redac---n 0.0.4 → 0.0.5

package/dist/names.d.ts

@@ -1,7 +1,11 @@
 /** Every spelling of "password" (PASSWORD_LANGUAGES), and those of languages other than English. */
 export declare const PASSWORD_SPELLINGS: string[];
 export declare const FOREIGN_PASSWORD_SPELLINGS: string[];
-/** The words of a name in upper case: `clientSecret` → CLIENT, SECRET; `x-api-key` → X, API, KEY. */
+/**
+ * The words of a name in upper case: `clientSecret` → CLIENT, SECRET; `x-api-key` → X, API, KEY. A compound some
+ * write as two words is one (`PassPhrase`, `pass_word`, `ClearTextPassword` → CLEARTEXT, PASSWORD), as it is written
+ * glued: its halves alone say something else (`PHRASE` a seed phrase, `TEXT` UI text).
+ */
 export declare function words(name: string): string[];
 /**
  * Whether a name names a session or its ID, whoever's session it is: `INSTAGRAM_SESSION_ID`, `LINKEDIN_SESSION`,

package/dist/names.js

@@ -48,6 +48,11 @@ const PASSWORD_LANGUAGES = [
             "parole",
             "slaptažodis",
             "fjalëkalimi",
+            "fjalëkalim",
+            "salasõna",
+            "lykilorð",
+            "nenosiri",
+            "zaporka",
             "kupuhipa",
             "focal faire",
             "mật khẩu",
@@ -133,7 +138,7 @@ const CREDENTIAL_WORDS = new Set([
     "SK",
 ]);
 /** Single words that end in a credential word: PGPASSWORD, AUTHKEY, WRITEKEY, APITOKEN. */
-const CREDENTIAL_SUFFIX = /(PASSWORD|PASSWD|PASSPHRASE|PASSCODE|TOKEN|SECRET|APIKEY|AUTH|AUTHKEY|WRITEKEY|READKEY|SECRETKEY|PRIVATEKEY|ACCESSKEY|SESSID|SESSIONID|PASS|PWD|APPKEY|MASTERKEY|SIGNINGKEY|ENCRYPTIONKEY|LICENSEKEY|DEVKEY|USERKEY)$/;
+const CREDENTIAL_SUFFIX = /(PASSWORD|PASSWD|PASSPHRASE|PASSCODE|TOKEN|SECRET|APIKEY|AUTH|AUTHKEY|WRITEKEY|READKEY|SECRETKEY|PRIVATEKEY|ACCESSKEY|SESSID|SESSIONID|PASS|PWD|PW|APPKEY|MASTERKEY|SIGNINGKEY|ENCRYPTIONKEY|LICENSEKEY|DEVKEY|USERKEY)$/;
 /** Last words that describe a form of the word before: `client-key-data`, `SECRET_B64`, `secret_key_base`. */
 const WRAPPER_WORDS = new Set([
     "DATA",
@@ -151,6 +156,7 @@ const WRAPPER_WORDS = new Set([
     "BYTES",
     "PLAIN",
     "PLAINTEXT",
+    "CLEARTEXT",
 ]);
 /** Last words that only qualify the word before: `API_KEY_V2`, `DB_PASSWORD_PROD`. */
 const QUALIFIER_WORDS = /^(V\d+|\d+|PROD|PRODUCTION|DEV|DEVELOPMENT|STAGING|STAGE|TEST|LIVE|OLD|NEW|PREVIOUS|PREV|CURRENT|NEXT|PRIMARY|SECONDARY|BACKUP|FALLBACKS?|ROTATED|LOCAL|REMOTE|DEFAULT|SANDBOX|QA|UAT|INT|EXT|ADMIN|ROOT|MASTER|CONFIRM|CONFIRMATION|AGAIN|REPEAT|VERIFY|VERIFICATION)$/;
@@ -297,6 +303,7 @@ const NOT_CREDENTIAL_BEFORE = lookup({
         "COUNT",
         "LEXER",
         "PARSER",
+        "SHELL",
         "CANCELLATION",
         "CANCEL",
         "INPUT",
@@ -363,7 +370,6 @@ const NOT_CREDENTIAL_BEFORE = lookup({
         "ALWAYS",
         "STRICT",
         "NEEDS",
-        "HTTP",
         "SASL",
         "LDAP",
         "OIDC",
@@ -407,6 +413,8 @@ const IDENTIFIER_WORDS = new Set([
     "ACCOUNT",
     "TENANT",
     "ORG",
+    "ORGANIZATION",
+    "ORGANISATION",
     "TEAM",
     "CHANNEL",
     "STYLE",
@@ -414,6 +422,7 @@ const IDENTIFIER_WORDS = new Set([
     "UUID",
     "GUID",
     "REF",
+    "REFERENCE",
     "KIND",
     "TYPE",
     "MODE",
@@ -476,6 +485,9 @@ const HASH_WORDS = new Set([
     "COMMIT",
     "REV",
     "REVISION",
+    // (A release is the build's commit or version: Sentry's, Langfuse's, Bugsnag's `SENTRY_RELEASE=<sha>`.)
+    "RELEASE",
+    "VCS",
     "FINGERPRINT",
     "CRC",
     "CRC32",
@@ -578,6 +590,7 @@ const ABOUT_WORDS = new Set([
     "VALIDATION",
     "VALIDATOR",
     "POLICY",
+    "POLICIES",
     "RULE",
     "RULES",
     "ICON",
@@ -603,7 +616,6 @@ const ABOUT_WORDS = new Set([
     "FAILED",
     "FAILURE",
     "MISMATCH",
-    "MATCH",
     "CHANGED",
     "RESET",
     "EMPTY",
@@ -627,13 +639,35 @@ const ABOUT_WORDS = new Set([
 ]);
 /** About words that can also say what a credential belongs to. */
 const ROUTE_WORDS = new Set(["PAGE", "SCREEN", "ROUTE", "VIEW", "EVENT", "HANDLER", "DIALOG", "MODAL", "STATUS"]);
+/**
+ * About words that are also nouns a component is named with, its name's first half (`LABEL_STUDIO_PASSWORD`,
+ * `EVENT_STORE_PASSWORD`, `MESSAGE_BROKER_PASSWORD`, `STATUS_DB_PASSWORD`, `HELP_DESK_PASSWORD`): they make a name
+ * about its credential only next to its word, or with qualifiers between (`LABEL_NEW_PASSWORD`, `LOGIN_PAGE_PASSWORD`).
+ */
+const NOUN_ABOUT_WORDS = new Set([
+    ...ROUTE_WORDS,
+    "LABEL",
+    "LABELS",
+    "MSG",
+    "MESSAGE",
+    "MESSAGES",
+    "TEXT",
+    "RULE",
+    "RULES",
+    "POLICY",
+    "HELP",
+]);
 /**
  * Shell variables whose names end in a credential word but hold something else (`PWD`, `OLDPWD`),
  * bare upper-case `KEY` and `AUTH` (loop keys, auth modes) and `PASS`, `XPASS` (`PASS: test name`, a test runner's
  * verdicts; named.ts still reads `PASS=value`).
  */
 const NOT_CREDENTIAL_NAMES = new Set(["PWD", "OLDPWD", "AUTH", "KEY", "PASS", "XPASS"]);
-/** The words of a name in upper case: `clientSecret` → CLIENT, SECRET; `x-api-key` → X, API, KEY. */
+/**
+ * The words of a name in upper case: `clientSecret` → CLIENT, SECRET; `x-api-key` → X, API, KEY. A compound some
+ * write as two words is one (`PassPhrase`, `pass_word`, `ClearTextPassword` → CLEARTEXT, PASSWORD), as it is written
+ * glued: its halves alone say something else (`PHRASE` a seed phrase, `TEXT` UI text).
+ */
 export function words(name) {
     // (Accents dropped first, so `contraseña` is CONTRASENA and `hasło` HASLO, as CREDENTIAL_WORDS spells them.)
     return name
@@ -643,6 +677,7 @@ export function words(name) {
         .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
         .replace(/([A-Z])([A-Z][a-z])/g, "$1_$2")
         .toUpperCase()
+        .replace(/(?<![\p{L}\p{N}])(?:(PASS)[^\p{L}\p{N}]+(WORD|WD|PHRASE|CODE)|(CLEAR|PLAIN)[^\p{L}\p{N}]+(TEXT))(?![\p{L}\p{N}])/gu, "$1$2$3$4")
         .split(/[^\p{L}\p{N}]+/u)
         .filter(Boolean);
 }
@@ -891,17 +926,16 @@ const PASSWORD_WORDS = new Set([
 ]);
 /**
  * Whether a name's word names a password: "password" in any language, or one glued to the word before it (`PGPASSWORD`,
- * `adminpasswd`, `DBPASSCODE`); the short `PASS`, `PWD` and Redis's `AUTH` glued only after what they belong to
- * (`REDISPASS`, `ROOTPWD`, `masterauth`; not `bypass`, `OAuth`), as isCredentialWord reads them.
+ * `adminpasswd`, `DBPASSCODE`); the short `PASS`, `PWD`, `PW` and Redis's `AUTH` glued only after what they belong to
+ * (`REDISPASS`, `JKSPASS`, `ROOTPWD`, `rootpw`, `masterauth`; not `bypass`, `OAuth`), as isCredentialWord reads them.
  */
 function isPasswordWord(word) {
     if (PASSWORD_WORDS.has(word))
         return true;
-    const glued = /(PASSWORD|PASSWD|PASSPHRASE|PASSCODE|PASS|PWD|AUTH)$/.exec(word);
+    const glued = /(PASSWORD|PASSWD|PASSPHRASE|PASSCODE|PASS|PWD|PW|AUTH)$/.exec(word);
     if (!glued)
         return false;
-    const head = word.slice(0, glued.index);
-    return /^PASS(?:WORD|WD|PHRASE|CODE)$/.test(glued[1]) || PASSWORD_OWNERS.has(head) || isVendorName(head);
+    return /^PASS(?:WORD|WD|PHRASE|CODE)$/.test(glued[1]) || ownsGlued(word.slice(0, glued.index), glued[1]);
 }
 /**
  * A credential's name written as a phrase of words, as one word or several: `mot_de_passe` and `palavra_passe` (a
@@ -978,7 +1012,8 @@ const PIN_SETTING = /^(?:TIMEOUT|TTL|EXPIRY|EXPIRES|EXPIRATION|SECONDS|SECS|MS|M
  * named for what it opens (`alarm_code`). namesPasswordOrPin, the name readers and the prose readers all ask this one.
  */
 export function isPinName(name) {
-    const w = words(name);
+    // (A numbered one is one too: `pin1`, `door_pin2`.)
+    const w = words(name).map((x) => x.replace(/(?<=^PIN)\d+$/, ""));
     const at = w.findIndex((x, i) => (x === "PIN" && !NOT_CREDENTIAL_BEFORE.PIN.has(w[i - 1] ?? "")) || x === "PINCODE" || x === "PASSCODE");
     if (at >= 0)
         return !w.slice(at + 1).some((x) => PIN_SETTING.test(x) || (x !== "CODE" && isCredentialWord(x)));
@@ -1084,9 +1119,89 @@ const PASSWORD_OWNERS = new Set([
     "BASIC",
     "BEARER",
 ]);
+/**
+ * Words `PASS` ends glued to them that are no password's owner: English words (`bypass`, `compass`, `overpass`,
+ * `trespass`), filters (`lowpass`, `bandpass`), a renderer's or a compiler's passes (`subpass`, `renderpass`,
+ * `multipass`, `numpass`), passes that admit a person (`daypass`, `boardingpass`) or products (`KeePass`, `LastPass`,
+ * `gopass`, `NordPass`), and programs or directives about a password (`GIT_ASKPASS`, `getpass`, Redis' `resetpass`).
+ */
+const NOT_PASSWORD_OWNERS = new Set([
+    "BY",
+    "COM",
+    "ENCOM",
+    "OVER",
+    "UNDER",
+    "TRES",
+    "SUR",
+    "RE",
+    "PRE",
+    "OUT",
+    "MIS",
+    "LOW",
+    "HIGH",
+    "BAND",
+    "ALL",
+    "NOTCH",
+    "SUB",
+    "MULTI",
+    "SINGLE",
+    "FIRST",
+    "SECOND",
+    "THIRD",
+    "FINAL",
+    "LAST",
+    "NEXT",
+    "PREV",
+    "ONE",
+    "TWO",
+    "DOUBLE",
+    "NUM",
+    "MAX",
+    "MIN",
+    "RENDER",
+    "DEPTH",
+    "SHADOW",
+    "LIGHT",
+    "BLUR",
+    "DRAW",
+    "BOARDING",
+    "SEASON",
+    "BATTLE",
+    "HALL",
+    "DAY",
+    "BUS",
+    "RAIL",
+    "SKI",
+    "FAST",
+    "EASY",
+    "EZ",
+    "BACKSTAGE",
+    "KEE",
+    "GO",
+    "NORD",
+    "EN",
+    "PROTON",
+    "NO",
+    "ASK",
+    "GET",
+    "RESET",
+]);
+/**
+ * Whether `PASS`, `PWD`, `PW` or `AUTH` glued after `head` names a password or an auth string: after what it belongs to
+ * (PASSWORD_OWNERS, a vendor's name); `PASS`, the commonest, after any other word that's no part of another
+ * (NOT_PASSWORD_OWNERS): `JKSPASS`, `vpnpass`, `kafkapass`, `p12pass`. (Not after a letter or a number alone: `npass`,
+ * `2pass`; nor `PW` after a letter, as base64 ends, `…GS+xpw==`.)
+ */
+function ownsGlued(head, suffix) {
+    if (suffix === "PW" && head.length < 2)
+        return false;
+    if (PASSWORD_OWNERS.has(head) || isVendorName(head))
+        return true;
+    return suffix === "PASS" && /^[A-Z][A-Z0-9]+$/.test(head) && !NOT_PASSWORD_OWNERS.has(head);
+}
 /**
  * Whether one word of a name is a credential word: `PASSWORD`, `TOKEN`, `KEY`, or one glued to it, `PGPASSWORD`,
- * `APITOKEN`, `WRITEKEY`. The short `PASS`, `PWD` and `AUTH` count glued only after what they belong to (PASSWORD_OWNERS).
+ * `APITOKEN`, `WRITEKEY`. The short `PASS`, `PWD`, `PW` and `AUTH` count glued only after what they belong to (ownsGlued).
  */
 function isCredentialWord(word) {
     if (CREDENTIAL_WORDS.has(word))
@@ -1094,8 +1209,7 @@ function isCredentialWord(word) {
     const glued = CREDENTIAL_SUFFIX.exec(word);
     if (!glued)
         return false;
-    const head = word.slice(0, glued.index);
-    return !/^(?:PASS|PWD|AUTH)$/.test(glued[1]) || PASSWORD_OWNERS.has(head) || isVendorName(head);
+    return !/^(?:PASS|PWD|PW|AUTH)$/.test(glued[1]) || ownsGlued(word.slice(0, glued.index), glued[1]);
 }
 /**
  * What a name says about its value:
@@ -1272,9 +1386,11 @@ function classify(name, w, core, last) {
         return "identifier";
     // An alarm's, a door's or a keypad's code is a PIN; `vapidPrivate`, `push_private`: the private half of a key pair.
     // (A key's private half named as a camel-case hump or after a separator, `vapidPrivate`, `VAPID_PRIVATE`; not a word
-    // that ends so, `isprivate`, `semiprivate`.)
+    // that ends so, `isprivate`, `semiprivate`; nor an identifier's, `zone_private`.)
     if (isPinName(name) ||
-        (/^[a-z][a-z0-9]*(?:Private|[_-]private)$|^[A-Za-z][A-Za-z0-9]*[_-]PRIVATE$/.test(name) && !ABOUT_WORDS.has(w[0])))
+        (/^[a-z][a-z0-9]*(?:Private|[_-]private)$|^[A-Za-z][A-Za-z0-9]*[_-]PRIVATE$/.test(name) &&
+            !ABOUT_WORDS.has(w[0]) &&
+            !IDENTIFIER_WORDS.has(w[0])))
         return "credential";
     if (isPublicName(name, core))
         return "public";
@@ -1341,8 +1457,17 @@ function classify(name, w, core, last) {
         (core.length >= 2 &&
             /^(ACCESS|API|SECRET|CLIENT|APP|AUTH|SIGNING)$/.test(core.at(-2)) &&
             /^(TOKEN|KEY)$/.test(last));
-    const about = core.some((x) => ABOUT_WORDS.has(x) && !(fullPhrase && ROUTE_WORDS.has(x))) ||
-        /^NO(PASS|PASSWD|PASSWORD|AUTH)$/.test(last);
+    // (A noun about word followed by another that names what the credential belongs to names a component; not a credential
+    // phrase's first word, `LOGIN_PAGE_APP_PASSWORD`.)
+    const about = core.some((x, i) => ABOUT_WORDS.has(x) &&
+        !(fullPhrase && ROUTE_WORDS.has(x)) &&
+        !(NOUN_ABOUT_WORDS.has(x) &&
+            core
+                .slice(i + 1, -1)
+                .some((y) => !ABOUT_WORDS.has(y) &&
+                !QUALIFIER_WORDS.test(y) &&
+                !isCredentialWord(y) &&
+                !/^(ACCESS|API|SECRET|CLIENT|APP|AUTH|SIGNING)$/.test(y)))) || /^NO(PASS|PASSWD|PASSWORD|AUTH)$/.test(last);
     if (!about && isCredentialWord(last) && !(last === "PAT" && core.length > 1 && !PAT_OWNERS.has(core.at(-2))))
         return "credential";
     // A credential's word first, then whose it is: `PASSWORD_DB`, `TOKEN_GITHUB`, `SECRET_STRIPE`, `password_for_db`; not
@@ -1354,7 +1479,7 @@ function classify(name, w, core, last) {
         return "credential";
     if (HASH_WORDS.has(last) ||
         /^(SHA|MD|BLAKE|CRC)\d*$/.test(last) ||
-        (last === "ID" && core.some((x) => HASH_WORDS.has(x))))
+        (/^(?:ID|NUMBER|NUM)$/.test(last) && core.some((x) => HASH_WORDS.has(x))))
         return "hash";
     if (IDENTIFIER_WORDS.has(last))
         return "identifier";

package/dist/normalize.d.ts

@@ -13,7 +13,10 @@ export interface Normalized {
 }
 /** A text with its HTML entities decoded as normalize decodes them: `&lt;redacted&gt;` is `<redacted>`. */
 export declare function decodeEntities(text: string): string;
-/** A `.pgpass` line, `host:port:database:user:password` (`*` is a wildcard in the first four). */
+/**
+ * A `.pgpass` line, `host:port:database:user:password` (`*` is a wildcard in the first four). Not a line of bytes in
+ * hex pairs, as `openssl x509 -text` prints a certificate's modulus (`f2:36:d0:9e:e7:…`).
+ */
 export declare const PGPASS: RegExp;
 /** Whether a text has anything to normalize, cheaply. (A pass only has work after one that ran if its own gate already fires on the original.) */
 export declare function needsNormalizing(text: string): boolean;

package/dist/normalize.js

@@ -6,7 +6,7 @@
  * 2. What a tool puts in front of lines: a file viewer's line numbers (`     12→`, `cat -n`), `grep -n`'s
  *    `path:12:`, a diff hunk's markers.
  * 3. What spells a character or a string another way: shell line continuations (`--password \` then the value on
- *    the next line), HTML entities (`"`, `#`), full-width punctuation and spaces of other widths, and a
+ *    the next line), HTML entities (`"`, `#`), full-width punctuation, typographic quotes and spaces of other widths, and a
  *    string literal split in pieces (`"xoxb-12ab" "34cd"`, `'sk-' + '…'`), joined.
  *
  * Each pass sees the lines the one before it leaves (a coloured diff's `ESC[32m+API_TOKEN=…` starts with its `+`;
@@ -93,8 +93,11 @@ const PREFIXED = /(?:^|\n)[\w./@+-]{1,200}\.\w{1,10}[:-]\d{1,7}[:-]|(?:^|\n)@@ -
  */
 const LINE_NUMBER = /^(?:[ \t]*\d{1,7}→| +\d{1,7}\t)/gm;
 const HAS_LINE_NUMBER = new RegExp(LINE_NUMBER.source, "m");
-/** A `.pgpass` line, `host:port:database:user:password` (`*` is a wildcard in the first four). */
-export const PGPASS = /^[ \t]*[^:\s#][^:\s]*:(?:\d{1,5}|\*):[^:\s]+:[^:\s]+:([^\r\n]+?)\r?$/m;
+/**
+ * A `.pgpass` line, `host:port:database:user:password` (`*` is a wildcard in the first four). Not a line of bytes in
+ * hex pairs, as `openssl x509 -text` prints a certificate's modulus (`f2:36:d0:9e:e7:…`).
+ */
+export const PGPASS = /^(?![ \t]*(?:[0-9A-Fa-f]{2}:){5})[ \t]*[^:\s#][^:\s]*:(?:\d{1,5}|\*):[^:\s]+:[^:\s]+:([^\r\n]+?)\r?$/m;
 /** `grep -n` and `rg -n`: `path:12:` before a match, `path-13-` before a context line. */
 const GREP_PREFIX = /^([\w./@+-]{1,200}\.[\w]{1,10})[:-](\d{1,7})[:-]/gm;
 /**
@@ -124,7 +127,7 @@ const INVISIBLE = /[\x00\x07\x1b\u00ad\u034f\u061c\u115f\u1160\u17b4\u17b5\u180b
 const NEEDS_PASS_ONE = (text) => INVISIBLE.test(text) || ESCAPED_CSI.test(text) || CARET_ESCAPE.test(text);
 const NEEDS_PASS_TWO = (text) => HAS_LINE_NUMBER.test(text) || PREFIXED.test(text) || LINE_END_MARK_TEST.test(text);
 const NEEDS_PASS_THREE = (text) => INLINE_TAG_TEST.test(text) ||
-    /[\u00a0\u2000-\u200a\u202f\u3000\uff1a\uff1d]|\\\r?\n/.test(text) ||
+    /[\u00a0\u2000-\u200a\u2018\u2019\u201c-\u201e\u202f\u3000\uff1a\uff1d]|\\\r?\n/.test(text) ||
     ENTITY.test(text) ||
     JOINT.test(text);
 /** Whether a text has anything to normalize, cheaply. (A pass only has work after one that ran if its own gate already fires on the original.) */
@@ -405,9 +408,12 @@ function literalJoints(text) {
                 continue;
             if (m[1] === "'" && /content-security-policy|-src\b/i.test(text.slice(start, lineEnd(text, m.index))))
                 continue;
-            // Across a line break with no operator: inside parentheses (Python), or a C initializer after `=`.
+            // Across a line break with no operator: inside parentheses (Python), or a C initializer after `=`, whose next
+            // piece is indented under it (a shell line's quoted value ends its line: `export PW="…"` then `"$DIR/run.sh"`).
             if (/\n/.test(s[0]) && !/[(=][ \t]*$/.test(before) && !/[(=,][ \t]*\r?$/.test(above))
                 continue;
+            if (/\n/.test(s[0]) && !/\n[ \t]+$/.test(s[0]) && !/\([ \t]*$/.test(before))
+                continue;
         }
         // The next piece is more of the string, not a name: `"…"="…"` lines (a .reg file, an INI) don't join.
         if (/^[ \t]*[=:]/.test(text.slice(next.lastIndex, next.lastIndex + 20)))
@@ -432,12 +438,13 @@ function unspell(text) {
             continue;
         }
         // A line continuation: the backslash and newline vanish, joining the lines as a shell, a C macro or a string
-        // does (`--password \`, `TOKEN=AbCd\` then `EfGh`). Not a Windows path's last backslash (`DATA_DIR=C:\data\`)
-        // nor a Markdown hard break (`**Host:** db\` then `**Password:** …`): a line that begins with no token there.
+        // does (`--password \`, `TOKEN=AbCd\` then `EfGh`). Not a Windows path's last backslash (`DATA_DIR=C:\data\`,
+        // `C:\Program Files\App\`, `\\server\share\`, `%ProgramData%\app\`: a word with another backslash in it), nor a
+        // Markdown hard break (`**Host:** db\` then `**Password:** …`): a line that begins with no token there.
         if (c === 92 && (text[i + 1] === "\n" || (text[i + 1] === "\r" && text[i + 2] === "\n"))) {
             const next = text[i + 1] === "\r" ? i + 3 : i + 2;
             const line = text.slice(lineStart(text, i), i);
-            const windowsPath = /(?:^|[\s=:"'])[A-Za-z]:\\[^\s]*$/.test(line);
+            const windowsPath = /\\\S*$/.test(line);
             const hardBreak = !/[ \t]$/.test(line) && !/^[\w"'$\s-]/.test(text[next] ?? "");
             if (!windowsPath && !hardBreak) {
                 w.separate();
@@ -455,10 +462,20 @@ function unspell(text) {
         }
         if (c === 38) {
             const m = ENTITY_AT.exec(text.slice(i, i + 12));
-            const ch = m ? entityChar(m) : undefined;
+            let ch = m ? entityChar(m) : undefined;
             if (m && ch !== undefined) {
-                w.emit(ch, i, i + m[0].length);
-                i += m[0].length;
+                // (An entity escaped again, `"` in an attribute escaped twice, is the character it stands for.)
+                let end = i + m[0].length;
+                for (let depth = 0; ch === "&" && depth < 3; depth++) {
+                    const inner = ENTITY_AT.exec(`&${text.slice(end, end + 11)}`);
+                    const innerChar = inner ? entityChar(inner) : undefined;
+                    if (!inner || innerChar === undefined)
+                        break;
+                    ch = innerChar;
+                    end += inner[0].length - 1;
+                }
+                w.emit(ch, i, end);
+                i = end;
                 continue;
             }
         }
@@ -475,6 +492,15 @@ function unspell(text) {
             i++;
             continue;
         }
+        // Typographic quotes, as a word processor's or a chat app's autocorrect writes them in pasted JSON and config
+        // (`“password”: “…”`, German `„…“`): the straight quotes the syntax means. (Not an apostrophe inside a word, which
+        // quotes nothing: Corsican `chjave d’accessu`, `it’s`.)
+        if ((c === 0x2018 || c === 0x2019 || (c >= 0x201c && c <= 0x201e)) &&
+            !(c === 0x2019 && /\p{L}/u.test(text[i - 1] ?? "") && /\p{L}/u.test(text[i + 1] ?? ""))) {
+            w.emit(c <= 0x2019 ? "'" : '"', i, i + 1);
+            i++;
+            continue;
+        }
         w.emit(text[i], i, i + 1);
         i++;
     }

package/dist/pem.d.ts

@@ -1,3 +1,5 @@
+/** Whether a text ends inside an armored block: its last BEGIN or END line is a BEGIN (the END is still to come). */
+export declare function endsInBlock(text: string): boolean;
 /** The BEGIN lines of a text, each with its label, in order. */
 export declare function beginLines(text: string): Generator<{
     start: number;

package/dist/pem.js

@@ -19,6 +19,14 @@ const ARMOR = (word) => String.raw `-{4,5} ?${word} ([A-Za-z0-9][A-Za-z0-9 ]{0,5
 const END_LINE = new RegExp(ARMOR("END"), "y");
 /** Where an END line may start. */
 const END_START = /-{4,5} ?END /y;
+const ARMOR_LINE = new RegExp(ARMOR("(BEGIN|END)"), "g");
+/** Whether a text ends inside an armored block: its last BEGIN or END line is a BEGIN (the END is still to come). */
+export function endsInBlock(text) {
+    let last;
+    for (const m of text.matchAll(ARMOR_LINE))
+        last = m[1];
+    return last === "BEGIN";
+}
 /** The BEGIN lines of a text, each with its label, in order. */
 export function* beginLines(text) {
     for (const m of text.matchAll(new RegExp(ARMOR("BEGIN"), "g")))
@@ -122,6 +130,10 @@ function pemBody(text, begin, from) {
             while (j < text.length && isArmorChar(text.charCodeAt(j)))
                 j++;
             run = j - lineFrom;
+            // (Base64 has `=` only as its padding, at the end: `password=Zq7m…` after a cut certificate, or on its BEGIN
+            // line in a log, is a setting.)
+            if (/=[^=]/.test(text.slice(lineFrom, j)))
+                break;
             // (A blank line separates the headers from the material; once material has begun, it ends the block.)
             if (run === 0 && (material > 0 || !breakAt(text, j)))
                 break;

package/dist/policy.js

@@ -10,7 +10,7 @@
  */
 import { clientSdkAt, isClientGoogleKey, isPublicJwt, PUBLIC_FORMAT, PUBLIC_SDK_PARAM, PUBLISHED_EXAMPLE, } from "./public.js";
 import { isBase58Address, isBech32Address, isNatsPublicKey, isStellarPublicKey, isXrpAddress } from "./checksums.js";
-import { isPairLabel } from "./named.js";
+import { enclosingKey, isPairLabel } from "./named.js";
 import { nameClass, namesPasswordOrPin } from "./names.js";
 import { base64Binary, base64Prefix } from "./base64.js";
 import { isDerPublicKey, isPgpPublicKey, isPublicPem } from "./publickeys.js";
@@ -60,7 +60,9 @@ function isClientSdkKey(sdk, name, before) {
     const positional = !name || callee === name;
     if (!positional)
         return PUBLIC_SDK_PARAM.test(name.replace(/^.*[.\s]/, ""));
-    return (!/^(?:algoliasearch|instantsearch)/.test(sdk) || /search[-_ ]?(?:only|key)|public|read[-_ ]?only/i.test(before));
+    // (`public` as a word, not inside a name or a path: `NEXT_PUBLIC_ALGOLIA_APP_ID`, `publicIndex`, `public/`.)
+    return (!/^(?:algoliasearch|instantsearch)/.test(sdk) ||
+        /search[-_ ]?(?:only|key)|(?<![\w$./-])public(?![\w$/-])|read[-_ ]?only/i.test(before));
 }
 /**
  * A `WWW-Authenticate` or `Proxy-Authenticate` header's scheme and parameters, up to inside one of the parameters the
@@ -85,12 +87,12 @@ export function keepReason(text, f, hashes = "keep") {
     const left = text.slice(Math.max(0, f.start - 200), f.start);
     // A device's published default PIN, counting or one digit repeated, that its line calls the default or an example
     // (`The default Bluetooth PIN is 0000`, `factory PIN: 1234`). Anywhere else a PIN of `0000` is someone's PIN
-    // (`pin_value=0000`, `--password 123456`).
+    // (`pin_value=0000`, `--password 123456`). (The line's words, not a host's or a path's: `api.example.com/login`.)
     if (/^\d{4,8}$/.test(value) &&
         isCountingDigits(value) &&
         f.name !== undefined &&
         namesPasswordOrPin(f.name) &&
-        /\b(?:default|factory|example|such as|for instance)\b|\be\.g\./i.test(left.slice(left.lastIndexOf("\n") + 1)))
+        /(?<![\w./-])(?:default|factory|example|such as|for instance)(?![\w./-])|\be\.g\./i.test(left.slice(left.lastIndexOf("\n") + 1)))
         return "a published default PIN";
     // The token the span sits in, to blanks, quotes and separators, and its part after a label (`key_id:rzp_…`,
     // `SHA256:…`; a Mapbox `pk.` token's segment, a JWT behind a diff's `+`): a layer may have cut into either.
@@ -230,6 +232,10 @@ export function keepReason(text, f, hashes = "keep") {
     // (A name of key-like words: `Token for the public API:` is a sentence, not a name.)
     if (name && nameClass(name.replace(/\s+/g, "_")) === "public" && /key|token|id\b|dsn|sid/i.test(name) && !serverLine)
         return "public by its name";
+    // (Or with the key of the object it sits in: `mixpanel: { projectToken: … }` is `mixpanel.projectToken`.)
+    const parent = name && /key|token/i.test(name) && /^[\w$-]+$/.test(name) ? enclosingKey(text, f.start) : undefined;
+    if (parent && nameClass(`${parent}.${name}`) === "public" && !serverLine)
+        return "public by its name";
     // A random token the unnamed layer guessed at, under a name that says ID or hash (`bridgeSessionId`, `sha`): what the
     // unnamed layer's own name vetoes say, for a finding whose name only this stage sees (a transcript leaf's key).
     if (isGuess(f.rule) && ["identifier", "hash"].includes(nameClass(name.replace(/\s+/g, "_"))))
@@ -262,7 +268,8 @@ export function keepReason(text, f, hashes = "keep") {
     if (/^AIza/.test(value) && isClientGoogleKey(text, f.start))
         return "client-side Google key";
     // The search-only key of an Algolia DocSearch config (`appId`, `apiKey`, `indexName`), in every docs site;
-    // never a key named admin, write or secret.
+    // never a key named admin, write or secret, nor one in code that writes to the index (an indexing script's
+    // `saveObjects`, a crawler's config), which takes the admin key.
     if (/^[0-9a-f]{32}$/.test(value)) {
         const near = text.slice(Math.max(0, f.start - 300), f.end + 300);
         const key = /([\w-]+)["']?[ \t]*[:=][ \t]*["'`]?$/.exec(left.slice(-80))?.[1] ?? "";

package/dist/public.js

@@ -9,6 +9,7 @@ import { base64Binary } from "./base64.js";
 import { naturalness } from "./charlm.js";
 import { hmacSha256 } from "./hmac.js";
 import { callArguments } from "./calls.js";
+import { lastText } from "./lines.js";
 /** Keys that are public by design: publishable, site and project keys meant for browsers. */
 export const PUBLIC_FORMAT = /^(?:pk_(?:live|test)_|NRJS-[0-9a-f]{19}$|rzp_(?:live|test)_[A-Za-z0-9]{14}$|pk\.(?:eyJ|[A-Za-z0-9]{20})|pub[0-9a-f]{32}$|phc_|sb_publishable_|sq0idp-|sqb_[0-9a-f]{40}$)/;
 /** Where the bracket that encloses the end of `before` opens, skipping balanced pairs, or -1. */
@@ -62,6 +63,13 @@ export function isClientGoogleKey(text, start) {
     // its attributes on one line or several, in either order.)
     if (/GMSServices\.provideAPIKey\(\s*"$|GMSPlacesClient\.provideAPIKey\(\s*"$/.test(line))
         return true;
+    // The files Firebase's tools generate into an app: the Android plugin's `values.xml` (`<string
+    // name="google_api_key">`), and iOS's `GoogleService-Info.plist` (`<key>API_KEY</key>` beside `GOOGLE_APP_ID`).
+    if (/<string\b[^<>]*\bname="google(?:_crash_reporting)?_api_key"[^<>]*>$/.test(line))
+        return true;
+    if (/<key>API_KEY<\/key>\s*<string>$/.test(before) &&
+        /<key>(?:GOOGLE_APP_ID|GCM_SENDER_ID)<\/key>/.test(text.slice(Math.max(0, start - 3000), start + 3000)))
+        return true;
     const tag = /<meta-data\b[^<>]*android:value="$/.exec(before)?.[0];
     if (tag &&
         (/android:name="com\.google\.android\.geo\.API_KEY"/.test(tag) ||
@@ -95,10 +103,11 @@ export function isClientGoogleKey(text, start) {
         };
         object = [...siblings(up), line + lineAfter, ...siblings(down)].join("\n");
     }
-    // (The bracket must be the config's own: `firebaseConfig = {`, `initializeApp({`, `FirebaseOptions(`.)
+    // (The bracket must be the config's own: `firebaseConfig = {`, `initializeApp({`, `FirebaseOptions(`, an Angular
+    // environment's `firebase: {`.)
     return (/authDomain|messagingSenderId|"api_key"\s*:\s*\[/.test(object) ||
         (open >= 0 &&
-            /(?:firebaseConfig\w*\s*[:=]\s*\{|initializeApp\(\s*\{?|FirebaseOptions\(|"api_key"\s*:\s*\[\s*\{)$/.test(before.slice(0, open + 1))));
+            /(?:firebaseConfig\w*\s*[:=]\s*\{|\bfirebase["']?\s*:\s*\{|initializeApp\(\s*\{?|FirebaseOptions\(|"api_key"\s*:\s*\[\s*\{)$/.test(before.slice(0, open + 1))));
 }
 /**
  * Example keys from vendor docs and RFCs, which are published on purpose: RFC 6749's authorization code,
@@ -156,7 +165,7 @@ const STAND_IN = (() => {
     // (A word starts after a non-letter or at a camel-case hump, and ends before a non-lower-case letter.)
     return new RegExp(String.raw `(?:(?<![A-Za-z])|(?<=[a-z])(?=[A-Z]))(?:${[...new Set(cases)].join("|")}|[xX]{3,})(?![a-z])`, "g");
 })();
-/** What separates the parts of a placeholder: `YOUR_API_KEY_HERE`, `example-token`, `<your-key>`, `sk-[redacted]`. */
+/** What separates the parts of a placeholder:`YOUR_API_KEY_HERE`, `example-token`, `<your-key>`, `sk-[redacted]`. */
 const PLACEHOLDER_SEPARATORS = /[-_. :/[\]<>(){}*]+/;
 /**
  * A value made of stand-in words and plain ones: each part between separators is a plain one (a small number, a short
@@ -169,10 +178,8 @@ function isStandIn(token) {
     if (token.search(STAND_IN) < 0)
         return false;
     const isWord = (p) => /^[A-Za-z]+$/.test(p) && naturalness(p.toLowerCase()) > 0.3;
-    return token
-        .split(PLACEHOLDER_SEPARATORS)
-        .filter(Boolean)
-        .every((part) => {
+    const parts = token.split(PLACEHOLDER_SEPARATORS).filter(Boolean);
+    return parts.every((part) => {
         const standIns = [...part.matchAll(STAND_IN)];
         if (!standIns.length)
             return /^\d{1,4}$/.test(part) || /^[A-Za-z]{1,4}$/.test(part) || isWord(part);
@@ -195,13 +202,19 @@ const MASKED = /^[^*\s]{0,8}\*{4,}[^*\s]{0,8}$/;
  * off (`...` then 300 characters).
  */
 export function isTruncated(token) {
-    const m = /^([\w+/=:.-]{0,16}?)(?:\.\.\.|…)([\w+/=:.-]{0,40})$/.exec(token);
+    const m = /^([\w+/=:.-]{0,32}?)(?:\.\.\.|…)([\w+/=:.-]{0,40})$/.exec(token);
     if (!m)
         return false;
+    // (Up to 16 characters before the ellipsis, or a longer vendor prefix of short parts and up to 10 of the key:
+    // `sk-ant-api03-Zx9K…`, `github_pat_11ABCDE0Y0…`.)
+    const prefix = /^(?:[a-z][a-z0-9]{1,7}[-_]){2,4}(?=[A-Za-z0-9+/=]{0,10}$)/.exec(m[1])?.[0];
+    if (m[1].length > 16 && !prefix)
+        return false;
     const runs = (side) => side.match(/[A-Za-z]+/g) ?? [];
     const isWord = (run) => naturalness(run.toLowerCase()) > 0.3;
-    // (A person's word: capitalised, or five letters that read as one; a vendor's prefix is neither: `sk-proj`, `AKIA`.)
-    return (!runs(m[1]).some((run) => /^[A-Z][a-z]{3,}$/.test(run) || (run.length >= 5 && isWord(run))) &&
+    // (A person's word: capitalised, or five letters that read as one; a vendor's prefix is neither: `sk-proj`, `AKIA`,
+    // and a long one's words are the vendor's: `github_pat_`.)
+    return (!runs(m[1].length > 16 ? m[1].slice(prefix.length) : m[1]).some((run) => /^[A-Z][a-z]{3,}$/.test(run) || (run.length >= 5 && isWord(run))) &&
         (m[2].length <= 8 || runs(m[2]).every((run) => run.length <= 2 || isWord(run))));
 }
 /** A template's holes: `{{ secrets.DB }}`, `${API_KEY}`, `%(password)s`, `{db_pass}`, `<password>`. */
@@ -298,9 +311,13 @@ export function isPublicJwt(token, samplesOnly = false) {
         return false;
     // (jwt.io's sample claims say a sample when a public key signed them, RS256's and the others'; an HMAC token is a
     // sample only by its docs key, signedWithDocsKey, as one signed with a real secret may copy the claims.)
+    // (The samples name no issuer and set no expiry: a token that does, `"iss":"https://dev-…auth0.com/"`, came from a
+    // real one, whose test user may well be John Doe.)
     const hmac = /"alg"\s*:\s*"HS\d+"/.test(base64Binary(head) ?? "");
     return ((!samplesOnly && /"role"\s*:\s*"anon"/.test(payload)) ||
-        (!hmac && (/"sub"\s*:\s*"1234567890"/.test(payload) || /"name"\s*:\s*"John Doe"/.test(payload))) ||
+        (!hmac &&
+            (/"sub"\s*:\s*"1234567890"/.test(payload) || /"name"\s*:\s*"John Doe"/.test(payload)) &&
+            !/"(?:iss|exp)"\s*:/.test(payload)) ||
         signedWithDocsKey(token));
 }
 /**
@@ -337,14 +354,17 @@ const base64url = (bytes) => btoa(String.fromCharCode(...bytes))
  * Browser and mobile SDK initialisers, whose keys are public by design: calls (`Sentry.init(`, `new Pusher(`,
  * `loadStripe(`) or config objects (`firebaseConfig = {`, `_rollbarConfig = {`). Not a vendor word alone:
  * `IntercomClient(…)` is a server SDK, a bare `createInstance(` is any factory unless Optimizely's is imported (see
- * clientSdkAt), and a comment naming the vendor initialises nothing.
+ * clientSdkAt), and a comment naming the vendor initialises nothing. Nor `Rollbar.init(`, which Node servers call with
+ * their server token, as `new Rollbar(` is: only the browser snippet's `_rollbarConfig` says client.
  */
-const CLIENT_SDK_CALL = /(?:\b(?:AnalyticsBrowser\.load|analytics\.load|Bugsnag\.start|Rollbar\.init|optimizely(?:Sdk)?\.createInstance|createInstance|(?:new\s+)?GrowthBook|Purchases\.configure|braintree\.\w+\.create|(?:new\s+)?AdyenCheckout|branch\.init|initializeApp|new\s+mapboxgl\.\w+|(?:new\s+)?Pusher|Sentry\.init|posthog\.init|amplitude\.(?:init|getInstance\(\)\.init)|mixpanel\.init|LDClient\.initialize|datadogRum\.init|DD_RUM\.init|heap\.load|algoliasearch|docsearch|instantsearch|Intercom|loadStripe|Stripe|Square\.payments)\s*\(|\b(?:_rollbarConfig|firebaseConfig\w*)\s*[:=]\s*\{)/g;
+const CLIENT_SDK_CALL = /(?:\b(?:AnalyticsBrowser\.load|analytics\.load|Bugsnag\.start|optimizely(?:Sdk)?\.createInstance|createInstance|(?:new\s+)?GrowthBook|Purchases\.configure|braintree\.\w+\.create|(?:new\s+)?AdyenCheckout|branch\.init|initializeApp|new\s+mapboxgl\.\w+|(?:new\s+)?Pusher|Sentry\.init|posthog\.init|amplitude\.(?:init|getInstance\(\)\.init)|mixpanel\.init|LDClient\.initialize|datadogRum\.init|DD_RUM\.init|heap\.load|algoliasearch|docsearch|instantsearch|Intercom|loadStripe|Stripe|Square\.payments)\s*\(|\b(?:_rollbarConfig|firebaseConfig\w*)\s*[:=]\s*\{)/g;
 /**
  * The client SDK initialiser whose arguments `at` is directly inside, or inside an object or list given as one of them,
  * if the call starts within 300 characters before it: its call as written (`algoliasearch(`).
  */
 export function clientSdkAt(text, at) {
+    if (!hasClientSdkCall(text))
+        return undefined;
     const from = Math.max(0, at - 300);
     let last;
     for (const m of text.slice(from, at).matchAll(CLIENT_SDK_CALL))
@@ -358,5 +378,7 @@ export function clientSdkAt(text, at) {
     const inside = arg.literal || at === arg.start || (/^[{[]/.test(arg.text) && holding(callArguments(text, arg.start + 1)));
     return inside ? last[0] : undefined;
 }
+/** Whether a text calls a client SDK's initialiser anywhere: most don't, and need no look 300 characters back. */
+const hasClientSdkCall = lastText((text) => new RegExp(CLIENT_SDK_CALL.source).test(text));
 /** The parameters client SDKs take public keys under (positional arguments count too). */
 export const PUBLIC_SDK_PARAM = /^(?:api_?key|key|client_?key|client_?token|sdk_?key|app_?id|application_?id|dsn|authorization|publishable_?key|public_?key|site_?key|access_?token|token|search_?(?:only_?)?api_?key)$/i;