@sema-agent/client-core 0.95.0 → 0.97.0

package/dist/displayUntrusted.js

@@ -38,18 +38,12 @@ function scanForSecretLiteral(s) {
         return true;
     return s.split(/[^A-Za-z0-9_-]+/).some(tok => tok !== '' && SECRET_LITERAL_RE.test(tok));
 }
-function decodeAsciiEscapes(s) {
-    return s.replace(/%[0-9A-Fa-f]{2}/g, esc => {
-        const code = Number.parseInt(esc.slice(1), 16);
-        return code < 0x80 ? String.fromCharCode(code) : esc;
-    });
-}
 export function looksLikeKnownSecret(s) {
     let cur = s;
     for (let layer = 0; layer < 4; layer++) {
         if (scanForSecretLiteral(cur))
             return true;
-        const next = decodeAsciiEscapes(cur);
+        const next = percentDecodeForMatching(cur).decoded;
         if (next === cur)
             break;
         cur = next;
@@ -261,21 +255,23 @@ function isKnownSecretSegment(value) {
     const core = valueCoreForJudging(value);
     return core.length > 0 && looksLikeKnownSecret(core);
 }
-function queryCandidates(src, base, query, edits, soft) {
+function queryCandidates(src, base, query, edits, soft, byShape = false) {
+    const relax = byShape === 'relaxed';
     let pos = base;
     for (const part of query.split('&')) {
         if (part.length > 0) {
             const eq = part.indexOf('=');
             if (eq === -1) {
                 const at = pos;
-                if (!slotIsWholeMarker(part, soft && ((i) => soft(at + i))))
+                if (!slotIsWholeMarker(part, soft && ((i) => soft(at + i))) && (!byShape || queryPartCarriesCredential(null, part, relax)))
                     pushEdit(edits, src, pos, pos + part.length, REDACTED_QUERY);
             }
             else {
                 const value = part.slice(eq + 1);
                 const at = pos + eq + 1;
-                if (value.length > 0 && !slotIsWholeMarker(value, soft && ((i) => soft(at + i))))
+                if (value.length > 0 && !slotIsWholeMarker(value, soft && ((i) => soft(at + i))) && (!byShape || queryPartCarriesCredential(part.slice(0, eq), value, relax))) {
                     pushEdit(edits, src, pos + eq + 1, pos + part.length, REDACTED_QUERY);
+                }
             }
         }
         pos += part.length + 1;
@@ -319,7 +315,7 @@ function pathCandidates(src, base, path, opaqueSegments, edits, soft) {
         pos += segment.length + 1;
     }
 }
-function urlTokenCandidatesAt(src, start, end, edits, soft) {
+function urlTokenCandidatesAt(src, start, end, edits, soft, byShape = false) {
     const token = src.slice(start, end);
     const schemeEnd = token.indexOf('://') + '://'.length;
     const scheme = token.slice(0, schemeEnd);
@@ -337,7 +333,7 @@ function urlTokenCandidatesAt(src, start, end, edits, soft) {
     const path = question === -1 ? beforeHash : beforeHash.slice(0, question);
     pathCandidates(src, start + tailStart, path, !/^file:/i.test(scheme), edits, soft);
     if (question !== -1)
-        queryCandidates(src, start + tailStart + question + 1, beforeHash.slice(question + 1), edits, soft);
+        queryCandidates(src, start + tailStart + question + 1, beforeHash.slice(question + 1), edits, soft, byShape);
     if (hash !== -1) {
         const rawFragment = tail.slice(hash + 1);
         const at = start + tailStart + hash + 1;
@@ -345,7 +341,7 @@ function urlTokenCandidatesAt(src, start, end, edits, soft) {
             pushEdit(edits, src, start + tailStart + hash + 1, end, REDACTED_FRAGMENT);
     }
 }
-function urlCandidates(text, out, regions, unitPos = () => false, soft) {
+function urlCandidates(text, out, regions, unitPos = () => false, soft, byShape = false) {
     let mark = text.indexOf('://');
     while (mark !== -1) {
         let start = mark;
@@ -410,7 +406,7 @@ function urlCandidates(text, out, regions, unitPos = () => false, soft) {
             end = runStart;
         end = trailingCloserEnd(text, start, mark + 3, end, unitPos);
         const tokenEdits = [];
-        urlTokenCandidatesAt(text, start, end, tokenEdits, soft);
+        urlTokenCandidatesAt(text, start, end, tokenEdits, soft, byShape);
         editsToCandidates(tokenEdits, 'url', out, end);
         const token = text.slice(start, end);
         const schemeEnd = token.indexOf('://') + 3;
@@ -813,8 +809,16 @@ const isNameBlank = (cp) => NAME_BLANK_RANGES.some(([a, b]) => cp >= a && cp <=
 const isFoldedBlank = (c) => isNameBlank(c) && isRegexSpace(c);
 const isUnicodeBlank = (c) => (c > 0x7f && isRegexSpace(c) && c !== 0xfeff) || isNameBlank(c);
 const SECRET_SCHEME_WORD = /(?:\b|(?<=\\[A-Za-z"']))(?!(?<=(?<!\\)\\)(?:bearer|basic|token)\\t)(bearer|basic|token)(?:[\s:=\uFF1A\uFF1D\u115F\u1160\u3164\uFFA0\u2800]|\\t)+/gi;
+const SCHEME_LEFT_STRICT = String.raw `(?:\b|(?<=\\[A-Za-z"']))`;
+const SCHEME_WORD_OUTER_SOURCE = widenLeft(SECRET_SCHEME_WORD.source, SCHEME_LEFT_STRICT, String.raw `(?=bearer|basic)`);
 const schemeWordIsInner = (word, tokenInner) => tokenInner || word.toLowerCase() !== 'token';
 const SECRET_LABELLED_WORD = /(?:\b|(?<=_)|(?<=\\[A-Za-z"']))((?:access[-_ ]?|refresh[-_ ]?|id[-_ ]?|client[-_ ]?|api[-_ ]?|x[-_]api[-_ ]?|session[-_ ]?|auth[-_ ]?)?(?:token|key|secret|password|authorization|credential)s?)(?:\\*["'])?(?:[\s\u115F\u1160\u3164\uFFA0\u2800]|\\t)*[:=\uFF1A\uFF1D](?:[\s\u115F\u1160\u3164\uFFA0\u2800]|\\t)*/gi;
+function widenLeft(source, strictLeft, extraAlt) {
+    return source.startsWith(strictLeft) ? `${strictLeft.slice(0, -1)}|${extraAlt})${source.slice(strictLeft.length)}` : source;
+}
+const LABEL_LEFT_STRICT = String.raw `(?:\b|(?<=_)|(?<=\\[A-Za-z"']))`;
+const LABEL_LEFT_GLUED_ALT = String.raw `(?<=[A-Za-z0-9])(?:(?=(?:token|secret|password|authorization|credential)(?!s))|(?<!mon|tur|don|hoc|whis|joc|lac)(?=key(?!s)))`;
+const LABEL_WORD_OUTER_SOURCE = widenLeft(SECRET_LABELLED_WORD.source, LABEL_LEFT_STRICT, LABEL_LEFT_GLUED_ALT);
 const DIAGNOSTIC_VALUE_WORDS = new Set([
     'missing', 'required', 'invalid', 'expired', 'unauthorized', 'unauthenticated', 'authentication',
     'authorization', 'credential', 'credentials', 'unsupported', 'malformed', 'rejected', 'absent',
@@ -1266,6 +1270,35 @@ function percentDecodeForMatching(text) {
     offsets.push(text.length);
     return { decoded: chars.join(''), offsets };
 }
+const PERCENT_ESCAPE_ASCII = /%[0-7][0-9A-Fa-f]/;
+const MAX_PERCENT_VIEW_LAYERS = 3;
+function percentLayers(text) {
+    const out = [];
+    if (!PERCENT_ESCAPE_ASCII.test(text))
+        return out;
+    let cur = text;
+    let ps = null;
+    let pe = null;
+    for (let layer = 0; layer < MAX_PERCENT_VIEW_LAYERS; layer++) {
+        const { decoded, offsets } = percentDecodeForMatching(cur);
+        if (decoded === cur)
+            break;
+        const n = decoded.length;
+        const nps = new Int32Array(n);
+        const npe = new Int32Array(n);
+        for (let k = 0; k < n; k++) {
+            const a = offsets[k] ?? 0;
+            const b = offsets[k + 1] ?? cur.length;
+            nps[k] = ps === null ? a : (ps[a] ?? 0);
+            npe[k] = pe === null ? b : (pe[b - 1] ?? 0);
+        }
+        out.push({ text: decoded, ps: nps, pe: npe });
+        cur = decoded;
+        ps = nps;
+        pe = npe;
+    }
+    return out;
+}
 function firstLabelCutInPath(path) {
     let cut = -1;
     for (const src of [SECRET_SCHEME_WORD, SECRET_LABELLED_WORD]) {
@@ -1520,7 +1553,7 @@ function quoteSwallowedBefore(S, at) {
         return '';
     return dq === -1 ? "'" : sq === -1 ? '"' : dq < sq ? '"' : "'";
 }
-function labelEndsAt(text, end, atLeast = false) {
+function labelEndsAt(text, end, atLeast = false, outer = false) {
     let k = end;
     while (k > 0 && isRegexSpace(text.charCodeAt(k - 1)))
         k--;
@@ -1539,7 +1572,7 @@ function labelEndsAt(text, end, atLeast = false) {
     let w = k;
     while (w > 0 && isIdentOrDash(text.charAt(w - 1)))
         w--;
-    const re = new RegExp(SECRET_LABELLED_WORD.source, 'iy');
+    const re = new RegExp(outer ? LABEL_WORD_OUTER_SOURCE : SECRET_LABELLED_WORD.source, 'iy');
     for (let s = w; s < k; s++) {
         re.lastIndex = s;
         const m = re.exec(text);
@@ -2097,10 +2130,12 @@ function blockSeqEntries(scan, rawFrom, rawLabel) {
     }
     return out;
 }
-function labelCandidates(S, pass, regions, out, blocks) {
+function labelCandidates(S, pass, regions, out, blocks, outer = false) {
     const text = S.text;
     const unitAt = (k) => S.unitAt(k);
-    const re = pass === 'label' ? SECRET_LABELLED_WORD : SECRET_SCHEME_WORD;
+    const strictSource = pass === 'label' ? SECRET_LABELLED_WORD.source : SECRET_SCHEME_WORD.source;
+    const re = new RegExp(outer ? (pass === 'label' ? LABEL_WORD_OUTER_SOURCE : SCHEME_WORD_OUTER_SOURCE) : strictSource, 'gi');
+    const strictAt = outer ? new RegExp(strictSource, 'iy') : null;
     const schemePass = pass !== 'label';
     const tokenPass = pass === 'token';
     const rawUnitMap = blocks?.view.rawUnit ?? null;
@@ -2346,6 +2381,11 @@ function labelCandidates(S, pass, regions, out, blocks) {
     re.lastIndex = 0;
     hits: for (let hit = re.exec(text); hit !== null; hit = re.exec(text)) {
         const label = hit[1] ?? '';
+        if (strictAt !== null) {
+            strictAt.lastIndex = hit.index;
+            if (strictAt.test(text))
+                continue;
+        }
         if (hit.index >= skipFrom && hit.index < skipTo)
             continue;
         if (schemePass && (label.toLowerCase() === 'token') !== tokenPass)
@@ -2665,6 +2705,19 @@ function isAuthScheme(value) {
 const isKeyWordChar = (c) => (c >= 0x30 && c <= 0x39) || (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a) || c === 0x5f || c === 0x2d;
 const isAlnumCode = (c) => (c >= 0x30 && c <= 0x39) || (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a);
 const PROSE_LITERAL_MIN_RUN = 16;
+const PROSE_SHORT_LITERAL_MIN_TAIL = 6;
+function shortLiteralTail(word) {
+    const lit = SECRET_LITERAL_RE.exec(word);
+    if (lit === null)
+        return false;
+    const tail = word.slice(lit[0].length);
+    if (tail.length < PROSE_SHORT_LITERAL_MIN_TAIL)
+        return false;
+    for (let k = 0; k < tail.length; k++)
+        if (!isAlnumCode(tail.charCodeAt(k)))
+            return false;
+    return true;
+}
 function longestAlnumRun(word) {
     let best = 0;
     let run = 0;
@@ -3009,7 +3062,7 @@ function authParamEdits(text) {
 const LITERAL_PROBE_WINDOW = 64;
 function gluedLiteralStart(word) {
     const n = word.length;
-    if (n < PROSE_LITERAL_MIN_RUN + 2)
+    if (n < PROSE_SHORT_LITERAL_MIN_TAIL + 4)
         return 0;
     const runFrom = new Int32Array(n + 1);
     let best = 0;
@@ -3028,9 +3081,10 @@ function gluedLiteralStart(word) {
         const left = word.charCodeAt(k - 1);
         if ((left !== 0x5f && left !== 0x2d) || !isAlnumCode(word.charCodeAt(k)))
             continue;
-        if ((runFrom[k] ?? 0) < PROSE_LITERAL_MIN_RUN)
+        const run = runFrom[k] ?? 0;
+        if (run < PROSE_SHORT_LITERAL_MIN_TAIL)
             return 0;
-        if (SECRET_LITERAL_RE.test(word.slice(k, k + LITERAL_PROBE_WINDOW)))
+        if (SECRET_LITERAL_RE.test(word.slice(k, k + LITERAL_PROBE_WINDOW)) && (run >= PROSE_LITERAL_MIN_RUN || shortLiteralTail(word.slice(k))))
             return k;
     }
     return 0;
@@ -3090,8 +3144,27 @@ function isOpaqueWord(text, i, end) {
     }
     return segments > 0 && segmentChars / segments <= OPAQUE_MAX_AVG_SEGMENT;
 }
+const FILE_URL_OPENERS = new Set(['(', '[', '<', "'", ',', ';']);
+function fileUrlPositions(text) {
+    let marks = null;
+    const re = /file:/gi;
+    for (let hit = re.exec(text); hit !== null; hit = re.exec(text)) {
+        const s = hit.index;
+        if (s > 0 && !endsUrlFragmentAt(text, s - 1) && !FILE_URL_OPENERS.has(text.charAt(s - 1)))
+            continue;
+        let e = s + hit[0].length;
+        while (e < text.length && !endsUrlFragmentAt(text, e))
+            e++;
+        marks ??= new Uint8Array(text.length);
+        for (let k = s; k < e; k++)
+            marks[k] = 1;
+        re.lastIndex = e;
+    }
+    return marks;
+}
 function proseLiteralEdits(text) {
     const edits = [];
+    let fileAt;
     let i = 0;
     while (i < text.length) {
         const c = text.charCodeAt(i);
@@ -3102,6 +3175,7 @@ function proseLiteralEdits(text) {
         let end = i;
         while (end < text.length && isKeyWordChar(text.charCodeAt(end)))
             end++;
+        const escHead = i > 0 && text.charCodeAt(i - 1) === 0x25 && PERCENT_ESCAPE_ASCII.test(text.slice(i - 1, i + 2)) && i + 2 < end ? 2 : 0;
         const word = text.slice(i, end);
         if (word.startsWith('eyJ')) {
             let segEnd = end;
@@ -3120,22 +3194,33 @@ function proseLiteralEdits(text) {
         }
         const prev = i > 0 ? text.charAt(i - 1) : '';
         const hostSlot = prev === '/' && i > 1 && text.charAt(i - 2) === '/';
-        const pathish = (prev === '/' && !hostSlot) || prev === '\\' || prev === '.';
-        if (!pathish && SECRET_LITERAL_RE.test(word) && longestAlnumRun(word) >= PROSE_LITERAL_MIN_RUN) {
-            pushEdit(edits, text, i, end, REDACTED_SECRET);
-        }
-        else if (!pathish) {
+        const slashSegment = prev === '/' && !hostSlot;
+        if (slashSegment && fileAt === undefined)
+            fileAt = fileUrlPositions(text);
+        const localPath = prev === '\\' || prev === '.' || (slashSegment && fileAt != null && fileAt[i] === 1);
+        const pathish = slashSegment || localPath;
+        if (!localPath && SECRET_LITERAL_RE.test(word) && (longestAlnumRun(word) >= PROSE_LITERAL_MIN_RUN || shortLiteralTail(word))) {
+            pushEdit(edits, text, i + escHead, end, REDACTED_SECRET);
+        }
+        else if (!localPath) {
             const glued = gluedLiteralStart(word);
             if (glued > 0)
-                pushEdit(edits, text, i + glued, end, REDACTED_SECRET);
-            else if (!hostSlot && isOpaqueWord(text, i, end))
-                pushEdit(edits, text, i, end, REDACTED_SECRET);
+                pushEdit(edits, text, i + Math.max(glued, escHead), end, REDACTED_SECRET);
+            else if (!pathish && !hostSlot && isOpaqueWord(text, i, end))
+                pushEdit(edits, text, i + escHead, end, REDACTED_SECRET);
         }
         i = end;
     }
     return edits;
 }
+const C0_ALL = '\\u0000-\\u001F';
+const C0_KEEP_LAYOUT = '\\u0000-\\u0008\\u000B-\\u001F';
+const DEL_C1 = '\\u007F-\\u009F';
+const LONE_SURROGATE = '\\uD800-\\uDFFF';
+const LINE_SEPARATORS = '\\u2028\\u2029';
 const FORMAT_CHAR = /^\p{Cf}$/u;
+const FORMAT_CLASS = FORMAT_CHAR.source.slice(1, -1);
+const FACE_MARKED_CHAR = new RegExp(`^(?:[${C0_ALL}${DEL_C1}${LONE_SURROGATE}${LINE_SEPARATORS}]|${FORMAT_CLASS})$`, 'u');
 const isStrippableControl = (c) => (c <= 0x1f && (c < 0x09 || c > 0x0d)) || (c >= 0x7f && c <= 0x9f);
 class SequenceReader {
     text;
@@ -3263,13 +3348,7 @@ function c1SequenceAfter(text, c1, at, seq) {
     return null;
 }
 function isFaceMarkedCodePoint(cp) {
-    if (cp <= 0x1f || (cp >= 0x7f && cp <= 0x9f))
-        return true;
-    if (cp >= 0xd800 && cp <= 0xdfff)
-        return true;
-    if (cp === 0x2028 || cp === 0x2029)
-        return true;
-    return cp >= 0xad && cp <= 0x10ffff && FORMAT_CHAR.test(String.fromCodePoint(cp));
+    return cp >= 0 && cp <= 0x10ffff && FACE_MARKED_CHAR.test(String.fromCodePoint(cp));
 }
 function escapeTokenAt(text, at) {
     const four = /^\\u([0-9A-Fa-f]{4})/.exec(text.slice(at, at + 6));
@@ -3585,8 +3664,39 @@ function screenSurfaces(text, o) {
     if (joinedSpaced !== null)
         out.push(joinedSpaced);
     const contents = V.contents.map(([a, b]) => ({ sub: screen.slice(a, b), rawAt: (k) => M.ps[a + k] ?? 0, rawEndAt: (k) => M.pe[a + k] ?? 0 }));
+    const decoded = percentSurfaces(text, screen, M, o);
+    out.push(...decoded.surfaces);
+    contents.push(...decoded.contents);
     return { surfaces: out, rawSoft, rawPlain, contents };
 }
+function percentSurfaces(raw, text, base, o) {
+    const surfaces = [];
+    const contents = [];
+    for (const layer of percentLayers(text)) {
+        const n = layer.text.length;
+        const ps = new Int32Array(n);
+        const pe = new Int32Array(n);
+        const pdot = new Uint8Array(n);
+        for (let k = 0; k < n; k++) {
+            const a = layer.ps[k] ?? 0;
+            const b = layer.pe[k] ?? 0;
+            ps[k] = base === null ? a : (base.ps[a] ?? 0);
+            pe[k] = base === null ? b : (base.pe[b - 1] ?? 0);
+            if (base !== null && b - a === 1)
+                pdot[k] = base.pdot[a] ?? 0;
+        }
+        const M = { ps, pe, pdot, rawDot: base === null ? new Uint8Array(raw.length) : base.rawDot };
+        const VD = buildScanView(layer.text, o);
+        const sep = separatedSurface(raw, VD, M);
+        surfaces.push(base === null ? { ...sep, rawDot: null } : sep);
+        const joined = joinedSurface(raw, VD, false, M);
+        if (joined !== null)
+            surfaces.push(base === null ? { ...joined, rawDot: null } : joined);
+        for (const [a, b] of VD.contents)
+            contents.push({ sub: layer.text.slice(a, b), rawAt: (k) => ps[a + k] ?? 0, rawEndAt: (k) => pe[a + k] ?? 0 });
+    }
+    return { surfaces, contents };
+}
 function finalIsStructural(text, at) {
     if (text.charCodeAt(at) !== 0x5c)
         return false;
@@ -3855,6 +3965,9 @@ function collectCandidates(text, o, nested) {
         surfaces.push(joinedSpaced);
     const screen = screenSurfaces(text, o);
     surfaces.push(...screen.surfaces);
+    const decoded = percentSurfaces(text, text, null, o);
+    surfaces.push(...decoded.surfaces);
+    const decodedContents = decoded.contents;
     const raw = [];
     const blocks = { raw: text, view: V, out: raw, lines: [null, null], marks: null };
     const regionSurface = screen.surfaces[0] ?? separated;
@@ -3864,7 +3977,7 @@ function collectCandidates(text, o, nested) {
         const regions = [];
         if (o.urls) {
             const unitPos = (k) => S.dropped(k) || V.rawUnit[S.rawStart(k)] === 1;
-            urlCandidates(S.text, cands, regions, unitPos, (k) => unitPos(k) || S.painted(k));
+            urlCandidates(S.text, cands, regions, unitPos, (k) => unitPos(k) || S.painted(k), o.queryByShape ?? false);
             userinfoCandidates(S, cands, o.words);
         }
         if (o.words) {
@@ -3873,6 +3986,8 @@ function collectCandidates(text, o, nested) {
             labelCandidates(S, 'scheme', regions, cands, blocks);
             labelCandidates(S, 'token', regions, cands, blocks);
             labelCandidates(S, 'label', regions, cands, blocks);
+            labelCandidates(S, 'scheme', regions, cands, blocks, true);
+            labelCandidates(S, 'label', regions, cands, blocks, true);
             editsToCandidates(authParamEdits(S.text), 'param', cands);
             editsToCandidates(proseLiteralEdits(S.text), 'prose', cands);
         }
@@ -3890,7 +4005,7 @@ function collectCandidates(text, o, nested) {
                 raw.push({ start: a + iv.start, end: a + iv.end, kind: iv.kind, cls: 'nested', tokenEnd: a + iv.end, pretrimmed: true });
             }
         }
-        for (const c of screen.contents) {
+        for (const c of [...screen.contents, ...decodedContents]) {
             const inner = collectCandidates(c.sub, o, true);
             for (const iv of resolveCandidates(c.sub, inner.cands, inner.rawUnit, inner.rawDot, o.words ? pemRegions(inner.pemBlocksSeen) : [], inner.rawSoft, inner.rawPlain)) {
                 const start = c.rawAt(iv.start);
@@ -3959,11 +4074,6 @@ export function washCredentials(text) {
         return text;
     return scanAndMask(text, WASH_OPTIONS, false).text;
 }
-const C0_ALL = '\\u0000-\\u001F';
-const C0_KEEP_LAYOUT = '\\u0000-\\u0008\\u000B-\\u001F';
-const DEL_C1 = '\\u007F-\\u009F';
-const LONE_SURROGATE = '\\uD800-\\uDFFF';
-const LINE_SEPARATORS = '\\u2028\\u2029';
 const NAME_BLANKS = NAME_BLANK_RANGES.map(([a, b]) => (a === b ? classEscape(a) : `${classEscape(a)}-${classEscape(b)}`)).join('');
 function classEscape(cp) {
     return `\\u${cp.toString(16).toUpperCase().padStart(4, '0')}`;
@@ -4068,9 +4178,7 @@ function faceHitKept(ch, at, text) {
     const c = ch.charCodeAt(0);
     return ch.length === 1 && (c === 0x200d || c === 0x200c) && joinerKept(text, at, c === 0x200d);
 }
-const FORMAT_CLASS = '\\p{Cf}';
 const RGI_TAG_FLAG = '\\u{1F3F4}\\u{E0067}\\u{E0062}(?:\\u{E0065}\\u{E006E}\\u{E0067}|\\u{E0073}\\u{E0063}\\u{E0074}|\\u{E0077}\\u{E006C}\\u{E0073})\\u{E007F}';
-const BIDI_REORDER = '\\u061C\\u200E\\u200F\\u2028\\u2029\\u202A-\\u202E\\u2066-\\u2069';
 function unsafeClass(members, withFormatClass) {
     if (members === '' && !withFormatClass)
         return null;
@@ -4081,17 +4189,6 @@ function unsafeClass(members, withFormatClass) {
     ];
     return new RegExp(parts.join('|'), 'gu');
 }
-export const LEGACY_ESCAPE_FACE = Object.freeze({
-    unsafe: unsafeClass(`${C0_ALL}${DEL_C1}${BIDI_REORDER}${LONE_SURROGATE}`, false),
-    fold: false,
-    mark: 'escape',
-});
-export const LEGACY_LABEL_FACE = Object.freeze({ ...LEGACY_ESCAPE_FACE, fold: true });
-export const LEGACY_NAME_FACE = Object.freeze({
-    unsafe: unsafeClass(`${C0_ALL}\\u007F${LINE_SEPARATORS}`, false),
-    fold: true,
-    mark: 'space',
-});
 function markOf(ch, mark) {
     if (mark === 'dot')
         return '.';
@@ -4229,6 +4326,7 @@ function capPaired(t, max) {
     if (id >= 0)
         while (cut > 0 && t.ids[cut - 1] === id)
             cut--;
+    cut = markerSafeCut(t.text, cut);
     if (cut > 0) {
         const code = t.text.charCodeAt(cut - 1);
         if (code >= 0xd800 && code <= 0xdbff)
@@ -4269,8 +4367,24 @@ function publicFace(opts) {
     const index = (opts.controls !== false ? 8 : 0) + (opts.bidi !== false ? 4 : 0) + (keep ? 2 : 0) + (blanks ? 1 : 0);
     return { unsafe: PUBLIC_UNSAFE_BY_NETS[index] ?? null, fold, mark: opts.mark ?? 'escape', keepBlanks: blanks };
 }
+export const ESCAPE_FACE = Object.freeze({ ...publicFace({ foldLines: false }) });
+export const LABEL_FACE = Object.freeze({ ...publicFace({}) });
+export const PEER_NAME_FACE = Object.freeze({ ...publicFace({ mark: 'space' }) });
 const ESCAPE_TOKEN_AT = /^\\u(?:[0-9A-F]{4}|\{[0-9A-F]{1,6}\})/;
-function capDisplay(text, max, mark) {
+export const REDACTION_MARKER_MAX_LENGTH = REDACTION_MARKER_PREFIX.length + 2 * (1 + 16) + 1;
+export const DISPLAY_CAP_BACKOFF_MAX = REDACTION_MARKER_MAX_LENGTH;
+export function markerSafeCut(text, cut) {
+    if (cut <= 0 || cut >= text.length)
+        return cut;
+    const open = text.lastIndexOf('\u00ab', cut - 1);
+    if (open < 0 || cut - open >= REDACTION_MARKER_MAX_LENGTH)
+        return cut;
+    const close = text.indexOf('\u00bb', open);
+    if (close < cut || close - open + 1 > REDACTION_MARKER_MAX_LENGTH)
+        return cut;
+    return MARKER_RE.test(text.slice(open, close + 1)) ? open : cut;
+}
+export function capDisplay(text, max, mark) {
     if (typeof max !== 'number' || !Number.isFinite(max))
         return text;
     const limit = Math.max(0, Math.floor(max));
@@ -4287,6 +4401,7 @@ function capDisplay(text, max, mark) {
             break;
         }
     }
+    cut = markerSafeCut(text, cut);
     if (cut > 0) {
         const code = text.charCodeAt(cut - 1);
         if (code >= 0xd800 && code <= 0xdbff)
@@ -4309,6 +4424,14 @@ function runDisplaySteps(start, steps) {
     }
     return out;
 }
+export function paintAndCap(text, face, max) {
+    return runDisplaySteps(text, {
+        wash: (s) => s,
+        paint: (s) => applyDisplayFace(s, face),
+        cap: (s) => capDisplay(s, max, face.mark),
+        text: (s) => s,
+    });
+}
 function escapeSpacesFor(o, face) {
     if (face.mark !== 'escape' || face.fold)
         return null;
@@ -4327,9 +4450,10 @@ function escapeSpacesFor(o, face) {
     }
     return set.size === 0 ? null : set;
 }
-function scanOptionsOf(o, face) {
+function scanOptionsOf(o, face, queryByShape = false) {
     return {
         urls: o.credentialUrls !== false,
+        queryByShape,
         words: o.credentialWords !== false,
         blanks: face.keepBlanks === true,
         fold: face.fold,
@@ -4344,11 +4468,11 @@ export function credentialWashPasses(text, opts = {}) {
     scanAndMask(input, scan, false, stats);
     return { passes: stats.passes, capped: stats.capped };
 }
-function renderUntrusted(text, opts, ledger) {
+function renderUntrusted(text, opts, ledger, queryByShape = false) {
     const input = typeof text === 'string' ? text : String(text ?? '');
     const o = opts ?? {};
     const face = publicFace(o);
-    const scan = scanOptionsOf(o, face);
+    const scan = scanOptionsOf(o, face, queryByShape);
     const pairBackslashes = o.escapeBackslashes === true && face.mark !== 'dot' && face.mark !== 'space';
     const book = ledger ?? (pairBackslashes ? { cps: [], lens: [] } : null);
     if (book === null) {
@@ -4379,6 +4503,193 @@ export function displayUntrusted(text, opts = {}) {
     const out = renderUntrusted(text, opts, null);
     return typeof out === 'string' ? out : out.text;
 }
+const NON_SECRET_FIELD_NAMES = new Set([
+    'deployment', 'deploymentname', 'deploymentid', 'name', 'tenant', 'tenantname', 'tenantid', 'region', 'location', 'zone',
+    'project', 'projectname', 'projectid', 'workspace', 'workspacename', 'workspaceid', 'resource', 'resourcename', 'resourcegroup',
+    'model', 'modelname', 'modelid', 'apiversion', 'version', 'env', 'environment', 'stage', 'cluster', 'namespace', 'instance',
+    'service', 'servicename', 'app', 'appname', 'application', 'team', 'site', 'org', 'organization',
+]);
+function isNonSecretFieldName(key) {
+    const view = percentDecodeForMatching(key).decoded;
+    return NON_SECRET_FIELD_NAMES.has(view.toLowerCase().replace(/[-_]/g, ''));
+}
+function isCredentialLabelName(name) {
+    if (name.length === 0)
+        return false;
+    const decoded = percentDecodeForMatching(name).decoded;
+    for (const view of decoded === name ? [name] : [name, decoded]) {
+        const probe = `${view}=`;
+        if (labelEndsAt(probe, probe.length, false, true))
+            return true;
+    }
+    return false;
+}
+const WORD_CHAIN_MAX_SUFFIX_DIGITS = 4;
+const WORD_CHAIN_MAX_DIGIT_RUN = 8;
+function isReadableWordChain(value) {
+    const core = valueCoreForJudging(value);
+    if (core.length === 0 || !core.includes('-'))
+        return false;
+    const segments = core.split('-');
+    if (segments.length < 2)
+        return false;
+    if (!segments.some((seg) => seg.length >= 3 && [...seg].every(isAlpha)))
+        return false;
+    if ([...core].every((ch) => ch === '-' || isHexDigit(ch)))
+        return false;
+    for (const seg of segments) {
+        const letters = seg.replace(/[0-9]+$/, '').toLowerCase();
+        if (/[bcdfghjklmnpqrstvwxz]{4,}/.test(letters))
+            return false;
+        if (letters.length >= 5 && !/[aeiouy]/.test(letters))
+            return false;
+    }
+    for (const seg of segments) {
+        if (seg.length === 0)
+            return false;
+        let i = 0;
+        while (i < seg.length && isAlpha(seg.charAt(i)))
+            i++;
+        const letters = seg.slice(0, i);
+        const digits = seg.slice(i);
+        for (const ch of digits)
+            if (ch < '0' || ch > '9')
+                return false;
+        if (letters.length === 0) {
+            if (digits.length === 0 || digits.length > WORD_CHAIN_MAX_DIGIT_RUN)
+                return false;
+            continue;
+        }
+        const caseOk = letters === letters.toLowerCase() || letters === letters.toUpperCase() ||
+            (letters.charAt(0) === letters.charAt(0).toUpperCase() && letters.slice(1) === letters.slice(1).toLowerCase());
+        if (!caseOk)
+            return false;
+        if (digits.length > 0 && (letters.length < 2 || digits.length > WORD_CHAIN_MAX_SUFFIX_DIGITS))
+            return false;
+    }
+    return true;
+}
+const OPAQUE_TOKEN_PUNCTUATION = new Set(['-', '_', '.', '~', '+', '/', '=']);
+const HIGH_ENTROPY_MIN_ALNUM = 20;
+function isHighEntropyQueryValue(value) {
+    const { decoded } = percentDecodeForMatching(value);
+    let alnum = 0;
+    let mixed = 0;
+    let run = 0;
+    let runHasLetter = false;
+    let runHasDigit = false;
+    let anyLetter = false;
+    let anyDigit = false;
+    let allHex = true;
+    const flush = () => {
+        alnum += run;
+        if (runHasLetter && runHasDigit)
+            mixed += run;
+        run = 0;
+        runHasLetter = false;
+        runHasDigit = false;
+    };
+    for (const ch of decoded) {
+        if (isAlpha(ch)) {
+            run += 1;
+            runHasLetter = true;
+            anyLetter = true;
+            if (!isHexDigit(ch))
+                allHex = false;
+            continue;
+        }
+        if (ch >= '0' && ch <= '9') {
+            run += 1;
+            runHasDigit = true;
+            anyDigit = true;
+            continue;
+        }
+        if (!OPAQUE_TOKEN_PUNCTUATION.has(ch))
+            return false;
+        flush();
+    }
+    flush();
+    if (alnum < HIGH_ENTROPY_MIN_ALNUM)
+        return false;
+    return mixed * 2 >= alnum || (allHex && anyLetter && anyDigit);
+}
+function isOpaqueSecretValue(value) {
+    const core = valueCoreForJudging(value);
+    return core.length > 0 && (looksLikeKnownSecret(core) || isHighEntropyQueryValue(core));
+}
+const VALUE_PIECE_SEPARATORS = new Set(['/', '\\', '?', '#', '&', '=', ';', ':', '@', ',', '+']);
+function hasOpaquePiece(text) {
+    let start = 0;
+    for (let i = 0; i <= text.length; i++) {
+        const ch = text.charAt(i);
+        if (i === text.length || ch <= ' ' || VALUE_PIECE_SEPARATORS.has(ch)) {
+            if (i > start && isOpaqueSecretValue(text.slice(start, i)))
+                return true;
+            start = i + 1;
+        }
+    }
+    return false;
+}
+function carriesCredentialStructure(value) {
+    const netChanges = (v) => {
+        if (washCredentials(v) !== v || hasOpaquePiece(v))
+            return true;
+        if (!v.includes('+'))
+            return false;
+        const spaced = v.split('+').join(' ');
+        return washCredentials(spaced) !== spaced;
+    };
+    let view = value;
+    for (let layer = 0; layer < MAX_PERCENT_VIEW_LAYERS; layer++) {
+        if (netChanges(view))
+            return true;
+        const next = percentDecodeForMatching(view).decoded;
+        if (next === view)
+            return false;
+        view = next;
+    }
+    if (netChanges(view))
+        return true;
+    return percentDecodeForMatching(view).decoded !== view;
+}
+function queryPartCarriesCredential(key, value, relax) {
+    if (value.length === 0 || isMarker(value))
+        return false;
+    if (key !== null) {
+        if (isCredentialLabelName(key))
+            return true;
+        if (relax && isNonSecretFieldName(key) && isReadableWordChain(value))
+            return isKnownSecretSegment(value);
+    }
+    return isOpaqueSecretValue(value) || carriesCredentialStructure(value);
+}
+const UPLOAD_PROBE_PREFIX = 'https://q.invalid/?';
+const UPLOAD_SCAN_OPTIONS = Object.freeze({ urls: true, queryByShape: 'strict', words: true, blanks: false, fold: false, face: null, escapeSpaces: null });
+export function queryCarriesCredential(query) {
+    if (typeof query !== 'string' || query.length === 0)
+        return false;
+    const probe = `${UPLOAD_PROBE_PREFIX}${query}`;
+    return scanOnce(probe, UPLOAD_SCAN_OPTIONS, false).text !== probe;
+}
+export function displayConfiguredUrl(url, opts = {}) {
+    const out = renderUntrusted(typeof url === 'string' ? configuredUrlScannable(url) : url, opts, null, 'relaxed');
+    return typeof out === 'string' ? out : out.text;
+}
+function configuredUrlScannable(url) {
+    if (/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(url) || !/^[A-Za-z][A-Za-z0-9+.-]*:/.test(url))
+        return url;
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        return url;
+    }
+    if (u.host === '')
+        return url;
+    const userinfo = u.username !== '' || u.password !== '' ? `${u.username}${u.password !== '' ? `:${u.password}` : ''}@` : '';
+    return `${u.protocol}//${userinfo}${u.host}${u.pathname}${u.search}${u.hash}`;
+}
 export function quoteUntrustedForSentence(text, max) {
     const shown = displayUntrusted(text, { max, blanks: true, escapeBackslashes: true });
     return shown.trim() === '' ? undefined : `"${shown.replace(/"/g, '\\"')}"`;