redac---n 0.0.0-stage → 0.0.2

package/dist/urls.d.ts

@@ -0,0 +1,70 @@
+import { type Span } from "./syntax.ts";
+export interface Url {
+    start: number;
+    end: number;
+    /** `https`, `postgres`, …; "" for a path (`/reset/<token>`). */
+    scheme: string;
+    user?: Span;
+    password?: Span;
+    host?: Span;
+    /** The path's segments, without the slashes. */
+    segments: Span[];
+}
+export declare const URL_SCHEME: string;
+/**
+ * Where a URL that starts at `at` ends: at a blank, a quote, an angle bracket, a backtick, a backslash (a JSON
+ * string's escaped quote), or a closing bracket it didn't open (a Markdown link's `)`); sentence punctuation at its
+ * end isn't part of it (`…/reset/<token>.`). A password's brackets are (`app:p)dgbs@db`, `admin:<Harbor2291x>@host`).
+ * However long the password: each look-ahead for its `@` is remembered to where it stopped (`reachesAt`).
+ */
+export declare function urlEnd(text: string, at: number): number;
+/** Whether `value` starts with a URL with a scheme. */
+export declare const isUrl: (value: string) => boolean;
+/** The URL with a scheme that `value` starts with, read to where urlEnd ends it; undefined if it starts with none. */
+export declare function leadingUrl(value: string): Url | undefined;
+/** Whether `value` is, whole, one URL with a scheme and no password: an endpoint, a setting. */
+export declare function isPasswordlessUrl(value: string): boolean;
+/** The URLs in `text` with a scheme (`https://…`, `postgres://…`), and with `paths`, paths that start with a segment and a slash (`/reset/<token>`). */
+export declare function urls(text: string, { paths }?: {
+    paths?: boolean | undefined;
+}): Generator<Url>;
+/**
+ * Where the URL with a scheme that holds `text[at, end)` starts, looking back no further than `from`; -1 if that
+ * stretch isn't inside one. (The innermost: `?next=https://…/<token>` is inside the `next` URL.)
+ */
+export declare function urlAround(text: string, at: number, end?: number, from?: number): number;
+/**
+ * The user information starting at `at` in `url` (after `scheme://`, or a DSN's start): where the user ends, where the
+ * password starts (-1 for none), and where the `@` that ends it is; undefined if there is none. The password may hold
+ * `/`, `@`, `?` and `#` (`Sparrow2024?`, `Vq8#Lm2!`), but not a blank, nor a `?` or `#` after a `/` (that's a path's
+ * query: `host:443/docs?contact=ops@x`), nor a port and a path (`localhost:4873/@babel/core`); it ends at the first `@` whose host reaches `hostEnd` with no other `@`. An
+ * IPv6 host (`[::1]`) has none.
+ */
+export declare function readUserinfo(url: string, at: number, hostEnd?: RegExp): {
+    userEnd: number;
+    passwordStart: number;
+    end: number;
+} | undefined;
+export interface Param {
+    name: string;
+    value: Span;
+}
+/** A parameter's start and name: after `?`, `&` (or HTML's `&amp;`) or `#`, a name with PHP's `[]` allowed. */
+export declare const PARAM_START: string;
+export declare const PARAM_NAME: string;
+/**
+ * The `name=value` pairs in `text`: a URL's query and fragment (`#access_token=…`), a form body. A value ends at `&`,
+ * `#`, a blank, a quote, an angle bracket, a backtick or a backslash (JSON's `&` escape); closing parentheses it didn't
+ * open end it only at its end (`(see https://x.io/?k=abc)` is `abc`; a Markdown link's): `?key=Xk9(mP2)vQ7` is one value.
+ */
+export declare function queryParams(text: string, names?: string): Generator<Param>;
+/**
+ * The percent-encoded text in `text` that encodes text of its own (a URL in `redirect=`, JSON in a query, a sentence,
+ * in a log): each run decoded, `+` as a blank as forms write one, with the position in `text` of each decoded
+ * character (and one past the last). A run that encodes a single token is the random layer's (unnamed.ts
+ * `candidates`); one that isn't UTF-8 is left alone.
+ */
+export declare function percentEncoded(text: string): Generator<{
+    decoded: string;
+    map: number[];
+}>;

package/dist/urls.js

@@ -0,0 +1,303 @@
+/**
+ * URLs read into their parts, each with where it is: user and password, host, path segments; and the query
+ * parameters (`?name=value&…`) anywhere in a text, in a URL or a form body. One definition of where a URL and a
+ * parameter's value end, for every rule that reads them.
+ */
+import { lastText, lowerBound } from "./lines.js";
+import { MAX_VALUE, withoutUnopenedClosers } from "./syntax.js";
+/**
+ * A URL's scheme, as a regex source for use inside other patterns: `https`, `postgres`, `mongodb+srv`, SQLAlchemy's
+ * dialect and driver (`redshift+redshift_connector`, `oracle+cx_oracle`, whose drivers' names hold `_`). Two characters
+ * at least: a drive letter (`C://Users`) is none.
+ */
+const SCHEME_LENGTH = 41;
+export const URL_SCHEME = String.raw `[A-Za-z][\w+.-]{1,${SCHEME_LENGTH - 1}}`;
+/** A scheme and its `://` that starts a text. */
+const SCHEME = new RegExp(String.raw `^${URL_SCHEME}:\/\/`);
+/** A scheme, its `://` and the user information after it, to its first `/` or `@`. */
+const USERINFO = new RegExp(String.raw `${URL_SCHEME}:\/\/[^\s/@]*`, "y");
+/**
+ * Where a URL that starts at `at` ends: at a blank, a quote, an angle bracket, a backtick, a backslash (a JSON
+ * string's escaped quote), or a closing bracket it didn't open (a Markdown link's `)`); sentence punctuation at its
+ * end isn't part of it (`…/reset/<token>.`). A password's brackets are (`app:p)dgbs@db`, `admin:<Harbor2291x>@host`).
+ * However long the password: each look-ahead for its `@` is remembered to where it stopped (`reachesAt`).
+ */
+export function urlEnd(text, at) {
+    const open = { ")": 0, "]": 0 };
+    const closerIsPassword = reachesAt(text, /[^\s"'<>`\\/@]*(@)?/y);
+    const quoteIsPassword = reachesAt(text, /[^\s"<>`\\/@,;]*(@)?/y);
+    // A quote is a password's only in `scheme://user:password` (no `/` or `@` yet), not after a port (`host:5432'`).
+    USERINFO.lastIndex = at;
+    const userinfoEnd = USERINFO.exec(text) ? USERINFO.lastIndex : -1;
+    const colon = userinfoEnd < 0 ? -1 : text.indexOf(":", text.indexOf("://", at) + 3);
+    const bracketed = /<[^\s<>@"'`]+>@/y;
+    let end = at;
+    for (; end < text.length && end - at < MAX_VALUE; end++) {
+        const c = text[end];
+        if (c === "(")
+            open[")"]++;
+        else if (c === "[")
+            open["]"]++;
+        else if (c === ")" || c === "]") {
+            // (Before the `@` that ends a user and password, it's the password's: `postgres://app:p)dgbs@db`.)
+            if (open[c] === 0 && !closerIsPassword(end + 1))
+                break;
+            open[c] = Math.max(0, open[c] - 1);
+        }
+        else if (c === "<" && text[end - 1] === ":") {
+            bracketed.lastIndex = end;
+            if (!bracketed.test(text))
+                break;
+            end = bracketed.lastIndex - 1;
+        }
+        else if ((c === "'" || c === '"') &&
+            quoteIsPassword(end + 1) &&
+            colon >= 0 &&
+            colon < end &&
+            end <= userinfoEnd &&
+            !endsInPort(text, end)) {
+            // (In a password, before the `@` that ends it: `postgres://app:Kx9m'Qv2@db`, `postgres://app:Kx9m"Qv2@db`.)
+        }
+        else if (/[\s"'<>`\\]/.test(c))
+            break;
+    }
+    while (end > at && /[.,;:!?]/.test(text[end - 1]))
+        end--;
+    return end;
+}
+/**
+ * Whether the characters from `from` on, up to the first one `stop` doesn't take, are followed by an `@` (`stop` is a
+ * sticky pattern with the `@` as its one group). The answer holds for every `from` up to where that run stopped, so a
+ * URL of many brackets looks ahead once per run, not once per bracket.
+ */
+function reachesAt(text, stop) {
+    let runEnd = -1;
+    let found = false;
+    return (from) => {
+        if (from > runEnd) {
+            stop.lastIndex = from;
+            found = stop.exec(text)[1] !== undefined;
+            runEnd = stop.lastIndex - (found ? 1 : 0);
+        }
+        return found;
+    };
+}
+/** Whether the text before `end` ends in a port (`:5432`, digits after a colon). */
+function endsInPort(text, end) {
+    let digits = end;
+    while (digits > 0 && text[digits - 1] >= "0" && text[digits - 1] <= "9")
+        digits--;
+    return digits < end && text[digits - 1] === ":";
+}
+/** Whether `value` starts with a URL with a scheme. */
+export const isUrl = (value) => SCHEME.test(value);
+/** The URL with a scheme that `value` starts with, read to where urlEnd ends it; undefined if it starts with none. */
+export function leadingUrl(value) {
+    return isUrl(value) ? parseUrl(value, 0, urlEnd(value, 0)) : undefined;
+}
+/** Whether `value` is, whole, one URL with a scheme and no password: an endpoint, a setting. */
+export function isPasswordlessUrl(value) {
+    const url = leadingUrl(value);
+    return !!url && url.end === value.length && !url.password;
+}
+/** The URLs in `text` with a scheme (`https://…`, `postgres://…`), and with `paths`, paths that start with a segment and a slash (`/reset/<token>`). */
+export function* urls(text, { paths = false } = {}) {
+    const start = paths
+        ? new RegExp(String.raw `\b${URL_SCHEME}:\/\/|(?<![\w.:/])\/[\w.-]{1,80}\/`, "g")
+        : new RegExp(String.raw `\b${URL_SCHEME}:\/\/`, "g");
+    // (exec, not matchAll, which iterates a copy: the next URL is looked for after this one ends.)
+    for (let m = start.exec(text); m; m = start.exec(text)) {
+        const end = urlEnd(text, m.index);
+        yield parseUrl(text, m.index, end);
+        start.lastIndex = Math.max(start.lastIndex, end);
+    }
+}
+/** Where each `://` of a text is, in order: found once a text, so the URL around a position is a binary search away. */
+const schemeSeparators = lastText((text) => {
+    const out = [];
+    for (let i = text.indexOf("://"); i >= 0; i = text.indexOf("://", i + 1))
+        out.push(i);
+    return out;
+});
+/** A scheme that ends a text, as a whole word. */
+const SCHEME_BEFORE = new RegExp(String.raw `(?<![\w+.-])${URL_SCHEME}$`);
+/**
+ * Where the URL with a scheme that holds `text[at, end)` starts, looking back no further than `from`; -1 if that
+ * stretch isn't inside one. (The innermost: `?next=https://…/<token>` is inside the `next` URL.)
+ */
+export function urlAround(text, at, end = at, from = Math.max(0, at - 4096)) {
+    // (A stretch may start at the `//` itself: `https:` then `//<host>`.)
+    const seps = schemeSeparators(text);
+    const sep = seps[lowerBound(seps, at) - 1] ?? -1;
+    if (sep < from)
+        return -1;
+    // (A scheme's characters and the one before it.)
+    const scheme = SCHEME_BEFORE.exec(text.slice(Math.max(from, sep - SCHEME_LENGTH - 1), sep));
+    if (!scheme)
+        return -1;
+    const start = sep - scheme[0].length;
+    return urlEnd(text, start) >= end ? start : -1;
+}
+/**
+ * A URL's parts. The authority's user information, as clients read it: a user with no `/?#@:` (or an email address
+ * before a `:`, `writer@proj.iam.gserviceaccount.com:pw@host`), then `@`, or `:` and a password that runs to the first
+ * `@` whose host runs to a `/`, `?`, `#` or the end with no other `@`, so a generated password may hold `@` and `/`
+ * (`app:Xk9/mQ@2pL@host`). An `@` in the path or the query (`?email=bob@example.com`, `react@18.3.1`) is not a user's.
+ */
+function parseUrl(text, start, end) {
+    const url = text.slice(start, end);
+    // (A scheme starts the URL: a path's `?next=https://…` is its query's.)
+    const sep = isUrl(url) ? url.indexOf("://") : -1;
+    const scheme = sep > 0 ? url.slice(0, sep) : "";
+    let at = sep > 0 ? sep + 3 : 0;
+    const span = (from, to) => ({
+        value: url.slice(from, to),
+        start: start + from,
+        end: start + to,
+    });
+    const out = { start, end, scheme, segments: [] };
+    if (scheme) {
+        const userinfo = readUserinfo(url, at);
+        if (userinfo) {
+            out.user = span(at, userinfo.userEnd);
+            if (userinfo.passwordStart >= 0)
+                out.password = span(userinfo.passwordStart, userinfo.end);
+            at = userinfo.end + 1;
+        }
+        const hostEnd = url.slice(at).search(/[/?#]|$/) + at;
+        out.host = span(at, hostEnd);
+        at = hostEnd;
+    }
+    const pathEnd = url.slice(at).search(/[?#]|$/) + at;
+    for (let s = at; s < pathEnd;) {
+        const slash = url.indexOf("/", s + 1);
+        const segEnd = slash < 0 || slash > pathEnd ? pathEnd : slash;
+        if (url[s] === "/")
+            s++;
+        if (segEnd > s)
+            out.segments.push(span(s, segEnd));
+        s = segEnd;
+    }
+    return out;
+}
+/**
+ * The user information starting at `at` in `url` (after `scheme://`, or a DSN's start): where the user ends, where the
+ * password starts (-1 for none), and where the `@` that ends it is; undefined if there is none. The password may hold
+ * `/`, `@`, `?` and `#` (`Sparrow2024?`, `Vq8#Lm2!`), but not a blank, nor a `?` or `#` after a `/` (that's a path's
+ * query: `host:443/docs?contact=ops@x`), nor a port and a path (`localhost:4873/@babel/core`); it ends at the first `@` whose host reaches `hostEnd` with no other `@`. An
+ * IPv6 host (`[::1]`) has none.
+ */
+export function readUserinfo(url, at, hostEnd = /[/?#]/) {
+    if (url[at] === "[")
+        return undefined;
+    // A service account's email as the user, if a password follows it.
+    const email = /^[\w.+-]{1,64}@[\w-]{1,63}(?:\.[\w-]{1,63}){1,8}(?=:)/.exec(url.slice(at, at + 200));
+    const withEmail = email && password(url, at, at + email[0].length, hostEnd);
+    if (withEmail)
+        return withEmail;
+    const userEnd = at + url.slice(at).search(/[/?#@:\s]|$/);
+    return url[userEnd] === "@" ? { userEnd, passwordStart: -1, end: userEnd } : password(url, at, userEnd, hostEnd);
+}
+/** A `:` at `userEnd` and the password after it, to its `@`. */
+function password(url, userStart, userEnd, hostEnd) {
+    // (`host:5432/path@ref`: a port, not a password.)
+    if (url[userEnd] !== ":" || /^\d{1,5}(?:[/?#]|$)/.test(url.slice(userEnd + 1, userEnd + 8)))
+        return undefined;
+    let a = -1;
+    let slash = false;
+    for (let i = userEnd + 1; i < url.length && !/\s/.test(url[i]) && !(slash && a < 0 && /[?#]/.test(url[i])); i++) {
+        if (url[i] === "/" && a < 0)
+            slash = true;
+        if (url[i] === "@")
+            a = i;
+        // The host after the last `@` ended with no `@` in it.
+        else if (a >= 0 && hostEnd.test(url[i]))
+            break;
+    }
+    if (a < 0)
+        return undefined;
+    // `git.example.com:org/repo@v1.2`: a host, a path and a ref (no host after the `@`), not a user and a password.
+    const after = url.slice(a + 1).split(/[/?#]/)[0];
+    if (slash && /^[\w-]+(?:\.[\w-]+)+$/.test(url.slice(userStart, userEnd)) && !isHost(after))
+        return undefined;
+    return { userEnd, passwordStart: userEnd + 1, end: a };
+}
+/** A host as a URL names one: a domain with a TLD (`db.internal`, `example.com`), an IPv4 address, a name and a port. */
+const isHost = (h) => /^(?:[\w-]+\.)+[A-Za-z][\w-]*(?::\d{1,5})?$|^\d{1,3}(?:\.\d{1,3}){3}(?::\d{1,5})?$|^[\w-]+:\d{1,5}$/.test(h);
+/** A parameter's start and name: after `?`, `&` (or HTML's `&amp;`) or `#`, a name with PHP's `[]` allowed. */
+export const PARAM_START = String.raw `(?:&amp;|[?&#])`;
+export const PARAM_NAME = String.raw `[\w.\[\]-]{1,60}`;
+/**
+ * The `name=value` pairs in `text`: a URL's query and fragment (`#access_token=…`), a form body. A value ends at `&`,
+ * `#`, a blank, a quote, an angle bracket, a backtick or a backslash (JSON's `&` escape); closing parentheses it didn't
+ * open end it only at its end (`(see https://x.io/?k=abc)` is `abc`; a Markdown link's): `?key=Xk9(mP2)vQ7` is one value.
+ */
+export function* queryParams(text, names = PARAM_NAME) {
+    for (const m of text.matchAll(new RegExp(String.raw `${PARAM_START}(${names})=([^&#\s"'<>\`\\]+)`, "dgi"))) {
+        const value = withoutUnopenedClosers(m[2], ")");
+        if (!value)
+            continue;
+        const start = m.indices[2][0];
+        yield { name: m[1], value: { value, start, end: start + value.length } };
+    }
+}
+const UTF8 = new TextEncoder();
+/**
+ * A run of what percent-encoding leaves as it is and `%XX` escapes, matched whole (each run once: linear), and kept
+ * when it holds an escape: an encoded URL, query or JSON.
+ */
+const PERCENT_RUN = /(?:[A-Za-z0-9_.~+-]|%[0-9A-Fa-f]{2})+/g;
+/**
+ * The percent-encoded text in `text` that encodes text of its own (a URL in `redirect=`, JSON in a query, a sentence,
+ * in a log): each run decoded, `+` as a blank as forms write one, with the position in `text` of each decoded
+ * character (and one past the last). A run that encodes a single token is the random layer's (unnamed.ts
+ * `candidates`); one that isn't UTF-8 is left alone.
+ */
+export function* percentEncoded(text) {
+    if (!text.includes("%"))
+        return;
+    const utf8 = new TextDecoder("utf-8", { fatal: true });
+    for (const m of text.matchAll(PERCENT_RUN)) {
+        const run = m[0];
+        if (!run.includes("%"))
+            continue;
+        let decoded = "";
+        const map = [];
+        let ok = true;
+        for (let i = 0; i < run.length && ok;) {
+            if (run[i] !== "%") {
+                decoded += run[i] === "+" ? " " : run[i];
+                map.push(m.index + i++);
+                continue;
+            }
+            // (A run of escapes is decoded as UTF-8 together, each character mapped to its first byte's escape.)
+            const bytes = [];
+            const at = [];
+            while (run[i] === "%") {
+                bytes.push(parseInt(run.slice(i + 1, i + 3), 16));
+                at.push(m.index + i);
+                i += 3;
+            }
+            let chars = "";
+            try {
+                chars = utf8.decode(new Uint8Array(bytes));
+            }
+            catch {
+                ok = false;
+            }
+            let byte = 0;
+            for (const c of chars) {
+                decoded += c;
+                for (let k = 0; k < c.length; k++)
+                    map.push(at[byte]);
+                byte += UTF8.encode(c).length;
+            }
+        }
+        // (Text of its own: a URL, a path, pairs, JSON, words. A token with a `:`, a `/` or base64's padding in it is a
+        // token: `<id>:<time>`, `+TGFu…3M=`.)
+        if (!ok || decoded.length < 12 || !/[?&{"@ ]|:\/\/|^\/\w|=(?!=*$)/.test(decoded))
+            continue;
+        map.push(m.index + run.length);
+        yield { decoded, map };
+    }
+}

package/dist/values.d.ts

@@ -0,0 +1,178 @@
+/**
+ * Tests on a value that sits under a credential name: is it a literal secret, or something that only
+ * stands in for one (a reference, a template, a placeholder, a mask, code)? Agents read config and
+ * code full of `password: ${DB_PASSWORD}` and `api_key = os.environ["KEY"]`; hiding those costs the
+ * agent the structure it needs and protects nothing.
+ */
+/** An identifier path: `config.db.password`, `cfg?.pw`, `$this->password`, `Settings::SECRET`. */
+export declare const IDENT_PATH: string;
+/** Strips quotes, a trailing comma or semicolon, and an inline comment from a raw value. */
+export declare function cleanValue(raw: string): string;
+/**
+ * Words, short numbers and short IDs joined by separators: names like `acme-prod-uploads-2024`,
+ * `refs/pull/482/merge` or `--max-old-space-size=4096`, not keys.
+ */
+export declare function isWordy(value: string): boolean;
+/**
+ * Identifier segments that read as names (a word's case, or short): `md5`, `htmlspecialchars`, `jmat.gId`, not
+ * `IWNwpPK.QC.BXh`, nor humps a generator's case flips made (`hqArruGhkoRtvpQplEac`).
+ */
+export declare function isNameLike(path: string): boolean;
+/** Which inert shape a value has (INERT_SHAPES), if any. (Written in markup's escapes, a shape is that shape: `<redacted>`.) */
+export declare function inertShape(value: string): string | undefined;
+/** A value that can't be a credential: empty, a boolean, a path, a placeholder or a reference to one held elsewhere. */
+export declare function isInert(value: string): boolean;
+/** A file path: path-shaped, with no segment that a generator made (`/NKR7uXt0UfYN9/`, `/eB7/ZDoDhDrnTAZWfbkgNMM`). */
+export declare function isPath(path: string): boolean;
+/**
+ * A path segment a generator made, not a person: one that mixes cases and digits and is long, isn't a name, or has a
+ * symbol no name has (`Tv$-ycX.K9+`); mixed-case letters that read as no word, lower-cased (`ZDoDhDrnTAZWfbkgNMM`:
+ * the character model reads each camel-case hump on its own, and random humps often score as words); or a `+`
+ * inside mixed-case letters, base64's (`GbeaKB+qGmA+X`; mkcert's `localhost+2-key.pem` is one case, `c++` ends with it).
+ */
+export declare function isGeneratedSegment(seg: string): boolean;
+/**
+ * Most of a value's letters are in words: its runs of letters (camel-case humps apart) of three or more read as
+ * words or as code's abbreviations, and hold two thirds of its letters. `env(DATABASE_URL)`, `CORP\svc_deploy`,
+ * `logger.warning(` do; `JujvAIngWfOqw`, `)AM{?NfoSuFiMi.s` don't.
+ */
+export declare function readsAsWords(value: string): boolean;
+/**
+ * A value made of words, run together or joined by `_` or `-` (`required`, `not-set`, `sameorigin`, `Bearer`), as
+ * opposed to random letters, which have no digit by chance (`XGxAdcVIefCUMAVsDhkYhErsQwPz`,
+ * `kXbQzMwRpLtY-vNcDhJsGfWqZr_mKdTy`): every part of three letters or more reads as a word.
+ */
+export declare function isWordsValue(value: string): boolean;
+/**
+ * A token a generator made, by its characters alone: 16 or more of a token's alphabet, with letters, random as the
+ * character model reads it lower-cased, and not half words. Hex with digits is one whatever the model reads in its
+ * letters (`cafe`, `dead`). Fewer than one random token in two hundred fails this at 16 characters (hex with one
+ * letter reads as a number), one in ten thousand at 32; words run together (`reset-password-confirm`, `ProjectSettingsPage`), with numbers in them
+ * (`VerifyEmailPage2024.tsx`, `sso-saml-setup-v2`), and a date with a letter in it (`2024-01-15T10-30-00`) pass.
+ */
+export declare function isRandomToken(v: string, min?: number): boolean;
+/**
+ * A credential's name written as an identifier and ending in its credential word (`set_guest_wifi_password`,
+ * `DB_PASSWORD`, `githubToken`): a value that names a credential, not one. (Not kebab-case, which passwords are written
+ * in too, `test-pass-123`; nor a passphrase in title case, `FluffyBunnyPassword`; nor one that only holds the word,
+ * `verde_dev_pw`, `admin_pass1`.)
+ */
+export declare function namesCredential(value: string): boolean;
+/** Brackets that close in order: `f(a[0], {b})`, not `Ssaw(53n9DYc!(l7)`. (Quotes aren't tracked.) */
+export declare function isBalanced(s: string): boolean;
+/**
+ * A type as a declaration writes one, in Python, TypeScript, Go, Rust, Kotlin, Java or C#: a name, maybe qualified, with
+ * its arguments (`Optional[str]`, `Dict[str, Any]`, `Map<String, String>`, `Vec<u8>`) and marks (`string[]`, `String?`,
+ * `[]byte`, `*string`, `char*`, `&'a str`, `String!`), in a union (`str | None`, `string | null`; not an intersection,
+ * `Path&Ember&winter` is a passphrase), a tuple, a function's type (`() => string`) or a type query (`typeof DEFAULT`).
+ * One of its names at least is a type the language builds in, and every other reads as a name:
+ * `Optional[PasswordData]` is a type, `Summer|Winter`, `Hunter2!` and `Optional[Xk9mQ2vL]` aren't. With `classes`, a
+ * class named as types are (TYPE_CLASS) counts as built in: `"any"` where code is written; `"marked"` in a literal
+ * context, where a name alone is a type only by a type's own ending, `SecretStr`, `PasswordField` (`LittleSecret` is a
+ * passphrase there, and `Uint8Array` alone may be a password), but `Optional[ClientSecret]` is a type.
+ */
+export declare function isTypeExpression(value: string, classes?: "none" | "marked" | "any"): boolean;
+/**
+ * Code rather than a literal value: an environment lookup, a call, member access, a variable.
+ * Quoted strings are literals, unless built from code. Each shape below is code in any context; in a literal context
+ * (`NAME=value` in env, `key: value` in YAML, a CLI flag) only REFERENCES are code besides; elsewhere CODE_ONLY too,
+ * where an unquoted lower-case word without digits is taken as a variable (`password = userPassword`; with digits,
+ * `PASSWORD=hunter2` in a .env, it's a literal).
+ */
+export declare function isCode(raw: string, literal?: boolean): boolean;
+/**
+ * Digits in groups, six or more of them, as a PIN or a phone number is written: `4821-7730`, `0171 555 2368`. Under a
+ * password's or a PIN's name, that is the password; elsewhere an ID. (`12/12`, `8-64`, `1.2.3` are counts, lengths and
+ * versions under any name, and an ISO date is the date a listing shows: `password: 2024-05-01`, when it was set.)
+ */
+export declare function isGroupedDigits(value: string): boolean;
+/**
+ * Password hashes in text, as a global search: each format's whole shape, every `$` possibly doubled (Compose escapes
+ * it: `$$2y$$10$$…`), with no hash character on either side (a full stop after it ends a sentence, unless more hash follows).
+ */
+export declare const PASSWORD_HASH_IN_TEXT: RegExp;
+/** Password hashes: bcrypt, argon2, scrypt, crypt(3), Django, LDAP. Sensitive, but not a credential anyone can use. */
+export declare function isPasswordHash(value: string): boolean;
+/**
+ * Digits as a stand-in writes them: one or two, a count (`123`, `1234`, `6789`) or one digit repeated (`000`). A real
+ * password's digits are arbitrary (`Example7392`).
+ */
+export declare function isCountingDigits(digits: string): boolean;
+/** A stand-in credential from a test or a doc: only test words and a few digits as a stand-in writes them. */
+export declare function isTestValue(value: string): boolean;
+/**
+ * Names built from short parts: `BOB_sect163r2`, `KAS-ECC-CDH_P-256_C14`, `ED448-1-PUBLIC-Raw`, `ALICE_cf_c2pnb368w1`,
+ * `us-east-1a`, `login_and_password_removed`. The first part starts with a letter, and every part reads as a name
+ * part: short, a number, lower-case hex, a word, an acronym, letters then digits (`amd64`, `SECP521R1`), or a word then
+ * a code (`brainpoolP224r1`). Beside a word (`ALICE`, `PUBLIC`), any part of one case with digits is a code
+ * (`c2pnb368w1`). A random part mixes cases with digits (`JWPa`, `Xk9mP2`), and a product key's groups are random
+ * letters and digits of one length (`VKXQR-8B2MP-7WJ4T`): not names.
+ */
+export declare function isIdentifierShaped(value: string): boolean;
+/**
+ * A Kubernetes pod's name: its workload's name, then the generated suffixes of a ReplicaSet (6–10 characters)
+ * and of the pod (5): `ledger-api-58d4f7c9b-rbjl3`, `search-i12seefem-wq3g4`. (A word in the workload's name: its first
+ * part may be none, `k8s-agent-…`.)
+ */
+export declare function isPodName(value: string): boolean;
+/**
+ * A lower-case letter, a capital and a digit: the classes a password rule asks for, in a password made of words
+ * (`Maple-Orbit-42`, `Harvest2025`) or by a generator (`Xk9mP2vQ7`).
+ */
+export declare function hasThreeClasses(value: string): boolean;
+/**
+ * A password made to a password rule's demands: eight characters or more of three classes, a symbol among them (not
+ * only a name's `.` `_` `-`), and neither code nor words: `CANYpfso8s%`, `Harbor2291!`.
+ */
+export declare function isMadePassword(value: string): boolean;
+/**
+ * Names of algorithms, encodings and formats that sentences about credentials mention: `password (UTF-8)`, `SHA-256`;
+ * and password hashers as libraries name them: Django's `pbkdf2_sha256`, `bcrypt_sha256`, passlib's `sha512_crypt`.
+ */
+export declare const ALGORITHM: RegExp;
+/** A number with the word that counts in CJK: `6位`, `8文字`, `3回`, `8자`, `2번`. */
+export declare const CJK_COUNT: RegExp;
+/**
+ * A quantity written with its unit: a ratio (`3.52x`), a price (`~$280`), a test count and its share (`40/42 —
+ * 95.2%`). Benign, except under a password's name, where `1337x` and `$4821` are what was chosen. (A PIN's value is
+ * digits: named.ts proposes no other.)
+ */
+export declare const QUANTITY: RegExp;
+/**
+ * Values that are never a secret, whatever names them and whichever rule read them: counts, ratios and
+ * percentages (`12/12`, `98.5%`), ranges (`8-64`), versions (`v2.4.1`), dates and times, algorithm and
+ * encoding names, key chords (`ctrl+shift+F12`, `ctrl-p,ctrl-q`), type annotations (`str|None`), cloud regions, the
+ * words of a password rule (`min.`, `at least`), and code or markup that a reader can take for a value: regular
+ * expressions, package and class paths, IAM actions (`iam:ChangePassword`), XAML bindings, HTML elements, tickets
+ * (`[GH-784]`), hash schemes (`md5$`), short escaped or percent-encoded bytes, hex numbers, constants and the brackets
+ * after them (`None):`). Every name- and structure-based finding passes this
+ * gate (policy.ts keepReason), so a new rule can't bring back an over-redaction another rule already ruled out.
+ * Values from secret files and formats don't: there the file or the vendor format says what it is.
+ */
+export declare function isBenignValue(value: string): boolean;
+/**
+ * Unquoted code that refers to a credential by name, maybe ending its statement: `account.password`, `m_password;`,
+ * `md5($password);`, `secrets.db` (policy.ts, for unquoted values only). (Not a credential's member, `passwords.pop`,
+ * `txtPassword.Text`: under an env line's name that may be the password.)
+ */
+export declare function isCredentialReference(value: string): boolean;
+/**
+ * What an encryption tool writes before its ciphertext: SOPS `ENC[AES256_GCM,data:`, Jasypt `ENC(`, Spring Cloud
+ * Config `{cipher}`, Vault's `${VAULT::…::`, IIS configuration encryption `[enc:IISCngProvider:`, DigitalOcean App
+ * Platform's `EV[1:<nonce>:`. A value that starts with one (ENCRYPTED_VALUE), or a token right after one (the random
+ * layer's `encrypted` veto), is ciphertext, whose key isn't there.
+ */
+export declare const ENCRYPTION_WRAPPER: string;
+/** Default passwords and words that show up in ordinary output, too common to be anyone's secret. */
+export declare const COMMON_WORDS: Set<string>;
+/**
+ * Whether a value under a credential name is a literal secret worth hiding: not a type, a placeholder,
+ * a reference, code, a lone word or a number. (A password hash, and text in another script, are the decision stage's
+ * to keep: policy.ts keepReason, isBenignValue.)
+ */
+export declare function looksSecret(raw: string, literal?: boolean): boolean;
+/**
+ * Analytics, consent, load-balancer and preference cookies: `_ga=GA1.1.35…`, `_gid`, `_fbp`, `AWSALB`, `__cf_bm`,
+ * PostHog's `ph_…_posthog`, a locale or a theme. Not a session.
+ */
+export declare const ANALYTICS_COOKIE: RegExp;