redac---n 0.0.4 → 0.0.5

package/dist/urls.js

@@ -20,9 +20,11 @@ const USERINFO = new RegExp(String.raw `${URL_SCHEME}:\/\/[^\s/@]*`, "y");
  * Where a URL that starts at `at` ends: at a blank, a quote, an angle bracket, a backtick, a backslash (a JSON
  * string's escaped quote), or a closing bracket it didn't open (a Markdown link's `)`); sentence punctuation at its
  * end isn't part of it (`…/reset/<token>.`). A password's brackets are (`app:p)dgbs@db`, `admin:<Harbor2291x>@host`).
- * However long the password: each look-ahead for its `@` is remembered to where it stopped (`reachesAt`).
+ * However long the password: each look-ahead for its `@` is remembered to where it stopped (`reachesAt`). With `enough`,
+ * it stops once it has read past that point (the answer is then only known to be past it): urlAround asks whether a
+ * URL reaches a position, and a line with no blank in it (a comma-separated list of hosts) reads, as one URL, to its end.
  */
-export function urlEnd(text, at) {
+export function urlEnd(text, at, enough = Infinity) {
     const open = { ")": 0, "]": 0 };
     const closerIsPassword = reachesAt(text, /[^\s"'<>`\\/@]*(@)?/y);
     const quoteIsPassword = reachesAt(text, /[^\s"<>`\\/@,;]*(@)?/y);
@@ -33,6 +35,9 @@ export function urlEnd(text, at) {
     const bracketed = /<[^\s<>@"'`]+>@/y;
     let end = at;
     for (; end < text.length && end - at < MAX_VALUE; end++) {
+        // (Sentence punctuation read last could still be trimmed off below.)
+        if (end > enough && !/[.,;:!?]/.test(text[end - 1]))
+            return end;
         const c = text[end];
         if (c === "(")
             open[")"]++;
@@ -50,13 +55,14 @@ export function urlEnd(text, at) {
                 break;
             end = bracketed.lastIndex - 1;
         }
-        else if ((c === "'" || c === '"') &&
+        else if (/["'<>`\\]/.test(c) &&
             quoteIsPassword(end + 1) &&
             colon >= 0 &&
             colon < end &&
             end <= userinfoEnd &&
             !endsInPort(text, end)) {
-            // (In a password, before the `@` that ends it: `postgres://app:Kx9m'Qv2@db`, `postgres://app:Kx9m"Qv2@db`.)
+            // (In a password, before the `@` that ends it: `postgres://app:Kx9m'Qv2@db`, `postgres://app:Kx9m"Qv2@db`,
+            // `postgres://app:Qv2>Kx9m@db`; a JSON string's escape too, `app:Kx9m\u0026Qv2@db`.)
         }
         else if (/[\s"'<>`\\]/.test(c))
             break;
@@ -136,7 +142,7 @@ export function urlAround(text, at, end = at, from = Math.max(0, at - 4096)) {
     if (!scheme)
         return -1;
     const start = sep - scheme[0].length;
-    return urlEnd(text, start) >= end ? start : -1;
+    return urlEnd(text, start, end) >= end ? start : -1;
 }
 /**
  * A URL's parts. The authority's user information, as clients read it: a user with no `/?#@:` (or an email address
@@ -224,8 +230,11 @@ function password(url, userStart, userEnd, hostEnd) {
 }
 /** A host as a URL names one: a domain with a TLD (`db.internal`, `example.com`), an IPv4 address, a name and a port. */
 const isHost = (h) => /^(?:[\w-]+\.)+[A-Za-z][\w-]*(?::\d{1,5})?$|^\d{1,3}(?:\.\d{1,3}){3}(?::\d{1,5})?$|^[\w-]+:\d{1,5}$/.test(h);
-/** A parameter's start and name: after `?`, `&` (or HTML's `&amp;`) or `#`, a name with PHP's `[]` allowed. */
-export const PARAM_START = String.raw `(?:&amp;|[?&#])`;
+/**
+ * A parameter's start and name: after `?`, `&` (or HTML's `&amp;`, or the `\u0026` and `\x26` that JSON encoders and JS
+ * write for it: Go's encoding/json escapes every `&`) or `#`, a name with PHP's `[]` allowed.
+ */
+export const PARAM_START = String.raw `(?:&amp;|\\u0026|\\x26|[?&#])`;
 export const PARAM_NAME = String.raw `[\w.\[\]-]{1,60}`;
 /**
  * The `name=value` pairs in `text`: a URL's query and fragment (`#access_token=…`), a form body. A value ends at `&`,

package/dist/values.d.ts

@@ -127,7 +127,8 @@ export declare function hasThreeClasses(value: string): boolean;
 export declare function isMadePassword(value: string): boolean;
 /**
  * Names of algorithms, encodings and formats that sentences about credentials mention: `password (UTF-8)`, `SHA-256`;
- * and password hashers as libraries name them: Django's `pbkdf2_sha256`, `bcrypt_sha256`, passlib's `sha512_crypt`.
+ * and password hashers as libraries name them: Django's `pbkdf2_sha256`, `bcrypt_sha256`, passlib's `sha512_crypt`;
+ * and the schemes a password is checked or sent by: `scram-sha-256`, `md5crypt`, `WPA2`, `NTLMv2`, `MSCHAPv2`.
  */
 export declare const ALGORITHM: RegExp;
 /** A number with the word that counts in CJK: `6位`, `8文字`, `3回`, `8자`, `2번`. */

package/dist/values.js

@@ -238,6 +238,9 @@ function isCommandSubstitution(v) {
     const arithmetic = /^\$\$?\(\(([^()]*)\)\)$/.exec(v);
     if (arithmetic)
         return /^[\w\s+*/%$-]+$/.test(arithmetic[1]) && /[A-Za-z_]/.test(arithmetic[1]);
+    // A program a variable names, quoted, cut at its first blank or not: `$("$binpath" write …)`, `$("${VAULT_BIN}")`.
+    if (/^\$\$?\(\s*"\$\{?[A-Za-z_]\w*\}?"(?:\s|\)|$)/.test(v))
+        return true;
     const body = /^\$\$?\(([\s\S]*)\)$/.exec(v)?.[1] ??
         /^`([^`]{0,400})`$/.exec(v)?.[1] ??
         /^\$\$?\(([A-Za-z][\w.-]{1,30}(?: [^\n]*)?)$/.exec(v)?.[1];
@@ -247,7 +250,8 @@ function isCommandSubstitution(v) {
     return command !== undefined && command.split("/").every((p) => p === "" || p === "." || p === ".." || isNameLike(p));
 }
 /** Shapes the printf family writes; see `printf template` below. */
-const SPEC = /%[-+ #0]{0,3}(?:\d{1,3}|\*)?(?:\.(?:\d{1,3}|\*))?[sdvxfiu]|%\(\w+\)[sd]|\{\d*\}|\{:\w*\}/g;
+// (Java's `%n` is a line break; Python's `{0:04x}` a field with its format.)
+const SPEC = /%[-+ #0]{0,3}(?:\d{1,3}|\*)?(?:\.(?:\d{1,3}|\*))?[sdvxfiun]|%\(\w+\)[sd]|\{\d*(?::\w+)?\}|\{:\w*\}/g;
 /**
  * Shapes of values that can't be credentials, by name: constants, paths, references to a value held elsewhere
  * (variables, templates, secret managers), masks and placeholders, encrypted values, public identifiers.
@@ -269,8 +273,11 @@ const INERT_SHAPES = [
         (v) => {
             const m = /^[$%@&]\{([\w.-]{1,80})(?:(?::?[-?=+]|:)[^}]{0,80})?\}$/.exec(v);
             const ps = /^\$(?:env:([A-Za-z_]\w{0,80})|\{env:([A-Za-z_]\w{0,80})\}|\(\$env:([A-Za-z_]\w{0,80})\))$/i.exec(v);
-            // (A long name reads as words: `$rqcy7duhdjbjv` is a password.)
-            const reads = (name) => name.length <= 8 || naturalness(name.replace(/[_.-]+/g, " ")) > 0;
+            // (A long name reads as words: `$rqcy7duhdjbjv` is a password; and a short one switches between letters and
+            // digits once at most, `$pass1`, `$x509`: `$kd9xqz2m` is a password.)
+            const reads = (name) => name.length <= 8
+                ? (name.match(/[A-Za-z](?=\d)|\d(?=[A-Za-z])/g)?.length ?? 0) < 2
+                : naturalness(name.replace(/[_.-]+/g, " ")) > 0;
             // (Lower case with digits closing it reads as a password: `$summer2024`, not `$db_pass2`.)
             return ((!!m && isRefName(m[1])) ||
                 (!!ps && isRefName(ps[1] ?? ps[2] ?? ps[3])) ||
@@ -292,14 +299,16 @@ const INERT_SHAPES = [
     // quote: `$(kubectl get secret … -o jsonpath="`.
     ["command substitution", isCommandSubstitution],
     // `{{ var }}`, `${{ secrets.X }}`, `<%= pw %>`, `#{var}`, `@VAR@` (Maven, Autoconf): whole, a name inside. (Go's
-    // templates trim blanks with a `-` inside the braces: `{{- .Values.password -}}`, `{{- end }}`.)
+    // templates trim blanks with a `-` inside the braces: `{{- .Values.password -}}`, `{{- end }}`.) And the tokens a
+    // deployment replaces in a config file it ships (Octopus, Azure DevOps' Replace Tokens): `#{DbPassword}#`,
+    // `__DbPassword__`, `@@DbPassword@@`.
     [
         "template",
         (v) => {
-            const m = /^(?:\$?\{\{-?(.{0,200}?)-?\}\}|<%=?([^%]{0,200})%>|#\{([^}]{0,200})\}|@([\w.-]{1,80})@)$/.exec(v);
+            const m = /^(?:\$?\{\{-?(.{0,200}?)-?\}\}|<%=?([^%]{0,200})%>|#\{([^}]{0,200})\}#?|@@?([\w.-]{1,80})@@?|__([A-Za-z][\w.]{0,80}[A-Za-z0-9])__)$/.exec(v);
             if (!m)
                 return false;
-            const inner = (m[1] ?? m[2] ?? m[3] ?? m[4]).trim();
+            const inner = (m[1] ?? m[2] ?? m[3] ?? m[4] ?? m[5]).trim();
             return /^[A-Za-z_@$.]/.test(inner) && isNameLike(inner.split(/[^\w.]/)[0] || "x");
         },
     ],
@@ -326,8 +335,14 @@ const INERT_SHAPES = [
             if (m)
                 return (isReferencePath(m[3]) &&
                     (m[1] !== undefined || m[3].includes("/") || (m[2] === "env" && /^[A-Z_][A-Z0-9_]*$/.test(m[3]))));
+            // (An ARN's name as RDS makes it holds a `!`: `secret:rds!db-<uuid>-AbCdEf`. A Google resource name needs no
+            // scheme: `projects/123/secrets/db-password/versions/latest`. Azure's App Service reads Key Vault from
+            // `@Microsoft.KeyVault(SecretUri=…)` or `(VaultName=…;SecretName=…)`.)
+            const gcp = /^projects\/([\w-]{1,64})\/secrets\/([\w-]{1,255})(?:\/versions\/(?:\d+|latest))?$/.exec(v);
             return (/^credentialsJSON:[0-9a-f-]{36}$/.test(v) ||
-                /^arn:aws[\w-]*:(?:secretsmanager|ssm|kms):[a-z0-9-]*:(?:\d{12})?:[\w/:+=.@*${}-]+$/.test(v));
+                /^arn:aws[\w-]*:(?:secretsmanager|ssm|kms):[a-z0-9-]*:(?:\d{12})?:[\w/:+=.@*${}!-]+$/.test(v) ||
+                (!!gcp && isReferencePath(`${gcp[1]}/${gcp[2]}`)) ||
+                /^@Microsoft\.KeyVault\((?:SecretUri=https:\/\/[\w.-]+\/secrets\/[\w-]+(?:\/[\w-]*)?|VaultName=[\w-]+;\s*SecretName=[\w-]+(?:;\s*SecretVersion=\w+)?)\)$/i.test(v));
         },
     ],
     // `****`, `xxxxxxxx`, `••••`, `[REDACTED]`, `<hidden>`, `ab****yz`; AWX's `$encrypted$`;
@@ -343,6 +358,10 @@ const INERT_SHAPES = [
             /^x{3,}(?:[-_.\d]*$|[-_.]x)/i.test(v) ||
             /^[a-z]{1,10}(?:[-_][a-z]{1,10}){0,2}[-_](?:x{4,}|X{4,}|\*{4,}|\.{3,})$/.test(v),
     ],
+    // A block comment the value opens with, whole: the annotations bundlers and compilers write after `=`
+    // (`/*#__PURE__*/`, `/* @__PURE__ */`, `/** @type {string} */`, `/* webpackChunkName: "auth" */`), then the code
+    // they annotate, glued on or not (`/*#__PURE__*/function`).
+    ["comment", (v) => /^\/\*[^]{0,200}?\*\//.test(v)],
     // An interpolation cut where the reader stopped, at a quote inside it: Ruby `#{ENV['`, `#{node['db'`, JS `${cfg[`.
     [
         "cut interpolation",
@@ -372,7 +391,11 @@ const INERT_SHAPES = [
             /^\$__(?:env|file|vault)\{[^}\n]{1,200}\}$/.test(v) ||
             /^%\{(?:::)?[A-Za-z_][\w:]*(?:\([^}\n]{0,200}\))?\}$/.test(v) ||
             /^@@\{[^}\n]{1,100}\}@@$/.test(v) ||
-            /^\[%key:[\w:]{1,200}%\]$/.test(v),
+            /^\[%key:[\w:]{1,200}%\]$/.test(v) ||
+            // Concourse, BOSH and CredHub (`((db_pass))`, `((/main/db.password))`), and Azure Pipelines' runtime
+            // expressions (`$[variables.dbPassword]`): a path of names.
+            (/^\(\([\w./:-]{1,200}\)\)$/.test(v) && isReferencePath(v.slice(2, -2))) ||
+            /^\$\[\s*variables(?:\.[\w.-]{1,100}|\[['"][\w.-]{1,100}['"]\])\s*\]$/.test(v),
     ],
     // A placeholder after a prefix: `sk.<ask-in-#atlas-dev>`, `ghp_<your token>`; in words: `<from vault: "Android upload keystore">`,
     // `<your-key>`; names in brackets, a path of them too: `<SecretsManager:prod/db>` (not `<Xk9p>`); marked: `change-me`,
@@ -409,13 +432,17 @@ const INERT_SHAPES = [
             return (((residue.match(/[A-Za-z]/g)?.length ?? 0) <= 4 ||
                 naturalness(residue.replace(/[^A-Za-z]+/g, " ").trim()) > 0) &&
                 residue.split(/[^A-Za-z]+/).every((w) => w.length <= 3 || (naturalness(w) > 0.6 && isNameLike(w))) &&
+                // (Quotes around a field, as a command line's template quotes one: `password='%s'`.)
                 v
+                    .replace(/(["'])(%[^%'"\s]{1,8})\1/g, "$2")
                     .replace(SPEC, "")
                     .replace(/\\[nrt]/g, "")
                     .replace(/[\w.\-/: ]/g, "").length <= 1 &&
                 !(/[A-Z]/.test(v) && /\d/.test(v.replace(/%[sdv]/g, ""))) &&
-                [...v.matchAll(SPEC)].every((m) => (!/[A-Za-z0-9]/.test(v[m.index - 1] ?? "") || !/[A-Za-z0-9]/.test(v[m.index + m[0].length] ?? "")) &&
-                    !(m[0][0] === "%" && /[A-Za-z]/.test(v[m.index + m[0].length] ?? ""))));
+                // (A line break joins the words around it: `%n%nUsing generated security password: %s%n`.)
+                [...v.matchAll(SPEC)].every((m) => m[0] === "%n" ||
+                    ((!/[A-Za-z0-9]/.test(v[m.index - 1] ?? "") || !/[A-Za-z0-9]/.test(v[m.index + m[0].length] ?? "")) &&
+                        !(m[0][0] === "%" && /[A-Za-z]/.test(v[m.index + m[0].length] ?? "")))));
         },
     ],
     ["option", (v) => /^--[a-z][a-z0-9]*(?:-[a-z0-9]+)+$/.test(v)], // `--password-stdin`: a flag named, not a value
@@ -543,8 +570,9 @@ export function isPath(path) {
     if (/^[a-z0-9_-]+(?:\/[a-z0-9_.-]+)*\/[a-z0-9_-]+(?:\.[a-z0-9_-]+)*\.[a-z0-9]{1,8}$/.test(value))
         return value.split(/[/._-]/).every((seg) => (seg.match(/[a-z](?=\d)|\d(?=[a-z])/g)?.length ?? 0) <= 3);
     // (Rooted at a variable too: `$HOME/.config`, `$PWD/.kube/config`, `${GITHUB_WORKSPACE}/out`. Braces only around a
-    // name, a variable's or a template's: `/srv/{app}/logs`, not `/srv/{4}/x`.)
-    if (!/^(\.{1,2}\/|~\/|\/|\$\{?[A-Za-z_]\w*\}?\/|[A-Za-z]:\\)[\w.\-/+@${}\\ ]+$/.test(value) ||
+    // name, a variable's or a template's: `/srv/{app}/logs`, not `/srv/{4}/x`. A drive's path with either slash:
+    // `C:\Users\me\.ssh\id_rsa`, `C:/Users/me/.ssh/id_rsa`.)
+    if (!/^(\.{1,2}\/|~\/|\/|\$\{?[A-Za-z_]\w*\}?\/|[A-Za-z]:[\\/])[\w.\-/+@${}\\ ]+$/.test(value) ||
         !/[/\\]/.test(value.slice(1)) ||
         /[{}]/.test(value.replace(/\$?\{[A-Za-z_]\w*\}/g, "")))
         return false;
@@ -558,6 +586,10 @@ export function isPath(path) {
  */
 export function isGeneratedSegment(seg) {
     const mixed = /[a-z]/.test(seg) && /[A-Z]/.test(seg);
+    // (A long name of parts a person joined is judged by its parts: `Wildcard-Cert2024.pem`, `Build-Pipeline-v2`.)
+    const parts = seg.split(/[-_.]+/).filter(Boolean);
+    if (mixed && /\d/.test(seg) && seg.length >= 16 && !/[$+@ ]/.test(seg) && parts.length > 1)
+        return parts.some(isGeneratedSegment);
     if (mixed && /\d/.test(seg) && (seg.length >= 16 || /[$+@ ]/.test(seg) || (seg.length >= 5 && !isNameLike(seg))))
         return true;
     if (mixed && /[A-Za-z0-9]\+[A-Za-z0-9]/.test(seg))
@@ -715,7 +747,8 @@ export function isBalanced(s) {
  * (A bare variable in capitals, after no letter, digit or `$`: `Pa$$WORD`, `P@$SWORD1` keep letters of their own.)
  */
 function isExpansionsOnly(v) {
-    const rest = v.replace(/\$\{[^{}]{1,80}\}|(?<![\p{L}\p{N}$])\$[A-Z_][A-Z0-9_]{2,40}(?![\w$])|%[A-Z_][A-Z0-9_]{2,40}%/gu, "");
+    // (A name switching between letters and digits twice or more is a password after a `$`: `$X7K2M9QP`.)
+    const rest = v.replace(/\$\{[^{}]{1,80}\}|(?<![\p{L}\p{N}$])\$[A-Z_][A-Z0-9_]{2,40}(?![\w$])|%[A-Z_][A-Z0-9_]{2,40}%/gu, (m) => (/^\$\w+$/.test(m) && (m.match(/[A-Z](?=\d)|\d(?=[A-Z])/g)?.length ?? 0) >= 2 ? m : ""));
     // (One variable at least: `!@#$%^&*()` is a password of symbols.)
     return rest !== v && !/[\p{L}\p{N}]/u.test(rest);
 }
@@ -947,10 +980,12 @@ const CODE_SHAPES = [
                         (/^(["'`]).+\1$/.test(a) && isInert(a.slice(1, -1))))));
         },
     ],
-    // Go's pointer to a qualified type or a slice of one, `*corev1.Secret`, `[]byte`: no password starts so.
+    // Go's pointer to a qualified type or a slice of one, `*corev1.Secret`, `[]byte`, or a slice of the package's own,
+    // a struct field's `TSigKeys []TSigKey`: no password starts so.
     [
         "a pointer or slice type",
-        (v) => /^(?:[*&]|\[\])(?:\[\])*[a-z][a-z0-9]*(?:\.[A-Z][A-Za-z0-9]*)?$/.test(v) && readsAsWords(v),
+        (v) => /^(?:(?:[*&]|\[\])(?:\[\])*[a-z][a-z0-9]*(?:\.[A-Z][A-Za-z0-9]*)?|\[\](?:\[\])*\*?[A-Z][A-Za-z0-9]*)$/.test(v) &&
+            readsAsWords(v),
     ],
     // `!local.is_replica`, `var.db_password`, `module.db.password`.
     ["a Terraform reference", (v) => /^!?(?:local|var|module|data|each|count|path|terraform)\.[\w.[\]"-]+$/.test(v)],
@@ -1146,6 +1181,11 @@ const PASSWORD_HASHES = [
         "LDAP",
         String.raw `\{(?:SSHA\d*|SHA\d*|MD5|SMD5)\}${B64}{16,}={0,2}|\{PBKDF2(?:-SHA\d+)?\}\d+\$${C}+\$${C}{16,}|\{(?:CRYPT|ARGON2|BCRYPT)\}(?:${CRYPT_HASH})`,
     ],
+    // Spring Security's DelegatingPasswordEncoder names the encoder first, `{bcrypt}$2a$10$…`, `{argon2}$argon2id$…`
+    // (not `{noop}`, the password itself); Werkzeug's, its method and parameters, `scrypt:32768:8:1$<salt>$<hex>`,
+    // `pbkdf2:sha256:600000$<salt>$<hex>`.
+    ["Spring Security", String.raw `\{(?:bcrypt|argon2)\}(?:${CRYPT_HASH})`],
+    ["Werkzeug", String.raw `(?:scrypt:\d+:\d+:\d+|pbkdf2:sha\d+(?::\d+)?)\$[A-Za-z0-9]{1,64}\$[0-9a-f]{40,128}`],
 ];
 const HASH_WHOLE = new RegExp(`^(?:${PASSWORD_HASHES.map(([, whole]) => whole).join("|")})$`);
 /**
@@ -1162,7 +1202,7 @@ export function isPasswordHash(value) {
 /** Words test suites and docs use as stand-in credentials: `testpass`, `secret123`, `my-api-key`, `abc123`. */
 const TEST_WORD = /^(?:hoge|fuga|piyo|hogehoge|fugafuga|piyopiyo|hogera|s3krit|s3cr3t|s3cret|secr3t|p4ss|p@ss|p4ssw0rd|passw0rd|p@ssw0rd|test(?:ing)?|secret|secrets|password|passwd|pass|pw|pwd|token|key|api|apikey|my|your|foo|bar|baz|qux|dummy|fake|sample|example|demo|user|mock|stub|value|bearer|auth|access|client|private|super|top|very|valid|invalid|wrong|bad|good|new|old|default|local|dev|one|two|abc|xyz)$/i;
 /** At least one of these makes a value a stand-in; `admin2024` or `hunter22` alone could be someone's real password. */
-const TEST_MARKER = /^(?:hoge|fuga|piyo|hogehoge|fugafuga|piyopiyo|hogera|test(?:ing)?|dummy|fake|sample|example|demo|mock|stub|foo|bar|baz|qux|invalid|wrong|abc|xyz|secret|password|pass|token|key)$/i;
+const TEST_MARKER = /^(?:hoge|fuga|piyo|hogehoge|fugafuga|piyopiyo|hogera|test(?:ing)?|dummy|fake|sample|example|demo|mock|stub|foo|bar|baz|qux|invalid|wrong|abc|xyz|secret|password|pass|token|key|value)$/i;
 /**
  * Digits as a stand-in writes them: one or two, a count (`123`, `1234`, `6789`) or one digit repeated (`000`). A real
  * password's digits are arbitrary (`Example7392`).
@@ -1188,7 +1228,7 @@ export function isTestValue(value) {
         /(?:^|[-_.])(?:password|secret|token|key)[-_]?here$/i.test(value) ||
         /(?:^|[a-z0-9])(?:Password|Secret|Token|Key)Here$/.test(value))
         return true;
-    const parts = value.split(/[-_.: ]+|(?<=[a-z])(?=[A-Z0-9])|(?<=\d)(?=[A-Za-z])/).filter(Boolean);
+    const parts = value.split(/[-_.:,;="' ]+|(?<=[a-z])(?=[A-Z0-9])|(?<=\d)(?=[A-Za-z])/).filter(Boolean);
     return (parts.length > 0 &&
         parts.every((p) => TEST_WORD.test(p) || (/^\d{1,4}$/.test(p) && isCountingDigits(p)) || /^[!@#$*]+$/.test(p)) &&
         parts.some((p) => TEST_MARKER.test(p)));
@@ -1202,7 +1242,8 @@ export function isTestValue(value) {
  * letters and digits of one length (`VKXQR-8B2MP-7WJ4T`): not names.
  */
 export function isIdentifierShaped(value) {
-    const parts = value.split(/[-_.:]/);
+    // (A sentinel's underscores, `__n8n_BLANK_VALUE`, wrap its parts.)
+    const parts = value.replace(/^_+|_+$/g, "").split(/[-_.:]/);
     if (parts.length < 2 ||
         !/^[A-Za-z]/.test(parts[0]) ||
         !parts.every((p) => /^[A-Za-z0-9]*$/.test(p)) ||
@@ -1263,9 +1304,10 @@ export function isMadePassword(value) {
 }
 /**
  * Names of algorithms, encodings and formats that sentences about credentials mention: `password (UTF-8)`, `SHA-256`;
- * and password hashers as libraries name them: Django's `pbkdf2_sha256`, `bcrypt_sha256`, passlib's `sha512_crypt`.
+ * and password hashers as libraries name them: Django's `pbkdf2_sha256`, `bcrypt_sha256`, passlib's `sha512_crypt`;
+ * and the schemes a password is checked or sent by: `scram-sha-256`, `md5crypt`, `WPA2`, `NTLMv2`, `MSCHAPv2`.
  */
-export const ALGORITHM = /^(?:SHA-?(?:1|224|256|384|512)(?:\/\d{3})?|SHA3-\d{3}|AES-?(?:128|192|256)(?:-[A-Z]{2,4})?|RSA-?(?:1024|2048|3072|4096)|MD[245]|3?DES|HMAC-SHA-?(?:1|256|384|512)|PBKDF2(?:[-_](?:HMAC[-_])?SHA-?(?:1|224|256|384|512))?|(?:md5|sha1|sha256|sha512)_crypt|ECDSA|Ed(?:25519|448)|X(?:25519|448|509)|UTF-?(?:8|16|32)(?:LE|BE)?|UCS-?[24]|PKCS#?(?:1|5|7|8|11|12)|IPv[46]|ChaCha20(?:-Poly1305)?|TLSv?1\.[0-3]|SSLv[23]|ISO-8859-\d{1,2}|Windows-125\d|Latin-?\d|CP\d{3,4}|RFC-?\d{3,5}|base(?:32|58|64)(?:url)?|hex|bcrypt(?:_sha256)?|argon2(?:id|i|d)?|scrypt|\d+-(?:stellig|chiffres|caracteres|digits?|characters?))(?:-(?:encoded|decoded|encrypted))?$/i;
+export const ALGORITHM = /^(?:SHA-?(?:1|224|256|384|512)(?:\/\d{3})?|SHA3-\d{3}|AES-?(?:128|192|256)(?:-[A-Z]{2,4})?|RSA-?(?:1024|2048|3072|4096)|MD[245]|3?DES|HMAC-SHA-?(?:1|256|384|512)|PBKDF2(?:[-_](?:HMAC[-_])?SHA-?(?:1|224|256|384|512))?|(?:md5|sha1|sha256|sha512)_?crypt|yescrypt|SCRAM-SHA-(?:1|256)(?:-PLUS)?|WPA[23]?(?:-(?:PSK|SAE|Personal|Enterprise))?|NTLMv[12]|(?:MS-?)?CHAPv2|ECDSA|Ed(?:25519|448)|X(?:25519|448|509)|UTF-?(?:8|16|32)(?:LE|BE)?|UCS-?[24]|PKCS#?(?:1|5|7|8|11|12)|IPv[46]|ChaCha20(?:-Poly1305)?|TLSv?1\.[0-3]|SSLv[23]|ISO-8859-\d{1,2}|Windows-125\d|Latin-?\d|CP\d{3,4}|RFC-?\d{3,5}|base(?:32|58|64)(?:url)?|hex|bcrypt(?:_sha256)?|argon2(?:id|i|d)?|scrypt|\d+-(?:stellig|chiffres|caracteres|digits?|characters?))(?:-(?:encoded|decoded|encrypted))?$/i;
 /** A format string's hole: `%d`, `%1$s`, `{0}`, `{{count}}`, `%{n}`. */
 const FORMAT_HOLE = /%(?:\d+\$)?[-+ 0#]*\d*(?:\.\d+)?[sdifuxXc@]|\{\{?\s*\w*\s*\}?\}|%\{\w+\}/;
 /** "Password" in another language, anywhere in a value. */
@@ -1350,7 +1392,9 @@ export function isBenignValue(value) {
         /^(?:\d+:)?\d+(?:\.\d+)+(?:\.[a-z]+\d*)?(?:[-+~][\w.]*)+$/.test(v) ||
         /^\d{4}-\d{2}-\d{2}(?:[T ]\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:?\d{2})?)?$/.test(v) || // dates
         ALGORITHM.test(v) ||
-        /^(?:(?:ctrl|cmd|alt|shift|meta|option|opt|super|mod|win|control|command)\+)+\S{1,12}$/i.test(v) || // key chords
+        // Key chords, `ctrl+shift+F12`, `Cmd+K,Cmd+S`: the key after the modifiers is one character or a key's name, so a
+        // password that starts with a modifier's word, `Super+Admin2024!`, isn't one.
+        /^(?:(?:(?:ctrl|cmd|alt|shift|meta|option|opt|super|mod|win|control|command)\+)+(?:\S|f\d{1,2}|enter|return|esc|escape|tab|space|up|down|left|right|home|end|delete|del|backspace|pageup|pagedown|pgup|pgdn|insert|ins|plus|minus|equal|comma|period|slash|backslash|backquote|pause|break|printscreen|prtsc|capslock|numlock|scrolllock|numpad\d|(?:arrow)?(?:up|down|left|right))(?:,|$))+$/i.test(v) ||
         // Key chords with `-`, a key's name after them, in a sequence: Docker's `ctrl-p,ctrl-q`, Emacs's `C-x`, an editor's
         // `Down|Ctrl-N`, `Command-Left|Home|Ctrl-A`. (A key named alone, `Home`, only in a list.)
         /^(?:(?:(?:ctrl|cmd|alt|shift|meta|option|opt|super|control|command|[CMS])-)+(?:[a-z0-9@[\]\\^_]|f\d{1,2}|enter|esc|escape|tab|space|up|down|left|right|home|end|delete|del|backspace|pageup|pagedown|insert)(?:[,|]|$))+$/i.test(v) ||
@@ -1449,8 +1493,8 @@ export function isCredentialReference(value) {
  * layer's `encrypted` veto), is ciphertext, whose key isn't there.
  */
 export const ENCRYPTION_WRAPPER = String.raw `ENC\[[A-Z0-9_]+,data:|ENC\(|\{cipher\}|\$\{VAULT::(?:[^:}\s]+::){0,3}|\[enc:\w+:|\bEV\[\d+:(?:[A-Za-z0-9+/=]+:)?`;
-// (Jenkins's `hudson.util.Secret`, `{AQAAABAAAA…}`: a version byte and the IV's length, then the IV and the ciphertext.)
-const ENCRYPTED_VALUE = new RegExp(String.raw `^(?:${ENCRYPTION_WRAPPER}|ENC\[|!vault\b|\$ANSIBLE_VAULT|\{?AQAAABAAAA[A-Za-z0-9+/]{30,}={0,2}\}?$)`);
+// (Not Jenkins's `hudson.util.Secret`, `{AQAAABAAAA…}`: its key sits on the same machine, policy.ts.)
+const ENCRYPTED_VALUE = new RegExp(String.raw `^(?:${ENCRYPTION_WRAPPER}|ENC\[|!vault\b|\$ANSIBLE_VAULT)`);
 /** Default passwords and words that show up in ordinary output, too common to be anyone's secret. */
 export const COMMON_WORDS = new Set([
     "files",
@@ -1571,10 +1615,11 @@ export const COMMON_WORDS = new Set([
 ]);
 /**
  * "Password" in another language, as a form's label (i18n files, string resources): `wachtwoord`, `mot de passe
- * actuel`, run together or plural (`Motdepasse`, `Passwörter`, `Contraseñas`), with a note in words after it
+ * actuel`, run together or plural (`Motdepasse`, `Passwörter`, `Contraseñas`), with a word or two around it
+ * (`Ubah kata sandi`, "change password"; `Kata sandi inisialisasi admin`) or a note in words after it
  * (`Phrase de passe (facultative)`, `Contraseña (opcional)`).
  */
-const PASSWORD_LABEL = new RegExp(String.raw `^(?:${FOREIGN_PASSWORD_SPELLINGS.map((s) => s.replace(/ /g, "\\s*")).join("|")})(?:s|es|er|en|e)?(?:\s+\p{L}+)?(?:\s*\([\p{L} ,.'’/-]{1,30}\))?\*?$`, "iu");
+const PASSWORD_LABEL = new RegExp(String.raw `^(?:\p{L}+\s+){0,2}(?:${FOREIGN_PASSWORD_SPELLINGS.map((s) => s.replace(/ /g, "\\s*")).join("|")})(?:s|es|er|en|e)?(?:\s+\p{L}+){0,2}(?:\s*\([\p{L} ,.'’/-]{1,30}\))?\*?$`, "iu");
 const isPasswordLabel = (value) => PASSWORD_LABEL.test(value);
 /**
  * Whether a value under a credential name is a literal secret worth hiding: not a type, a placeholder,

package/docs/holdout.svg

@@ -1,5 +1,5 @@
 <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 760 460" width="760" height="460" role="img" aria-labelledby="t d">
-<title id="t">Held-out test set: secrets caught vs. look-alikes destroyed</title><desc id="d">redac---n guessing off: 90.9% of secrets caught, 1.1% of keep values lost; redac---n guessing confident: 93.0% of secrets caught, 3.0% of keep values lost; redac---n guessing eager: 93.2% of secrets caught, 3.2% of keep values lost; gitleaks: 54.6% of secrets caught, 1.5% of keep values lost; betterleaks: 67.0% of secrets caught, 1.7% of keep values lost; kingfisher: 43.1% of secrets caught, 0.5% of keep values lost; trufflehog: 38.5% of secrets caught, 0.4% of keep values lost; noseyparker: 42.1% of secrets caught, 1.5% of keep values lost; detect-secrets: 47.2% of secrets caught, 15.2% of keep values lost; credsweeper: 70.1% of secrets caught, 15.2% of keep values lost; union(all 7): 84.2% of secrets caught, 28.6% of keep values lost; union(all but detect-secrets): 83.1% of secrets caught, 16.9% of keep values lost; gitleaks+betterleaks+kingfisher: 70.6% of secrets caught, 2.2% of keep values lost</desc>
+<title id="t">Held-out test set: secrets caught vs. look-alikes destroyed</title><desc id="d">redac---n guessing off: 90.5% of secrets caught, 0.9% of keep values lost; redac---n guessing confident: 92.6% of secrets caught, 2.9% of keep values lost; redac---n guessing eager: 92.8% of secrets caught, 3.0% of keep values lost; gitleaks: 54.6% of secrets caught, 1.5% of keep values lost; betterleaks: 67.0% of secrets caught, 1.7% of keep values lost; kingfisher: 43.1% of secrets caught, 0.5% of keep values lost; trufflehog: 38.5% of secrets caught, 0.4% of keep values lost; noseyparker: 42.1% of secrets caught, 1.5% of keep values lost; detect-secrets: 47.2% of secrets caught, 15.2% of keep values lost; credsweeper: 70.1% of secrets caught, 15.2% of keep values lost; union(all 7): 84.2% of secrets caught, 28.6% of keep values lost; union(all but detect-secrets): 83.1% of secrets caught, 16.9% of keep values lost; gitleaks+betterleaks+kingfisher: 70.6% of secrets caught, 2.2% of keep values lost</desc>
 <style>
 .bg { fill: #fcfcfb; } .accent { fill: #2a78d6; } .accent-line { stroke: #2a78d6; } .other { fill: #898781; }
 .hollow { fill: none; stroke: #898781; } .chain { fill: none; stroke: #c3c2b7; stroke-width: 1.5; }
@@ -53,7 +53,7 @@ text { font-family: system-ui, -apple-system, "Segoe UI", sans-serif; fill: #525
 <line class="axis" x1="56" x2="736" y1="408" y2="408"/>
 <text x="736" y="450" text-anchor="end">text that must survive but was redacted (lower is better, √ scale) →</text>
 <text transform="translate(14 408) rotate(-90)">secrets caught (higher is better) →</text>
-<polyline fill="none" class="accent-line" stroke-width="2" points="183.64059086206942,108.90531347674198 272.5676772508076,98.46957161242875 278.1937486206931,97.52086780658203"/>
+<polyline fill="none" class="accent-line" stroke-width="2" points="171.4552585205683,110.80272108843525 265.6171632148547,100.36697922412208 271.4248319264723,99.41827541827541"/>
 <circle cx="624.92" cy="74" r="6" class="accent"/><text x="635.92" y="78" class="ours">redac---n</text>
 <circle cx="624.92" cy="94" r="5" class="other"/><text x="635.92" y="98">other scanners</text>
 <circle cx="209.94034469409104" cy="287.26162897591473" r="5" class="other ring" stroke-width="2"><title>gitleaks: 54.6% caught, 1.5% lost</title></circle>
@@ -66,12 +66,12 @@ text { font-family: system-ui, -apple-system, "Segoe UI", sans-serif; fill: #525
 <circle cx="719.6120496050027" cy="141.47747747747746" r="5" class="other ring" stroke-width="2"><title>union(all 7): 84.2% caught, 28.6% lost</title></circle>
 <circle cx="565.5944718414523" cy="147.16970031255744" r="5" class="other ring" stroke-width="2"><title>union(all but detect-secrets): 83.1% caught, 16.9% lost</title></circle>
 <circle cx="239.2256589830112" cy="208.51921309064167" r="5" class="other ring" stroke-width="2"><title>gitleaks+betterleaks+kingfisher: 70.6% caught, 2.2% lost</title></circle>
-<circle cx="183.64059086206942" cy="108.90531347674198" r="6" class="accent ring" stroke-width="2"><title>redac---n guessing off: 90.9% caught, 1.1% lost</title></circle>
-<circle cx="272.5676772508076" cy="98.46957161242875" r="6" class="accent ring" stroke-width="2"><title>redac---n guessing confident: 93.0% caught, 3.0% lost</title></circle>
-<circle cx="278.1937486206931" cy="97.52086780658203" r="6" class="accent ring" stroke-width="2"><title>redac---n guessing eager: 93.2% caught, 3.2% lost</title></circle>
-<text x="288.1937486206931" y="101.52086780658203" text-anchor="start" class="ours">guessing eager</text>
-<text x="264.5676772508076" y="88.46957161242875" text-anchor="end" class="ours">guessing confident</text>
-<text x="173.64059086206942" y="112.90531347674198" text-anchor="end" class="ours">guessing off</text>
+<circle cx="171.4552585205683" cy="110.80272108843525" r="6" class="accent ring" stroke-width="2"><title>redac---n guessing off: 90.5% caught, 0.9% lost</title></circle>
+<circle cx="265.6171632148547" cy="100.36697922412208" r="6" class="accent ring" stroke-width="2"><title>redac---n guessing confident: 92.6% caught, 2.9% lost</title></circle>
+<circle cx="271.4248319264723" cy="99.41827541827541" r="6" class="accent ring" stroke-width="2"><title>redac---n guessing eager: 92.8% caught, 3.0% lost</title></circle>
+<text x="281.4248319264723" y="103.41827541827541" text-anchor="start" class="ours">guessing eager</text>
+<text x="257.6171632148547" y="90.36697922412208" text-anchor="end" class="ours">guessing confident</text>
+<text x="161.4552585205683" y="114.80272108843525" text-anchor="end" class="ours">guessing off</text>
 <text x="709.6120496050027" y="145.47747747747746" text-anchor="end">all seven combined</text>
 <text x="555.5944718414523" y="151.16970031255744" text-anchor="end">all but detect-secrets</text>
 <text x="249.2256589830112" y="212.51921309064167" text-anchor="start">gitleaks + Betterleaks + Kingfisher</text>

package/docs/layers.md

@@ -39,7 +39,7 @@ no name, format or structure around it: the key passed to `Client("…")`, a tok
 into chat. It's also wrong most often: 140 look-alikes, mostly random IDs and hashes, are destroyed by it alone,
 which is why `guessing` is a setting.
 
-**Formats** (`src/formats.ts`) recognizes 536 vendor token formats by their prefixes and shapes (`ghp_`, `sk-ant-`,
+**Formats** (`src/formats.ts`) recognizes 542 vendor token formats by their prefixes and shapes (`ghp_`, `sk-ant-`,
 `xoxb-`, `AKIA…`). On its own it catches a third of the secrets, but most of those have a name next to them too, so
 what only it catches is smaller. It almost never fires on ordinary text: 0.09 false redactions per million
 characters.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "redac---n",
-	"version": "0.0.4",
+	"version": "0.0.5",
 	"description": "Redact secrets from text and agent transcripts before they reach an untrusted model provider",
 	"keywords": [
 		"secrets",