@jbrowse/core 5.0.0-beta.1 → 5.0.0-beta.11

package/esm/util/featureTypes.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Classification of a feature from its `type` string alone, for the plugins
+ * that decide something about a feature they did not parse. A type is the only
+ * thing a display, a menu or a widget can ask about a feature without knowing
+ * which adapter produced it, so these live in core rather than beside any one
+ * of their callers.
+ */
+/**
+ * Whether the type names a unit of transcription — a gene, a transcript, or an
+ * RNA, including the pseudogene and V(D)J segment spellings. This is the
+ * question "does this feature have exons", not "can this feature be spliced":
+ * an alignment splices too and is deliberately not gene-like, because a caller
+ * that means to launch a protein view or read a CDS would be wrong about it.
+ */
+export declare function isGeneLikeType(type: string | undefined): boolean;
+/**
+ * Whether the type names a sequence alignment — SO `match` and its subtypes
+ * (`cDNA_match`, `EST_match`, `nucleotide_match`, `protein_match`,
+ * `translated_nucleotide_match`), whose `match_part` children are the aligned
+ * blocks and whose gaps between them are introns when the aligned sequence was
+ * a transcript. Separate from `isGeneLikeType` on purpose: an EST alignment is
+ * evidence for a gene, not one.
+ */
+export declare function isSequenceMatchType(type: string | undefined): boolean;

package/esm/util/featureTypes.js

@@ -0,0 +1,35 @@
+/**
+ * Classification of a feature from its `type` string alone, for the plugins
+ * that decide something about a feature they did not parse. A type is the only
+ * thing a display, a menu or a widget can ask about a feature without knowing
+ * which adapter produced it, so these live in core rather than beside any one
+ * of their callers.
+ */
+// Anchored at the end so 'intergenic_region' is not a gene, 'rnapol_binding_site'
+// is not an RNA, and 'transcriptional_cis_regulatory_region' is not a
+// transcript.
+const GENE_LIKE_TYPE = /gene(_segment)?$|rna$|transcript$/;
+/**
+ * Whether the type names a unit of transcription — a gene, a transcript, or an
+ * RNA, including the pseudogene and V(D)J segment spellings. This is the
+ * question "does this feature have exons", not "can this feature be spliced":
+ * an alignment splices too and is deliberately not gene-like, because a caller
+ * that means to launch a protein view or read a CDS would be wrong about it.
+ */
+export function isGeneLikeType(type) {
+    return type !== undefined && GENE_LIKE_TYPE.test(type.toLowerCase());
+}
+// SO `match` and every subtype of it is spelled `<something>_match`, so the
+// suffix is the family. `match_part`, the child, is excluded by the anchor.
+const SEQUENCE_MATCH_TYPE = /(^|_)match$/;
+/**
+ * Whether the type names a sequence alignment — SO `match` and its subtypes
+ * (`cDNA_match`, `EST_match`, `nucleotide_match`, `protein_match`,
+ * `translated_nucleotide_match`), whose `match_part` children are the aligned
+ * blocks and whose gaps between them are introns when the aligned sequence was
+ * a transcript. Separate from `isGeneLikeType` on purpose: an EST alignment is
+ * evidence for a gene, not one.
+ */
+export function isSequenceMatchType(type) {
+    return type !== undefined && SEQUENCE_MATCH_TYPE.test(type.toLowerCase());
+}

package/esm/util/fetchAndMaybeUnzip.js

@@ -1,6 +1,8 @@
 import { redactSource } from './getLocationUri.js';
 import { downloadStatus, phaseOf, updateStatus } from './progress.js';
-import { withStopTokenSignal } from './stopToken.js';
+function loadInflater() {
+    return import('@gmod/bgzf-filehandle');
+}
 export function isGzip(buf) {
     return buf[0] === 31 && buf[1] === 139 && buf[2] === 8;
 }
@@ -36,22 +38,27 @@ label = 'Downloading file') {
     const phase = loc.source === undefined
         ? label
         : { message: phaseOf(label), source: redactSource(loc.source) };
-    const { statusCallback, stopToken } = opts;
-    // the stop token becomes the read's signal, so a cancelled whole-file load
-    // drops at the socket rather than downloading a multi-GB body to completion
-    const buf = await withStopTokenSignal(stopToken, signal => downloadStatus(phase, statusCallback, onProgress => loc.readFile({ ...opts, onProgress, signal })));
+    const { statusCallback, signal } = opts;
     // the inflater is imported dynamically because this module is reachable from
     // the core/util barrel, so a static import put bgzf-filehandle + pako
-    // (~180KB) on the startup path of every page load; only an actually-gzipped
-    // file needs them
+    // (~180KB) on the startup path of every page load. A name ending .gz starts
+    // that import beside the download instead of after it; the bytes still decide
+    // whether to inflate.
+    const inflater = /\.gz($|[?#])/.test(loc.source ?? '')
+        ? loadInflater()
+        : undefined;
+    inflater?.catch(() => { });
+    // the signal reaches the read, so a cancelled whole-file load drops at the
+    // socket rather than downloading a multi-GB body to completion
+    const buf = await downloadStatus(phase, statusCallback, onProgress => loc.readFile({ ...opts, onProgress, signal }));
     return isGzip(buf)
         ? await updateStatus('Unzipping', statusCallback, async () => {
-            const { unzip } = await import('@gmod/bgzf-filehandle');
+            const { unzip } = await (inflater ?? loadInflater());
             return unzip(buf);
         }, 
         // a cancel landing here is otherwise discovered only by whatever parses
         // the result, after a whole-file inflate has run to completion
-        stopToken)
+        signal)
         : buf;
 }
 export async function fetchAndMaybeUnzipText(loc, opts, label) {

package/esm/util/fetchContext.d.ts

@@ -1,9 +1,8 @@
 import type { RpcCallArgs, RpcCallReturn } from '../rpc/RpcRegistry.ts';
 import type { StatusCallback } from './progress.ts';
-import type { StopToken } from './stopToken.ts';
 import type { IStateTreeNode } from '@jbrowse/mobx-state-tree';
 export interface FetchContext {
-    stopToken: StopToken;
+    signal: AbortSignal;
     isStale: () => boolean;
     /**
      * The RPC `statusCallback` for the work this context describes: guarded to
@@ -24,23 +23,23 @@ export interface FetchContext {
     /**
      * The one way a fetch calls an RPC: the registry-typed
      * `rpcManager.call(rpcSessionId, method, args)` with this context's
-     * `stopToken` and `statusCallback` injected. Both used to be hand-threaded
+     * `signal` and `statusCallback` injected. Both used to be hand-threaded
      * at every fetch site, and forgetting either was silent — no cancellation
      * for that display, or no progress — which is exactly the failure class the
      * envelope makes inexpressible: a fetch cannot issue an RPC the cancel and
      * the status bar don't know about.
      *
      * Declared with a `this` parameter so it reads the *holding* context's
-     * token and callback — the fan-out copies rebind it to their own status
+     * signal and callback — the fan-out copies rebind it to their own status
      * slot by construction — and so destructuring it off the context is a type
      * error rather than a stale binding.
      */
-    callRpc: <M extends string>(this: FetchContext, method: M, args: Omit<RpcCallArgs<M>, 'stopToken' | 'statusCallback'>) => Promise<RpcCallReturn<M>>;
+    callRpc: <M extends string>(this: FetchContext, method: M, args: Omit<RpcCallArgs<M>, 'signal' | 'statusCallback'>) => Promise<RpcCallReturn<M>>;
 }
 /**
  * Build a {@link FetchContext} over a live fetch's primitives. One
- * constructor, so every context — `runFetch`'s, the prerequisite skeleton's —
- * carries the same `callRpc` envelope.
+ * constructor, so every context — `FetchMixin.runFetch`'s and `runFetchOnce`'s
+ * alike — carries the same `callRpc` envelope.
  *
  * **`self` has to be somewhere `getRpcSessionId` can find one, which in practice
  * means a track or something under it.** `rpcSessionId` is declared by
@@ -52,7 +51,7 @@ export interface FetchContext {
  * track, which is what the breakpoint split view's overlay fetch does.
  */
 export declare function makeFetchContext(self: IStateTreeNode, base: {
-    stopToken: StopToken;
+    signal: AbortSignal;
     isStale: () => boolean;
     statusCallback: StatusCallback;
 }): FetchContext;

package/esm/util/fetchContext.js

@@ -3,8 +3,8 @@ import { createStatusFanOut } from './progress.js';
 import { getRpcHost } from './sessionServices.js';
 /**
  * Build a {@link FetchContext} over a live fetch's primitives. One
- * constructor, so every context — `runFetch`'s, the prerequisite skeleton's —
- * carries the same `callRpc` envelope.
+ * constructor, so every context — `FetchMixin.runFetch`'s and `runFetchOnce`'s
+ * alike — carries the same `callRpc` envelope.
  *
  * **`self` has to be somewhere `getRpcSessionId` can find one, which in practice
  * means a track or something under it.** `rpcSessionId` is declared by
@@ -21,7 +21,7 @@ export function makeFetchContext(self, base) {
         callRpc(method, args) {
             return getRpcHost(self).rpcManager.call(getRpcSessionId(self), method, {
                 ...args,
-                stopToken: this.stopToken,
+                signal: this.signal,
                 statusCallback: this.statusCallback,
             });
         },

package/esm/util/fetchHub.d.ts

@@ -1,6 +1,6 @@
 export interface HubConfig {
     assemblies?: Record<string, unknown>[];
-    aggregateTextSearchAdapters?: Record<string, unknown>[];
+    aggregateTextSearchAdapters?: (string | Record<string, unknown>)[];
     tracks?: Record<string, unknown>[];
     [key: string]: unknown;
 }
@@ -12,4 +12,6 @@ export declare function hubUrl(hub: string): string;
  * the name straight to `createLinearGenomeView({ assembly: 'hg38' })` for the
  * common case; call this directly only to cherry-pick tracks from the catalog.
  */
-export declare function fetchHub(hub: string): Promise<HubConfig>;
+export declare function fetchHub(hub: string, { signal }?: {
+    signal?: AbortSignal;
+}): Promise<HubConfig>;

package/esm/util/fetchHub.js

@@ -15,9 +15,9 @@ export function hubUrl(hub) {
  * the name straight to `createLinearGenomeView({ assembly: 'hg38' })` for the
  * common case; call this directly only to cherry-pick tracks from the catalog.
  */
-export async function fetchHub(hub) {
+export async function fetchHub(hub, { signal } = {}) {
     const url = hubUrl(hub);
-    const response = await fetch(url);
+    const response = await fetch(url, { signal });
     if (response.ok) {
         const config = (await response.json());
         // hosted configs reference their data relative to the config's own location

package/esm/util/fetchPhases.d.ts

@@ -4,10 +4,10 @@
  * remembered.
  *
  * The shared `installFetch` skeleton takes this shape, and so does the LGV
- * global family (`installGlobalFetchAutorun`, over `FetchMixin.runFetch`). It
- * was the same contract declared twice, with the same three rules explained
- * twice, which is a drift axis over rules whose whole value is being the same
- * everywhere.
+ * global family (`installGlobalFetchAutorun`, a declaration over that same
+ * skeleton). It was the same contract declared twice, with the same three rules
+ * explained twice, which is a drift axis over rules whose whole value is being
+ * the same everywhere.
  *
  * `TCtx` is what a family hands its `run`: a `FetchContext` for most of them, a
  * `ComparativeFetchContext` (that plus adapter config and refName rename) for
@@ -43,7 +43,7 @@ export interface FetchPhases<TArgs, TResult, TCtx> {
      * gets a dead Retry button — see there.
      *
      * What it must **not** do is move a trigger read of its own under a bail-out.
-     * See ARCHITECTURE.md §"The global-fetch trigger list must be read
+     * See reference/FETCH_KEYS.md §"The global-fetch trigger list must be read
      * unconditionally".
      */
     prepare: () => TArgs | undefined;
@@ -56,11 +56,11 @@ export interface FetchPhases<TArgs, TResult, TCtx> {
      * **Nothing it reads is tracked**, so the payload it assembles cannot widen
      * the autorun's dependency set the way calling `rpcProps()` in the body would.
      * Being async is not what buys that — `run` is *called* synchronously, so its
-     * own prefix down to its first `await` runs wherever the caller was. Each
-     * family arranges it: the global one reaches `run` through
-     * `FetchMixin.runFetch`, an MST flow and so an action, which MobX runs
-     * untracked; the comparative one calls its lifecycle inside `untracked`
-     * because it has no action to hide behind.
+     * own prefix down to its first `await` runs wherever the caller was. The
+     * `installFetch` skeleton calls it inside `untracked`, which covers the
+     * global and comparative families with it; the per-region family reaches its
+     * work through `FetchMixin.runFetch`, an MST flow and so an action, which
+     * MobX runs untracked.
      */
     run: (args: TArgs, ctx: TCtx) => Promise<TResult | undefined>;
     /**

package/esm/util/fetchSeq.d.ts

@@ -1,12 +1,11 @@
 import type { StatusCallback } from './progress.ts';
-import type { StopToken } from './stopToken.ts';
 import type { AbstractSessionModel } from './types/index.ts';
-export declare function fetchSeq({ start, end, refName, assemblyName, session, stopToken, statusCallback, }: {
+export declare function fetchSeq({ start, end, refName, assemblyName, session, signal, statusCallback, }: {
     start: number;
     end: number;
     refName: string;
     assemblyName: string;
     session: AbstractSessionModel;
-    stopToken?: StopToken;
+    signal?: AbortSignal;
     statusCallback?: StatusCallback;
 }): Promise<string>;

package/esm/util/fetchSeq.js

@@ -1,5 +1,5 @@
 import { getSequenceAdapterConfig } from '../assemblyManager/getSequenceAdapterConfig.js';
-export async function fetchSeq({ start, end, refName, assemblyName, session, stopToken, statusCallback, }) {
+export async function fetchSeq({ start, end, refName, assemblyName, session, signal, statusCallback, }) {
     const { rpcManager, assemblyManager } = session;
     const assembly = await assemblyManager.waitForAssembly(assemblyName);
     if (!assembly) {
@@ -28,7 +28,7 @@ export async function fetchSeq({ start, end, refName, assemblyName, session, sto
             refName: seqAdapterRefName,
             assemblyName,
         },
-        stopToken,
+        signal,
         statusCallback,
     });
     return seq ?? '';

package/esm/util/fieldReader.d.ts

@@ -0,0 +1,17 @@
+import type { JexlInstance } from './jexlStrings.ts';
+import type { Feature } from './simpleFeature.ts';
+/**
+ * #api
+ * What a channel reads off a feature: a field by name, a dotted path into a
+ * structured field where no field carries the whole name (`INFO.SVTYPE` on a
+ * VCF record), or a `jexl:` expression over `feature`. A jexl expression that
+ * does not compile throws here, once, rather than on every feature.
+ */
+export declare function fieldReader(ref: string, jexl: JexlInstance | undefined): (feature: Feature) => unknown;
+/**
+ * #api
+ * Whether a field ref is a bare name: what `feature.get` answers on its own,
+ * with no path to walk and no expression to evaluate. A loop over a plain name
+ * keeps the direct call, and only a config that writes a path pays for one.
+ */
+export declare function isPlainFieldRef(ref: string): ref is never;

package/esm/util/fieldReader.js

@@ -0,0 +1,62 @@
+import { isJexl, stringToJexlExpression } from './jexlStrings.js';
+import { buildJexlContext } from './simpleFeature.js';
+/**
+ * #api
+ * What a channel reads off a feature: a field by name, a dotted path into a
+ * structured field where no field carries the whole name (`INFO.SVTYPE` on a
+ * VCF record), or a `jexl:` expression over `feature`. A jexl expression that
+ * does not compile throws here, once, rather than on every feature.
+ */
+export function fieldReader(ref, jexl) {
+    const path = ref.includes('.') ? ref.split('.') : undefined;
+    const rests = path?.map((_, i) => path.slice(i).join('.'));
+    if (isJexl(ref)) {
+        if (!jexl) {
+            throw new Error(`a jexl: field needs a jexl instance (${ref})`);
+        }
+        const expr = stringToJexlExpression(ref, jexl);
+        return feature => expr.eval(buildJexlContext({ feature }));
+    }
+    return feature => {
+        const value = feature.get(ref);
+        return value === undefined && path && rests
+            ? readPath(feature.get(path[0]), path, rests)
+            : value;
+    };
+}
+/**
+ * #api
+ * Whether a field ref is a bare name: what `feature.get` answers on its own,
+ * with no path to walk and no expression to evaluate. A loop over a plain name
+ * keeps the direct call, and only a config that writes a path pays for one.
+ */
+export function isPlainFieldRef(ref) {
+    return !ref.includes('.') && !isJexl(ref);
+}
+function readPath(root, path, rests) {
+    let value = root;
+    for (let i = 1; i < path.length; i++) {
+        value =
+            typeof value === 'object' && value !== null
+                ? Reflect.get(value, path[i])
+                : undefined;
+    }
+    return value ?? readWholeRest(root, path, rests);
+}
+// A path that read nothing by descending tries each level's rest as one key,
+// so `INFO.AF.EAS` reaches a key named `AF.EAS`, which VCF 4.3 allows. Only a
+// miss pays for it: a path that resolves is the plain walk above.
+function readWholeRest(root, path, rests) {
+    let value = root;
+    for (let i = 1; i < path.length - 1; i++) {
+        if (typeof value !== 'object' || value === null) {
+            return undefined;
+        }
+        const whole = Reflect.get(value, rests[i]);
+        if (whole !== undefined) {
+            return whole ?? undefined;
+        }
+        value = Reflect.get(value, path[i]);
+    }
+    return undefined;
+}

package/esm/util/formatBytes.js

@@ -10,7 +10,7 @@ const units = ['bytes', 'kB', 'MB', 'GB', 'TB'];
 export function formatBytes(bytes) {
     let n = bytes;
     let i = 0;
-    while (n >= 1000 && i < units.length - 1) {
+    while (Number(n.toFixed(1)) >= 1000 && i < units.length - 1) {
         n /= 1000;
         i++;
     }

package/esm/util/formatGuessers.d.ts

@@ -1,7 +1,23 @@
-import type PluginManager from '../PluginManager.ts';
 import type { AdapterConfig } from './tracks.ts';
 import type { FileLocation } from './types/data.ts';
 import type { AdapterSpec } from '@jbrowse/add-track-core';
+/**
+ * creates a new location from the provided location including the appropriate
+ * suffix and location type
+ *
+ * @param location - the FileLocation
+ * @param suffix - the file suffix (e.g. .bam)
+ * @returns the constructed location object from the provided parameters
+ */
+export declare function makeIndex(location: FileLocation, suffix: string): import("./index.ts").BlobLocation | import("./index.ts").FileHandleLocation | {
+    uri: string;
+    locationType: string;
+    baseUri?: string | undefined;
+    localPath?: undefined;
+} | {
+    localPath: string;
+    locationType: string;
+};
 /**
  * The adapter config one format-table entry describes: the data file under the
  * field that format's adapter reads it from, plus wherever that adapter expects
@@ -14,17 +30,12 @@ import type { AdapterSpec } from '@jbrowse/add-track-core';
  */
 export declare function adapterConfigFromSpec(spec: AdapterSpec, file: FileLocation, index?: FileLocation): AdapterConfig | undefined;
 /**
- * Guess every format `@jbrowse/add-track-core`'s table describes — the same
- * table `@jbrowse/cli`'s `add-track` reads, so a file resolves to the same
- * adapter config in the app and on the command line.
- *
- * Whether a build can open a format is decided by `hasAdapterType`, not by the
- * table: guessing `BamAdapter` in a build with no alignments plugin writes a
- * track config that fails at render. A plugin therefore registers its adapters
- * and nothing else — there is no format list to keep in step. ADR-077.
- *
- * `CorePlugin` installs this first, so any `addAdapterGuesser` a plugin
- * registers is later in the chain and wins over the table. That is how a format
- * the table cannot express is added, and how a third-party plugin claims one.
+ * The track the format table makes of a file: its adapter, the track type that
+ * draws it, and the file name as its name. `undefined` for a file no format
+ * claims, which is where `guessTrackConf` throws.
  */
-export declare function installFormatGuessers(pluginManager: PluginManager): void;
+export declare function guessTrackConfFromTable(file: FileLocation, index?: FileLocation, adapterHint?: string): {
+    type: string;
+    name: string;
+    adapter: AdapterConfig;
+} | undefined;

package/esm/util/formatGuessers.js

@@ -1,6 +1,33 @@
 import { matchFormat, resolveIndexType, trackTypeForAdapter, } from '@jbrowse/add-track-core';
 import { getFileName } from './getFileName.js';
-import { addAdapterGuesser, addTrackTypeGuesser, makeIndex } from './tracks.js';
+/**
+ * creates a new location from the provided location including the appropriate
+ * suffix and location type
+ *
+ * @param location - the FileLocation
+ * @param suffix - the file suffix (e.g. .bam)
+ * @returns the constructed location object from the provided parameters
+ */
+export function makeIndex(location, suffix) {
+    if ('uri' in location) {
+        return {
+            uri: location.uri + suffix,
+            locationType: 'UriLocation',
+            // carry the parent's baseUri so a derived sibling index resolves against
+            // the same config location as the file it indexes
+            ...(location.baseUri ? { baseUri: location.baseUri } : {}),
+        };
+    }
+    else if ('localPath' in location) {
+        return {
+            localPath: location.localPath + suffix,
+            locationType: 'LocalPathLocation',
+        };
+    }
+    else {
+        return location;
+    }
+}
 /**
  * The adapter config one format-table entry describes: the data file under the
  * field that format's adapter reads it from, plus wherever that adapter expects
@@ -39,31 +66,19 @@ export function adapterConfigFromSpec(spec, file, index) {
     }
 }
 /**
- * Guess every format `@jbrowse/add-track-core`'s table describes — the same
- * table `@jbrowse/cli`'s `add-track` reads, so a file resolves to the same
- * adapter config in the app and on the command line.
- *
- * Whether a build can open a format is decided by `hasAdapterType`, not by the
- * table: guessing `BamAdapter` in a build with no alignments plugin writes a
- * track config that fails at render. A plugin therefore registers its adapters
- * and nothing else — there is no format list to keep in step. ADR-077.
- *
- * `CorePlugin` installs this first, so any `addAdapterGuesser` a plugin
- * registers is later in the chain and wins over the table. That is how a format
- * the table cannot express is added, and how a third-party plugin claims one.
+ * The track the format table makes of a file: its adapter, the track type that
+ * draws it, and the file name as its name. `undefined` for a file no format
+ * claims, which is where `guessTrackConf` throws.
  */
-// #region installFormatGuessers
-export function installFormatGuessers(pluginManager) {
-    addAdapterGuesser(pluginManager, (file, index, adapterHint) => {
-        const spec = matchFormat(getFileName(file), adapterHint)?.spec;
-        return spec &&
-            'adapterType' in spec &&
-            pluginManager.hasAdapterType(spec.adapterType)
-            ? adapterConfigFromSpec(spec, file, index)
-            : undefined;
-    });
-    addTrackTypeGuesser(pluginManager, (adapterName, file) => pluginManager.hasAdapterType(adapterName)
-        ? trackTypeForAdapter(adapterName, file && getFileName(file))
-        : undefined);
+export function guessTrackConfFromTable(file, index, adapterHint) {
+    const name = getFileName(file);
+    const spec = matchFormat(name, adapterHint)?.spec;
+    const adapter = spec && adapterConfigFromSpec(spec, file, index);
+    return adapter
+        ? {
+            type: trackTypeForAdapter(adapter.type, name) ?? 'FeatureTrack',
+            name,
+            adapter,
+        }
+        : undefined;
 }
-// #endregion

package/esm/util/formatRelativeTime.js

@@ -15,7 +15,7 @@ export function formatRelativeTime(date, now = Date.now()) {
     let duration = (Number(date) - now) / 1000;
     let result = rtf.format(Math.round(duration), 'years');
     for (const { amount, unit } of DIVISIONS) {
-        if (Math.abs(duration) < amount) {
+        if (Math.round(Math.abs(duration)) < amount) {
             result = rtf.format(Math.round(duration), unit);
             break;
         }

package/esm/util/freezeDeep.d.ts

@@ -1,20 +1,18 @@
 /**
  * Freeze `value` and everything reachable from it, in place, and return it.
  *
- * For a value handed to consumers **by reference on purpose**: a config slot's
- * `promotedBase` (the one literal every track sitting at base resolves to) and a
- * stored user preference (a promoted display-type default, read by every
- * following display). Sharing the reference is load-bearing in both cases —
- * `===` stability is what lets a display's cached MobX computed re-resolve
+ * For a value handed to consumers **by reference on purpose**: a stored user
+ * preference, read by everything that follows it. Sharing the reference is
+ * load-bearing — `===` stability is what lets a cached MobX computed re-derive
  * without waking anything downstream — so handing out a defensive copy per read
  * would trade a silent hazard for a real re-render on every read. Freezing keeps
  * the identity and makes "nothing mutates this" throw rather than quietly
- * rewriting a value every other track is reading.
+ * rewriting a value every other reader sees.
  *
- * Both callers freeze once, at schema build or at the store write, over a value
- * that has to survive `postMessage` anyway — so the recursion is over small JSON
- * and costs nothing per read. Cyclic input terminates: each object is frozen
- * before its children are visited.
+ * The caller freezes once, at the store write, over a value that has to survive
+ * `postMessage` anyway — so the recursion is over small JSON and costs nothing
+ * per read. Cyclic input terminates: each object is frozen before its children
+ * are visited.
  *
  * **Unconditional, deliberately unlike MST's own `deepFreeze`** (whose body this
  * otherwise mirrors), which is gated on `devMode()`. MST gates because it freezes

package/esm/util/freezeDeep.js

@@ -6,20 +6,18 @@ function isObjectLike(value) {
 /**
  * Freeze `value` and everything reachable from it, in place, and return it.
  *
- * For a value handed to consumers **by reference on purpose**: a config slot's
- * `promotedBase` (the one literal every track sitting at base resolves to) and a
- * stored user preference (a promoted display-type default, read by every
- * following display). Sharing the reference is load-bearing in both cases —
- * `===` stability is what lets a display's cached MobX computed re-resolve
+ * For a value handed to consumers **by reference on purpose**: a stored user
+ * preference, read by everything that follows it. Sharing the reference is
+ * load-bearing — `===` stability is what lets a cached MobX computed re-derive
  * without waking anything downstream — so handing out a defensive copy per read
  * would trade a silent hazard for a real re-render on every read. Freezing keeps
  * the identity and makes "nothing mutates this" throw rather than quietly
- * rewriting a value every other track is reading.
+ * rewriting a value every other reader sees.
  *
- * Both callers freeze once, at schema build or at the store write, over a value
- * that has to survive `postMessage` anyway — so the recursion is over small JSON
- * and costs nothing per read. Cyclic input terminates: each object is frozen
- * before its children are visited.
+ * The caller freezes once, at the store write, over a value that has to survive
+ * `postMessage` anyway — so the recursion is over small JSON and costs nothing
+ * per read. Cyclic input terminates: each object is frozen before its children
+ * are visited.
  *
  * **Unconditional, deliberately unlike MST's own `deepFreeze`** (whose body this
  * otherwise mirrors), which is gated on `devMode()`. MST gates because it freezes

package/esm/util/getLocationUri.d.ts

@@ -9,7 +9,8 @@ export declare function resolveUri({ uri, baseUri, }: {
     baseUri?: string;
 }): string;
 /**
- * An address with its query string dropped, which is what makes it safe to put
+ * An address with its query string and any username:password dropped, which is
+ * what makes it safe to put
  * on screen. A presigned S3 or GCS link carries its credential in the query — a
  * few hundred characters of `?X-Amz-Signature=…` — and a notice that renders one
  * puts it in front of whoever is looking at the screen and into every screenshot

package/esm/util/getLocationUri.js

@@ -13,7 +13,8 @@ export function resolveUri({ uri, baseUri = '', }) {
     }
 }
 /**
- * An address with its query string dropped, which is what makes it safe to put
+ * An address with its query string and any username:password dropped, which is
+ * what makes it safe to put
  * on screen. A presigned S3 or GCS link carries its credential in the query — a
  * few hundred characters of `?X-Amz-Signature=…` — and a notice that renders one
  * puts it in front of whoever is looking at the screen and into every screenshot
@@ -25,7 +26,12 @@ export function resolveUri({ uri, baseUri = '', }) {
  * than a typed location.
  */
 export function redactSource(source) {
-    return source.includes('://') ? source.split(/[?#]/)[0] : source;
+    if (!source.includes('://')) {
+        return source;
+    }
+    return source
+        .replace(/^([a-z][a-z\d+.-]*:\/\/)[^/?#]*@/i, '$1')
+        .split(/[?#]/)[0];
 }
 /**
  * Where a location's bytes come from, as an address worth showing someone, or