;
+    }
+    return true;
+}
+const OPAQUE_TOKEN_PUNCTUATION = new Set(['-', '_', '.', '~', '+', '/', '=']);
+const HIGH_ENTROPY_MIN_ALNUM = 20;
+function isHighEntropyQueryValue(value) {
+    const { decoded } = percentDecodeForMatching(value);
+    let alnum = 0;
+    let mixed = 0;
+    let run = 0;
+    let runHasLetter = false;
+    let runHasDigit = false;
+    let anyLetter = false;
+    let anyDigit = false;
+    let allHex = true;
+    const flush = () => {
+        alnum += run;
+        if (runHasLetter && runHasDigit)
+            mixed += run;
+        run = 0;
+        runHasLetter = false;
+        runHasDigit = false;
+    };
+    for (const ch of decoded) {
+        if (isAlpha(ch)) {
+            run += 1;
+            runHasLetter = true;
+            anyLetter = true;
+            if (!isHexDigit(ch))
+                allHex = false;
+            continue;
+        }
+        if (ch >= '0' && ch <= '9') {
+            run += 1;
+            runHasDigit = true;
+            anyDigit = true;
+            continue;
+        }
+        if (!OPAQUE_TOKEN_PUNCTUATION.has(ch))
+            return false;
+        flush();
+    }
+    flush();
+    if (alnum < HIGH_ENTROPY_MIN_ALNUM)
+        return false;
+    return mixed * 2 >= alnum || (allHex && anyLetter && anyDigit);
+}
+function isOpaqueSecretValue(value) {
+    const core = valueCoreForJudging(value);
+    return core.length > 0 && (looksLikeKnownSecret(core) || isHighEntropyQueryValue(core));
+}
+const VALUE_PIECE_SEPARATORS = new Set(['/', '\\', '?', '#', '&', '=', ';', ':', '@', ',', '+']);
+function hasOpaquePiece(text) {
+    let start = 0;
+    for (let i = 0; i <= text.length; i++) {
+        const ch = text.charAt(i);
+        if (i === text.length || ch <= ' ' || VALUE_PIECE_SEPARATORS.has(ch)) {
+            if (i > start && isOpaqueSecretValue(text.slice(start, i)))
+                return true;
+            start = i + 1;
+        }
+    }
+    return false;
+}
+function carriesCredentialStructure(value) {
+    const netChanges = (v) => {
+        if (washCredentials(v) !== v || hasOpaquePiece(v))
+            return true;
+        if (!v.includes('+'))
+            return false;
+        const spaced = v.split('+').join(' ');
+        return washCredentials(spaced) !== spaced;
+    };
+    let view = value;
+    for (let layer = 0; layer < MAX_PERCENT_VIEW_LAYERS; layer++) {
+        if (netChanges(view))
+            return true;
+        const next = percentDecodeForMatching(view).decoded;
+        if (next === view)
+            return false;
+        view = next;
+    }
+    if (netChanges(view))
+        return true;
+    return percentDecodeForMatching(view).decoded !== view;
+}
+function queryPartCarriesCredential(key, value, relax) {
+    if (value.length === 0 || isMarker(value))
+        return false;
+    if (key !== null) {
+        if (isCredentialLabelName(key))
+            return true;
+        if (relax && isNonSecretFieldName(key) && isReadableWordChain(value))
+            return isKnownSecretSegment(value);
+    }
+    return isOpaqueSecretValue(value) || carriesCredentialStructure(value);
+}
+const UPLOAD_PROBE_PREFIX = 'https://q.invalid/?';
+const UPLOAD_SCAN_OPTIONS = Object.freeze({ urls: true, queryByShape: 'strict', words: true, blanks: false, fold: false, face: null, escapeSpaces: null });
+export function queryCarriesCredential(query) {
+    if (typeof query !== 'string' || query.length === 0)
+        return false;
+    const probe = `${UPLOAD_PROBE_PREFIX}${query}`;
+    return scanOnce(probe, UPLOAD_SCAN_OPTIONS, false).text !== probe;
+}
+export function displayConfiguredUrl(url, opts = {}) {
+    const out = renderUntrusted(typeof url === 'string' ? configuredUrlScannable(url) : url, opts, null, 'relaxed');
+    return typeof out === 'string' ? out : out.text;
+}
+function configuredUrlScannable(url) {
+    if (/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(url) || !/^[A-Za-z][A-Za-z0-9+.-]*:/.test(url))
+        return url;
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        return url;
+    }
+    if (u.host === '')
+        return url;
+    const userinfo = u.username !== '' || u.password !== '' ? `${u.username}${u.password !== '' ? `:${u.password}` : ''}@` : '';
+    return `${u.protocol}//${userinfo}${u.host}${u.pathname}${u.search}${u.hash}`;
+}
+export function quoteUntrustedForSentence(text, max) {
+    const shown = displayUntrusted(text, { max, blanks: true, escapeBackslashes: true });
+    return shown.trim() === '' ? undefined : `"${shown.replace(/"/g, '\\"')}"`;
+}
 export function displayUntrustedMarks(text, opts = {}) {
     const ledger = { cps: [], lens: [] };
     const out = renderUntrusted(text, opts, ledger);
@@ -4088,4 +4686,4 @@ export function displayUntrustedMarks(text, opts = {}) {
         return { text: out, marks: [] };
     return { text: out.text, marks: collectMarks(out, ledger) };
 }
-const isQuoteChar = (c) => c.charCodeAt(0) === 0x22 || c.charCodeAt(0) === 0x27 || (c === '' && /`/.test(c));
+const isQuoteChar = (c) => c.charCodeAt(0) === 0x22 || c.charCodeAt(0) === 0x27;