@preventive/triage 1.0.0-alpha.38 → 1.0.0-alpha.39

package/risk/files/script.js

@@ -16,7 +16,8 @@ const MINIFIED_SPACES = .01
 // What a regular expression set aside holds.
 const REGEX = '\uE000'
 const JS = {
-  // A hashbang, the file's first line (`#!/usr/bin/env node`), a comment.
+  // A hashbang, the file's first line (`#!/usr/bin/env node`), a comment,
+  // after a byte order mark too, which node's ES module loader drops first.
   // A string's or template's escape may be a line continuation (`\` before a
   // line break, CRLF's whole).
   // Linear on any text: a regular expression's context looked back on only
@@ -25,7 +26,7 @@ const JS = {
   // regular expression its line's end, a template or a comment the text's,
   // rather than tried again from each later quote or slash.
   // A regular expression first where a value starts (after `=>`, `...`, an operator or a keyword, not a property: `x.default/2`, `this.#in/2`), so a quote in it (`/["']/`) starts no string.
-  stringOrComment: /((?=\/)(?<=(?:^|\.\.\.|[(,=:[!&|?{};>+\-*/%^<~]|(?<![\p{ID_Continue}$.#])(?:await|case|default|delete|do|else|extends|in|instanceof|new|of|return|throw|typeof|void|yield))[ \t]*)\/(?![/*])(?:[^/\\[\n]|\\.|\[(?:[^\]\\\n]|\\.)*(?:\]|(?=\\?$)))+(?:\/[a-z]*|(?=\\?$))|"(?:[^"\\\n]|\\(?:\r\n|[\s\S]))*(?:"|$)|'(?:[^'\\\n]|\\(?:\r\n|[\s\S]))*(?:'|$)|`(?:[^`\\]|\\(?:\r\n|[\s\S]))*(?:`|(?![\s\S])))|(?<![ \t])[ \t]*(?:\/\*[\s\S]*?(?:\*\/|(?![\s\S]))|\/\/.*|(?<![\s\S])#!.*)[ \t]*/gmu,
+  stringOrComment: /((?=\/)(?<=(?:^|\.\.\.|[(,=:[!&|?{};>+\-*/%^<~]|(?<![\p{ID_Continue}$.#])(?:await|case|default|delete|do|else|extends|in|instanceof|new|of|return|throw|typeof|void|yield))[ \t]*)\/(?![/*])(?:[^/\\[\n]|\\.|\[(?:[^\]\\\n]|\\.)*(?:\]|(?=\\?$)))+(?:\/[a-z]*|(?=\\?$))|"(?:[^"\\\n]|\\(?:\r\n|[\s\S]))*(?:"|$)|'(?:[^'\\\n]|\\(?:\r\n|[\s\S]))*(?:'|$)|`(?:[^`\\]|\\(?:\r\n|[\s\S]))*(?:`|(?![\s\S])))|(?<![ \t])[ \t]*(?:\/\*[\s\S]*?(?:\*\/|(?![\s\S]))|\/\/.*|(?<![\s\S])\uFEFF?#!.*)[ \t]*/gmu,
   // Beside punctuation (`a, b`, `x = 1`), not between two words, as
   // JavaScript tells a word's characters (`return a`, `var π`, `var \u03c0`),
   droppable: /(?<![\p{ID_Continue}$\\\u200C\u200D])[ \t]+|[ \t]+(?![\p{ID_Continue}$\\\u200C\u200D])/gu,
@@ -76,9 +77,10 @@ export function minifiedAverage(whole, { stringOrComment, droppable, needed }) {
 
 // JavaScript or TypeScript (a declaration file too, which node runs as any
 // other), or a script run by node by its hashbang (`bin/cli`, with no
-// extension).
+// extension), a byte order mark before it or not, as node runs one after it
+// as an ES module (in a `"type": "module"` package).
 const SCRIPT = /\.[cm]?[jt]sx?$/iu
-const NODE_HASHBANG = /^#!.*\bnode\b/u
+const NODE_HASHBANG = /^\uFEFF?#!.*\bnode\b/u
 // Whether a file (its path and text) is a script, as SCRIPT and NODE_HASHBANG tell.
 export const npmIsScript = (path, text) => typeof text === 'string' && (SCRIPT.test(path) || NODE_HASHBANG.test(text))
 // How many places a file is told doing a thing, the first ones, at most

package/risk/npm/assess.js

@@ -17,7 +17,7 @@ import { npmAddedDependency } from './new-dependency.js'
 // Which reading of a version an assessment kept (`risk/npm/assessments`) is:
 // one more whenever a heuristic changes what it finds, so one kept by an
 // older reading is read anew.
-const RISK_VERSION = 11
+const RISK_VERSION = 12
 
 // How long an assessment kept may be as JSON, and what risk reads of either
 // version's files: a package past it, whose files name thousands of hosts or

package/risk/npm/compare.js

@@ -11,7 +11,7 @@ import { bundleFileSizes, bundleFilesAsMap } from '../../common/bundle-sources.j
 import { npmVersionFileRisk, npmVersionHosts } from './files.js'
 import { npmHostFinding } from './held.js'
 import { HOST_TAGS, npmHostSeverity, npmHostsTagged } from '../files/hosts.js'
-import { npmBecameUnreadable, npmLargeCode, npmUnreadable } from '../files/readability.js'
+import { npmBecameUnreadable, npmBinaryCode, npmLargeCode, npmUnreadable } from '../files/readability.js'
 import { SEVERITIES } from '../files/stamps.js'
 import { npmFoundAdded, npmRunsCodeFlags, npmRunsCodeWithout } from '../files/runs-code.js'
 import { npmDependencySpecs } from './dependencies.js'
@@ -27,9 +27,11 @@ import { npmInstallScriptsChange, npmProvenanceLost, npmPublisherChange } from '
 // (npmHostSeverity: `exfiltration` and `remote` red, `ip-lookup` orange); a
 // code file of 256 KiB or more it adds (npmLargeCode, `large-code`); a file
 // it changes that had no line over 200 characters and now has one over 2,000
-// (npmBecameUnreadable, `now-unreadable`); and a file it adds or changes with
+// (npmBecameUnreadable, `now-unreadable`); a file it adds or changes with
 // an obfuscator's fingerprint where the one compared with had none
-// (`obfuscated`). Then in orange what any of its files runs beyond itself that
+// (`obfuscated`); and a code file it adds or changes that isn't text, where
+// the one compared with's was text, or no code, or none (npmBinaryCode,
+// `binary-code`). Then in orange what any of its files runs beyond itself that
 // `runs-code` doesn't name, kept from the version compared with
 // (`kept-runs-code`). A renamed file by its old path; one renamed alone,
 // unchanged, holds what it held. A file become unreadable calls for less
@@ -61,6 +63,8 @@ function npmFileFindings(base, other, files, major) {
         ...rebuiltWithMap(base, other, row.path, row.renamedFrom ?? row.path) ? { rebuilt: true } : {} }))) },
     { id: 'obfuscated', severity: 'critical', files: touched.filter(row => after(row).readability.obfuscation && !before(row)?.readability.obfuscation)
       .map(row => ({ path: row.path, obfuscation: after(row).readability.obfuscation })) },
+    { id: 'binary-code', severity: 'critical', files: touched.filter(row => npmBinaryCode(row.path, after(row).readability) && !npmBinaryCode(row.renamedFrom ?? row.path, before(row)?.readability))
+      .map(row => ({ path: row.path, bytes: sizes.get(row.path) })) },
     { id: 'kept-runs-code', severity: 'high', files: kept },
   ].filter(finding => finding.files.length > 0)
 }
@@ -159,7 +163,8 @@ function npmNewHosts(base, other, files) {
 // files hold that the one compared with's didn't, so where none of them runs
 // code beyond itself, names a service under one of the hosts' tags or a host
 // past ALLOWED_HOSTS, bears an obfuscator's fingerprint, has a line no one
-// writes (npmUnreadable) or is large code, nothing is found of them whatever
+// writes (npmUnreadable), is large code or is code that isn't text
+// (npmBinaryCode), nothing is found of them whatever
 // the one compared with holds. Nor do the one compared with's install scripts
 // differ by a binding.gyp among its files, but where its manifest names
 // neither `preinstall` nor `install`, and the open version has some.
@@ -170,6 +175,7 @@ export function npmBaseFilesTell(other, manifest) {
   return [...bundleFilesAsMap(other).keys()].some(path => {
     const { runsCode, exfiltration, readability, hosts } = npmVersionFileRisk(other, path)
     return Boolean(runsCode || exfiltration || readability.obfuscation) || npmUnreadable(path, readability) || npmLargeCode(path, sizes.get(path))
+      || npmBinaryCode(path, readability)
       || [...hosts?.keys() ?? []].some(host => !ALLOWED_HOSTS.has(host))
   })
 }

package/risk/npm/install-scripts.js

@@ -23,11 +23,12 @@ export function npmInstallScripts(manifest, paths = []) {
   return installScripts(manifest?.installScripts, Boolean(paths && (paths instanceof Set ? paths.has('binding.gyp') : paths.includes('binding.gyp'))))
 }
 
-// A package.json's install scripts, from its text; none where it isn't one,
+// A package.json's install scripts, from its text, a byte order mark it
+// starts with dropped, as npm drops one reading it; none where it isn't one,
 // or names none.
 export function packageJsonInstallScripts(text, bindingGyp = false) {
   let json = null
-  try { json = typeof text === 'string' ? JSON.parse(text) : null } catch {}
+  try { json = typeof text === 'string' ? JSON.parse(text.replace(/^\uFEFF/u, '')) : null } catch {}
   const scripts = json && typeof json === 'object' && json.scripts && typeof json.scripts === 'object' ? json.scripts : {}
   return installScripts(scripts, bindingGyp)
 }

package/server-managed/bundle-advisories.ts

@@ -107,7 +107,12 @@ export async function fetchBundleAdvisories(packages: Package[], signal: AbortSi
     const result = await Promise.race([Promise.all(asked.map(({ part, osv }) => part.length === 0 ? Promise.resolve([]) : advisories(part, { ...options, osv }))), deadline])
     return { status: 200, body: result.flat().toSorted((a, b) => order(a.ecosystem, b.ecosystem) || order(a.name, b.name)) }
   } catch (error) {
-    if (debug) console.warn('managed: advisories failed:', error)
+    // Answered as upstream's failure alone: logged, its message, or with
+    // `debug` the whole error, but for a request its client gave up on. One
+    // past its deadline (aborted with a TimeoutError, as AbortSignal.timeout
+    // and the bundle route's timer abort) is the server giving up: logged.
+    const cancelled = signal.aborted && (signal.reason as { name?: unknown } | undefined)?.name !== 'TimeoutError'
+    if (!cancelled) console.warn('managed: advisories failed:', debug || !(error instanceof Error) ? error : error.message)
     return { status: 502, body: { error: 'upstream-unavailable' } }
   } finally {
     if (onAbort) signal.removeEventListener('abort', onAbort)

package/server-managed/github-app.ts

@@ -6,7 +6,7 @@ import { Buffer } from 'node:buffer'
 import { createHash, createSign } from 'node:crypto'
 import { createClient } from '@preventive/upstream/github.js'
 import type { ManagedConfig } from './config.ts'
-import { GithubApiError, throwGithubResponseError, upstreamGithub } from './github-errors.ts'
+import { GithubApiError, githubUnreachable, throwGithubResponseError, upstreamGithub } from './github-errors.ts'
 
 export { GithubApiError } from './github-errors.ts'
 
@@ -71,6 +71,7 @@ export function mergeRepos(...lists: ConnectedRepo[][]): ConnectedRepo[] {
 // fold into a GithubApiError (401 passes through for the caller to handle).
 export async function githubJson(url: string, token: string | null, fetchImpl: typeof fetch, method: 'GET' | 'POST' = 'GET'): Promise<unknown> {
   let res: Response
+  const started = Date.now()
   try {
     res = await fetchImpl(url, {
       method,
@@ -81,10 +82,15 @@ export async function githubJson(url: string, token: string | null, fetchImpl: t
         'user-agent': USER_AGENT, 'x-github-api-version': API_VERSION,
       },
     })
-  } catch { throw new GithubApiError(502, 'github-unreachable') }
+  } catch (error) { throw githubUnreachable(error, started) }
   if (res.status === 401) discardInstallationToken(token, fetchImpl)
   if (!res.ok) await throwGithubResponseError(res)
-  try { return await res.json() } catch { throw new GithubApiError(502, 'github-malformed') }
+  // The answer's body is read within the same timeout: one not read whole is
+  // GitHub not reached, as one not answered is; only one that isn't JSON is
+  // malformed.
+  try { return await res.json() } catch (error) {
+    throw error instanceof SyntaxError ? new GithubApiError(502, 'github-malformed') : githubUnreachable(error, started)
+  }
 }
 
 // Validate one repo object into a ConnectedRepo (or null to skip), tagging it

package/server-managed/github-errors.ts

@@ -5,14 +5,32 @@ import { HttpError } from '@preventive/upstream/github.js'
 export class GithubApiError extends Error {
   status: number
   retryAfter: number | null
-  constructor(status: number, message: string, retryAfter: number | null = null) {
+  // What failed, where GitHub wasn't reached (githubUnreachable).
+  detail: string | null
+  constructor(status: number, message: string, retryAfter: number | null = null, detail: string | null = null) {
     super(message)
     this.name = 'GithubApiError'
     this.status = status
     this.retryAfter = retryAfter
+    this.detail = detail
   }
 }
 
+// GitHub not reached, or its answer not read whole, `started` ms since the
+// epoch: as `github-unreachable`, with what failed as the error and its causes
+// tell it (a timeout, a connection closed, an answer too large) and after how
+// long, for an admin's page to show (repository-risk.ts). Only the errors'
+// names, codes and messages, never GitHub's text nor a request's headers.
+export function githubUnreachable(error: unknown, started: number): GithubApiError {
+  const told: string[] = []
+  for (let at = error, depth = 0; at instanceof Error && depth < 4; at = at.cause, depth++) {
+    const code = 'code' in at && typeof at.code === 'string' && at.code !== at.name ? ` ${at.code}` : ''
+    told.push(`${at.name}${code}${at.message ? `: ${at.message.slice(0, 200)}` : ''}`)
+  }
+  const failed = told.length > 0 ? told.join('; ') : String(error).slice(0, 200)
+  return new GithubApiError(502, 'github-unreachable', null, `${failed}, after ${((Date.now() - started) / 1000).toFixed(1)}s`)
+}
+
 export async function throwGithubResponseError(res: Response): Promise<never> {
   if (res.status === 403 || res.status === 429) {
     const body = await res.json().catch(() => null) as { message?: unknown } | null
@@ -30,6 +48,7 @@ export async function throwGithubResponseError(res: Response): Promise<never> {
 }
 
 export async function upstreamGithub<T>(request: () => Promise<T>): Promise<T> {
+  const started = Date.now()
   try { return await request() } catch (error) {
     if (error instanceof HttpError) {
       // The upstream error includes GitHub's response text. Retain managed
@@ -44,6 +63,6 @@ export async function upstreamGithub<T>(request: () => Promise<T>): Promise<T> {
     if (error instanceof Error && (error.name === 'AssertionError' || error.cause instanceof SyntaxError)) {
       throw new GithubApiError(502, 'github-malformed')
     }
-    throw new GithubApiError(502, 'github-unreachable')
+    throw githubUnreachable(error, started)
   }
 }

package/server-managed/http.ts

@@ -221,6 +221,13 @@ const NPM_RISK_PATH = '/api/npm/risk'
 // having no such package or version, or a tarball unpacking past risk's
 // bounds; npm failing otherwise a 502.
 const NPM_RISK_STATUS: Partial<Record<string, number>> = { 'package-not-found': 404, 'version-not-found': 404, 'package-too-large': 413 }
+// A risk failure answered with its code alone, as risk's status for it (NPM_RISK_STATUS, else 502), its cause
+// logged where it is the server's or npm's, not the reader's (a 5xx), for the logs to say why.
+function sendRiskError(res: ServerResponse, err: NpmRiskError) {
+  const status = NPM_RISK_STATUS[err.code] ?? 502
+  if (status >= 500) console.error(`managed: npm risk failed (${err.code}):`, err.message)
+  sendJson(res, status, { error: err.code })
+}
 const NPM_PATHS = new Set([NPM_PACKAGE_PATH, NPM_VERSIONS_PATH, NPM_DOWNLOAD_PATH, NPM_STATS_PATH, NPM_ADVISORIES_PATH, NPM_TAGS_PATH, NPM_SOCKET_PATH, NPM_PROVENANCE_PATH, NPM_PRETTY_PATH,
   NPM_RENAME_DIFF_PATH, NPM_TYPE_ONLY_PATH, NPM_RISK_PATH])
 // How long an npm response may go unread before its connection is dropped.
@@ -1548,7 +1555,8 @@ async function handleBundleAdvisories(res: ServerResponse, deps: ManagedHttpDeps
   const controller = new AbortController()
   const onClose = () => { if (!res.writableEnded) controller.abort() }
   res.on('close', onClose)
-  const timer = setTimeout(() => controller.abort(), ADVISORIES_TIMEOUT_MS)
+  // Its deadline aborts as AbortSignal.timeout does, for a failure it leaves to be told from the reader's leaving.
+  const timer = setTimeout(() => controller.abort(new DOMException('advisories took too long', 'TimeoutError')), ADVISORIES_TIMEOUT_MS)
   try {
     if (res.destroyed) return
     const needsGithub = inventory.packages.some(pkg => repoAdvisories || pkg.ecosystem === 'github' || pkg.ecosystem === 'soldeer')
@@ -2804,7 +2812,7 @@ async function handleNpmReviews(req: IncomingMessage, res: ServerResponse, deps:
   } catch (err) {
     if (controller.signal.aborted) return
     if (err instanceof NpmPackageError) { sendJson(res, err.status, { error: err.message }); return }
-    if (err instanceof NpmRiskError) { sendJson(res, NPM_RISK_STATUS[err.code] ?? 502, { error: err.code }); return }
+    if (err instanceof NpmRiskError) { sendRiskError(res, err); return }
     throw err
   } finally { res.off('close', onClose) }
 }
@@ -3010,7 +3018,7 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
     writeResponse(res, Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength))
   } catch (err) {
     if (err instanceof NpmPackageError || err instanceof PrettyError) { if (!res.headersSent && !res.destroyed) sendJson(res, err.status, { error: err.message }); return }
-    if (err instanceof NpmRiskError) { if (!res.headersSent && !res.destroyed) sendJson(res, NPM_RISK_STATUS[err.code] ?? 502, { error: err.code }); return }
+    if (err instanceof NpmRiskError) { if (!res.headersSent && !res.destroyed) sendRiskError(res, err); return }
     if (controller.signal.aborted) return
     throw err
   } finally {

package/server-managed/repository-risk.ts

@@ -111,8 +111,11 @@ export type RepositoryRiskLine =
   | { type: 'done' }
 
 // What an error is known by: a GitHub or npm failure's code, or `failed`;
-// risk's with what it asked of npm and how that failed, where it says.
-function failureOf(error: unknown): RiskFailure {
+// GitHub not reached with what failed (githubUnreachable), while `doing` what
+// of a repository, and risk's with what it asked of npm and how that failed,
+// where they say.
+function failureOf(error: unknown, doing?: string): RiskFailure {
+  if (error instanceof GithubApiError && error.detail) return { error: error.message, detail: doing ? `${doing}: ${error.detail}` : error.detail }
   if (error instanceof GithubApiError || error instanceof NpmPackageError) return { error: error.message }
   if (!(error instanceof NpmRiskError)) return { error: 'failed' }
   return error.message === error.code ? { error: error.code } : { error: error.code, detail: error.message }
@@ -299,16 +302,18 @@ function assessLater(scan: Scan, packages: LockedPackage[]) {
 // for its commit or else from GitHub, those of its `paths` alone; null, with
 // its line telling why, where either failed, or where the scan stopped.
 async function listLockfiles(scan: Scan, repo: RepositoryRiskRepo) {
+  let doing = 'opening it'
   try {
     const opened = await scan.source.open(repo)
     if (scan.signal.aborted) return null
     const key = `${repo.repoId}@${opened.commit}`
     let listed = scan.caches.listings.get(key)
+    doing = 'listing its lockfiles'
     if (!listed) scan.caches.listings.set(key, listed = await opened.lockfiles())
     const lockfiles = listed.filter(({ path, format }) => NPM_LOCKFILE_FORMATS.has(format) && lockfileOf(path, repo.paths))
     return { opened, lockfiles }
   } catch (error) {
-    if (!scan.signal.aborted) scan.lines.add({ type: 'repo', id: repo.repoId, ...failureOf(error) })
+    if (!scan.signal.aborted) scan.lines.add({ type: 'repo', id: repo.repoId, ...failureOf(error, doing) })
     return null
   }
 }
@@ -353,7 +358,7 @@ async function readRepository(scan: Scan, repo: RepositoryRiskRepo) {
     lockfiles.push(await readLockfile(scan, repo.repoId, listed.opened, lockfile))
   }
   try { await listed.opened.recheck() } catch (error) {
-    if (!scan.signal.aborted) scan.lines.add({ type: 'repo', id: repo.repoId, ...failureOf(error) })
+    if (!scan.signal.aborted) scan.lines.add({ type: 'repo', id: repo.repoId, ...failureOf(error, 'checking access to it again') })
     return
   }
   if (scan.signal.aborted) return

package/out/chunk-BYUEDJOM.js

@@ -1,7 +0,0 @@
-import{a}from"./chunk-TUII34K2.js";var v="deepview-objstore.v1.put",y="deepview-objstore.v1.delete",h="deepview-objstore.v1.fetch",I="deepview-objstore.v1.fetch-rest",w="deepview-objstore.v1.put-rest",j="deepview-objstore.v1.delete-rest";function l(e){return e==null?"":String(e)}function p(e){return e??""}function x(e,n){return a([v,e.workspaceTag,e.resourceTag,l(e.prevVersion),p(e.prevIncarnation),e.contentHash,String(e.expectedLength),n].join(`
-`))}function O(e,n){return a([y,e.workspaceTag,e.resourceTag,l(e.prevVersion),p(e.prevIncarnation),n].join(`
-`))}function P(e,n,r){return a([h,e,n,r].join(`
-`))}async function i(e,n){return new Uint8Array(await crypto.subtle.sign({name:"Ed25519"},e,n)).toBase64({alphabet:"base64url",omitPadding:!0})}function B(e,n,r){return i(e,x(n,r))}function D(e,n,r){return i(e,O(n,r))}function R(e,n,r,o){return i(e,P(n,r,o))}function A(e,n,r){return a([I,e,n,String(r)].join(`
-`))}function _(e,n,r,o){return i(e,A(n,r,o))}function N(e,n){return a([w,e.workspaceTag,e.resourceTag,l(e.prevVersion),p(e.prevIncarnation),e.contentHash,String(e.expectedLength),String(n)].join(`
-`))}function U(e,n,r){return i(e,N(n,r))}function T(e,n){return a([j,e.workspaceTag,e.resourceTag,l(e.prevVersion),p(e.prevIncarnation),String(n)].join(`
-`))}function L(e,n,r){return i(e,T(n,r))}async function H(e){let n=await crypto.subtle.digest("SHA-256",e);return new Uint8Array(n).toBase64({alphabet:"base64url",omitPadding:!0})}var d="/api/config";var J="http://127.0.0.1:3123/";function m(e){if(typeof e!="string"||!e.trim())return null;try{let n=new URL(e);return!["http:","https:"].includes(n.protocol)||n.username||n.password||n.search||n.hash?null:(n.pathname=n.pathname.replace(/\/+$/u,"")+"/",n.href)}catch{return null}}var b="deepview.sync.serverInfo",g="deepview.sync.standaloneProbe";function $(){try{return localStorage.getItem(g)==="1"}catch{return!1}}function X(){try{localStorage.setItem(g,"1")}catch{}}function f(e){return e==="managed+e2e"||e==="e2e+managed"}function q(e,n){return(e==="managed"||f(e))&&/^\/(?:team|manage)(?:\/|$)/u.test(n)}function Q(e,n=null){return n&&(f(e)||e===n)?n:e==="managed"||e==="managed+e2e"?"managed":"e2e"}function W(e,n){return e&&f(e.mode)&&n.mode==="e2e"?{...e,githubNewIssueLabels:n.githubNewIssueLabels??"",...n.deepviewScanServer?{deepviewScanServer:n.deepviewScanServer}:{}}:n}function S(e){if(e==null||typeof e!="object")return null;let n=e.mode;if(n!=="e2e"&&n!=="managed"&&n!=="managed+e2e"&&n!=="e2e+managed")return null;let r=null,o=e.managed;if(o!=null&&typeof o=="object"){let u=o.loginPath,c=o.cookieName;typeof u=="string"&&typeof c=="string"&&(r={loginPath:u,cookieName:c},o.allowShare===!0&&(r.allowShare=!0))}let t=n==="managed"?null:m(e.deepviewScanServer),s=e.githubNewIssueLabels;return{mode:n,managed:r,...t?{deepviewScanServer:t}:{},...typeof s=="string"&&s.length<=4096?{githubNewIssueLabels:s}:{}}}async function Z(){try{let e=await fetch(d,{credentials:"same-origin",cache:"no-store",headers:{accept:"application/json"}});return e.status===404?"standalone":e.ok?S(await e.json()):null}catch{return null}}async function ee(e,n=3e3){let r;try{return await Promise.race([e,new Promise(o=>{r=setTimeout(()=>o(null),n)})])}catch{return null}finally{clearTimeout(r)}}function ne(){try{let e=localStorage.getItem(b);if(e==null)return null;let n=S(JSON.parse(e));return n?{mode:n.mode,managed:n.managed}:null}catch{return null}}function re(e){try{localStorage.setItem(b,JSON.stringify({mode:e.mode,managed:e.managed})),localStorage.removeItem(g)}catch{}}var E="deepview.objstore-presence.";function M(e){return E+e}function C(e){try{let n=localStorage.getItem(M(e));if(!n)return null;let r=JSON.parse(n);return!r||typeof r!="object"?null:{names:r.names&&typeof r.names=="object"?r.names:{},bundles:r.bundles&&typeof r.bundles=="object"?r.bundles:{},bundleNames:r.bundleNames&&typeof r.bundleNames=="object"?r.bundleNames:{},baselines:k(r.baselines,r.localVersions)}}catch{return null}}function k(e,n){let r={};if(n&&typeof n=="object")for(let[o,t]of Object.entries(n))Number.isSafeInteger(t)&&t>=0&&(r[o]={version:t,incarnation:null,synced:!0,hash:null});if(e&&typeof e=="object")for(let[o,t]of Object.entries(e))!t||typeof t!="object"||!Number.isSafeInteger(t.version)||t.version<0||t.incarnation!=null&&typeof t.incarnation!="string"||(r[o]={version:t.version,incarnation:t.incarnation??null,synced:t.synced===!0,hash:typeof t.hash=="string"?t.hash:null});return r}function oe(e,n,r,o){let t=C(e),s=Object.entries((n==="bundle"?t?.bundles:t?.names)??{}).find(([,c])=>c===r)?.[0],u=t?.baselines?.[s];return{synced:s!==void 0&&(n==="bundle"||u?.synced===!0&&u.hash===o),cached:!0}}export{B as a,D as b,R as c,_ as d,U as e,L as f,H as g,J as h,m as i,$ as j,X as k,f as l,q as m,Q as n,W as o,S as p,Z as q,ee as r,ne as s,re as t,M as u,C as v,oe as w};