@preventive/triage 1.0.0-alpha.4 → 1.0.0-alpha.41

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.4",
+  "version": "1.0.0-alpha.41",
   "description": "Client & relay server for triaging of automated reports",
-  "license": "MIT",
+  "license": "MIT OR Apache-2.0",
   "author": {
     "name": "Nikita Skovoroda",
     "email": "chalkerx@gmail.com",
@@ -29,63 +29,281 @@
     "#client/sync-host.js": "./client/sync-host.js"
   },
   "exports": {
-    "./server": "./server/index.ts",
+    "./reap": "./api/reap.ts",
+    "./server": "./server.ts",
+    "./server-e2e": "./server-e2e/index.ts",
+    "./bundle-build-worker": "./server-managed/bundle-build-worker.js",
     "./strip-types-loader": "./strip-types-loader.js",
     "./package.json": "./package.json"
   },
   "bin": {
-    "triage-server": "server/cli.js"
+    "triage-server": "cli.js",
+    "triage-e2e-server": "server-e2e/cli.js",
+    "triage-managed-server": "server-managed/cli.js"
   },
   "files": [
-    "server/auth.ts",
-    "server/bus-receiver.ts",
-    "server/cli.js",
-    "server/config.ts",
-    "server/db-neon.ts",
-    "server/db-revision-sql.ts",
-    "server/db-stmt.ts",
-    "server/db.ts",
-    "server/http.ts",
-    "server/hub.ts",
-    "server/index.ts",
-    "server/lifecycle.ts",
-    "server/neon-driver.ts",
-    "server/npm-proxy.ts",
-    "server/objstore/blob-fs.ts",
-    "server/objstore/blob-vercel.ts",
-    "server/objstore/blob.ts",
-    "server/objstore/fs.ts",
-    "server/objstore/handlers.ts",
-    "server/objstore/init.ts",
-    "server/objstore/reaper.ts",
-    "server/objstore/rest.ts",
-    "server/objstore/sign.ts",
-    "server/objstore/store-neon.ts",
-    "server/objstore/store.ts",
-    "server/objstore/tokens.ts",
-    "server/origin.ts",
-    "server/peer.ts",
-    "server/pubsub.ts",
-    "server/sign.ts",
-    "server/sse-server.ts",
-    "server/sse-session.ts",
-    "server/static.ts",
-    "server/sync-handlers.ts",
-    "server/util.ts",
-    "server/validation.ts",
-    "server/ws-server.ts",
-    "server/config.example.json",
+    "LICENSE-APACHE",
+    "LICENSE-MIT",
+    "api/reap.ts",
+    "cli.js",
+    "server.ts",
+    "server-e2e/app.ts",
+    "server-e2e/auth.ts",
+    "server-e2e/bus-receiver.ts",
+    "server-e2e/cli.js",
+    "server-e2e/config.ts",
+    "server-e2e/db-neon.ts",
+    "server-e2e/db-revision-sql.ts",
+    "server-e2e/db-stmt.ts",
+    "server-e2e/db.ts",
+    "server-e2e/http.ts",
+    "server-e2e/hub.ts",
+    "server-e2e/index.ts",
+    "server-e2e/lifecycle.ts",
+    "server-e2e/neon-driver.ts",
+    "server-e2e/npm-proxy.ts",
+    "server-e2e/objstore/blob-fs.ts",
+    "server-e2e/objstore/blob-vercel.ts",
+    "server-e2e/objstore/blob.ts",
+    "server-e2e/objstore/fetch-mint-guard.ts",
+    "server-e2e/objstore/fs.ts",
+    "server-e2e/objstore/handlers.ts",
+    "server-e2e/objstore/init.ts",
+    "server-e2e/objstore/reaper.ts",
+    "server-e2e/objstore/rest-deny.ts",
+    "server-e2e/objstore/rest-mint.ts",
+    "server-e2e/objstore/rest.ts",
+    "server-e2e/objstore/sign.ts",
+    "server-e2e/objstore/store-neon.ts",
+    "server-e2e/objstore/store.ts",
+    "server-e2e/objstore/tokens.ts",
+    "server-e2e/peer.ts",
+    "server-e2e/pubsub.ts",
+    "server-e2e/sign.ts",
+    "server-e2e/sse-server.ts",
+    "server-e2e/sse-session.ts",
+    "server-e2e/static.ts",
+    "server-e2e/sync-handlers.ts",
+    "server-e2e/util.ts",
+    "server-e2e/validation.ts",
+    "server-e2e/ws-server.ts",
+    "server-e2e/config.example.json",
+    "server-managed/activity.ts",
+    "server-managed/avatar-store.ts",
+    "server-managed/blob-store.ts",
+    "server-managed/brotli.ts",
+    "server-managed/bundle-advisories.ts",
+    "server-managed/bundle-advisory-inventory.ts",
+    "server-managed/bundle-cache.ts",
+    "server-managed/bundle-build.ts",
+    "server-managed/bundle-build-leases.ts",
+    "server-managed/bundle-build-worker.js",
+    "server-managed/bundle-build-diagnostics.js",
+    "server-managed/bundle-build-diagnostics.d.ts",
+    "server-managed/bundle-catalog.ts",
+    "server-managed/bundle-commits.ts",
+    "server-managed/bundle-store.ts",
+    "server-managed/bundle-summary-cache.ts",
+    "server-managed/bundle.ts",
+    "server-managed/cache-storage.ts",
+    "server-managed/cli.js",
+    "server-managed/combined.ts",
+    "server-managed/comments.ts",
+    "server-managed/config.ts",
+    "server-managed/content-access.ts",
+    "server-managed/crypto.ts",
+    "server-managed/db-methods.ts",
+    "server-managed/db-neon.ts",
+    "server-managed/db-schema.ts",
+    "server-managed/db-table-names.ts",
+    "server-managed/db.ts",
+    "server-managed/dependency-reviews.ts",
+    "server-managed/github-app.ts",
+    "server-managed/github-errors.ts",
+    "server-managed/github-metadata.ts",
+    "server-managed/github-issue-oauth.ts",
+    "server-managed/github-issues.ts",
+    "server-managed/github-issue-links.ts",
+    "server-managed/github-oauth.ts",
+    "server-managed/github-pulls.ts",
+    "server-managed/http-response.ts",
+    "server-managed/http.ts",
+    "server-managed/link-reports.ts",
+    "server-managed/locked-packages.ts",
+    "server-managed/lru.ts",
+    "server-managed/import-triage.ts",
+    "server-managed/managed-issues.ts",
+    "server-managed/management.ts",
+    "server-managed/management-catalog.ts",
+    "server-managed/object-storage.ts",
+    "server-managed/object-storage-disk.ts",
+    "server-managed/object-storage-vercel.ts",
+    "server-managed/index.ts",
+    "server-managed/npm-insights.ts",
+    "server-managed/npm-risk.ts",
+    "server-managed/npm-provenance.ts",
+    "server-managed/kept.ts",
+    "server-managed/npm-kept.ts",
+    "server-managed/npm-loads.ts",
+    "server-managed/npm-manifest.ts",
+    "server-managed/npm-packages.ts",
+    "server-managed/package-entry-points.ts",
+    "server-managed/pretty-print.ts",
+    "server-managed/rename-diff.ts",
+    "server-managed/rename-diff-worker.js",
+    "server-managed/public-workspace.ts",
+    "server-managed/repo-path.ts",
+    "server-managed/report-migration.ts",
+    "server-managed/report-query.ts",
+    "server-managed/report-response.ts",
+    "server-managed/report-store.ts",
+    "server-managed/report-sources.ts",
+    "server-managed/revisions.ts",
+    "server-managed/repository-browser.ts",
+    "server-managed/repository-aliases.ts",
+    "server-managed/repository-discovery.ts",
+    "server-managed/repository-policy.ts",
+    "server-managed/repository-risk.ts",
+    "server-managed/session.ts",
+    "server-managed/slugs.ts",
+    "server-managed/solidity-entry-points.ts",
+    "server-managed/sql-postgres.ts",
+    "server-managed/sql.ts",
+    "server-managed/static.ts",
+    "server-managed/storage.ts",
+    "server-managed/storage-command.ts",
+    "server-managed/storage-db.ts",
+    "server-managed/storage-encryption.ts",
+    "server-managed/storage-maintenance.ts",
+    "server-managed/storage-payload.ts",
+    "server-managed/storage-stores.ts",
+    "server-managed/team-catalog.ts",
+    "server-managed/team-feed.ts",
+    "server-managed/team-npm-scopes.ts",
+    "server-managed/team-app.ts",
+    "server-managed/team-reports.ts",
+    "server-managed/triage-response.ts",
+    "server-managed/type-only.ts",
+    "server-managed/type-only-worker.js",
+    "server-managed/uploads.ts",
+    "server-managed/view-as.ts",
+    "server-managed/upstream-cache.ts",
+    "server-managed/workspace-shares.ts",
+    "server-common/database-config.ts",
+    "server-common/initialize.ts",
+    "server-common/reap.ts",
+    "server-common/npm-advisories.ts",
+    "server-common/origin.ts",
+    "server-common/standalone.ts",
+    "server-common/storage-log.ts",
+    "server-common/storage-crypto.ts",
+    "server-common/vercel-blob.ts",
+    "server-common/scan-config.ts",
+    "common/bundle-commit.d.ts",
+    "common/bundle-commit.js",
+    "common/bundle-compare-diff.js",
+    "common/bundle-compare-diff.d.ts",
+    "common/bundle-compare-inputs.d.ts",
+    "common/bundle-compare-inputs.js",
+    "common/bundle-metadata.d.ts",
+    "common/bundle-pkg-of.d.ts",
+    "common/bundle-pkg-of.js",
+    "common/bundle-metadata.js",
+    "common/bundle-reasons.d.ts",
+    "common/bundle-reasons.js",
+    "common/bundle-sources.d.ts",
+    "common/bundle-sources.js",
+    "common/bundle-source-links.d.ts",
+    "common/bundle-source-links.js",
+    "common/bundle-sourcemap.d.ts",
+    "common/bundle-sourcemap.js",
+    "common/bundle-stats.js",
+    "common/bundle-tabs.js",
+    "common/code-language.js",
+    "common/default-scan-models.ts",
+    "common/dependency-reviews.js",
+    "common/dependency-reviews.d.ts",
+    "common/finding-id.js",
+    "common/finding-duplicates.js",
+    "common/finding-filters.js",
+    "common/github-pr.ts",
+    "common/github-issue-labels.js",
+    "common/github-issue-labels.d.ts",
+    "common/gzip.js",
+    "common/pretty-print.d.ts",
+    "common/pretty-print.js",
+    "common/line-diff.d.ts",
+    "common/line-diff.js",
+    "common/linked-workspace-groups.js",
+    "common/managed/comments.ts",
+    "common/managed/npm-packages.d.ts",
+    "common/managed/npm-packages.js",
+    "common/managed/permissions.ts",
+    "common/managed/report-content.ts",
+    "common/managed/repository-alias.ts",
+    "common/managed/report-filter.ts",
+    "common/managed/roles.ts",
+    "common/managed/routes.d.ts",
+    "common/managed/routes.js",
+    "common/managed/scan-models.ts",
+    "common/managed/team-app.js",
+    "common/managed/team-app.d.ts",
+    "common/managed/triage.ts",
+    "common/managed/upload-seal.ts",
     "common/save-error-reason.ts",
+    "common/revalidation-conflicts.js",
+    "common/revalidation-input-groups.js",
+    "common/server-info.ts",
+    "common/scan-server.ts",
     "common/utf8.d.ts",
     "common/utf8.js",
+    "common/workspace-app.js",
+    "common/workspace-groups.js",
+    "risk/index.js",
+    "risk/index.d.ts",
+    "risk/files/characters.js",
+    "risk/files/hosts.js",
+    "risk/files/readability.js",
+    "risk/files/runs-code.js",
+    "risk/files/script.js",
+    "risk/files/stamps.js",
+    "risk/npm/assess.js",
+    "risk/npm/combined.js",
+    "risk/npm/compare.js",
+    "risk/npm/dependencies.js",
+    "risk/npm/diff.js",
+    "risk/npm/held.js",
+    "risk/npm/files.js",
+    "risk/npm/downloads.js",
+    "risk/npm/install-scripts.js",
+    "risk/npm/malware.js",
+    "risk/npm/manifest.js",
+    "risk/npm/new-dependency.js",
+    "risk/npm/old-version.js",
+    "risk/npm/registry.js",
+    "risk/npm/release.js",
+    "risk/npm/score.js",
+    "risk/npm/specs.js",
+    "risk/npm/tarball.js",
+    "client/dependency-paths.d.ts",
+    "client/dependency-paths.js",
+    "client/finding-link.js",
+    "client/linked-findings.d.ts",
+    "client/linked-findings.js",
     "out/brotli-fallback.js",
+    "out/chunk-*.js",
+    "out/client-managed.js",
+    "out/client-managed-import.js",
     "out/client-sync.js",
     "out/graph.js",
+    "out/github-issue-authorized.html",
+    "out/github-issue-authorized.js",
     "out/icon-maskable.svg",
     "out/icon.svg",
     "out/index.html",
     "out/manifest.webmanifest",
     "out/prism.js",
+    "out/stasis.svg",
     "out/terminal.js",
     "out/view.css",
     "out/view.html",
@@ -94,40 +312,58 @@
   ],
   "scripts": {
     "lint": "node --run lint:js && node --run lint:css && node --run lint:ts",
-    "lint:js": "oxlint -c .oxlintrc.json --ignore-pattern=ui/logs.js ./tests/ ./common/ ./server/ ./client/ ./ui/",
+    "lint:js": "oxlint -c .oxlintrc.json --ignore-pattern=ui/logs.js ./cli.js ./server.ts ./tests/ ./common/ ./server-common/ ./server-e2e/ ./server-managed/ ./client/ ./ui/ ./risk/ ./api/",
     "lint:css": "stylelint 'ui/**/*.css'",
     "lint:ts": "tsc --noEmit",
     "prepack": "node --run build",
     "build": "node build.js build",
     "serve": "node build.js serve",
-    "server": "node server/index.ts",
-    "test": "node --js-base-64 --experimental-test-module-mocks --test ./tests/*.test.js"
+    "server": "node --run server-e2e --",
+    "server-e2e": "node server-e2e/index.ts",
+    "server-managed": "node server-managed/index.ts",
+    "server-managed-test": "node server-managed/test-server.ts",
+    "test": "node --js-base-64 --require=./tests/_resource-loader.js --experimental-test-module-mocks --test-timeout=120000 --test-concurrency=$(node -p 'Math.ceil(os.availableParallelism() * 1.5)') --test ./tests/*.test.js"
   },
   "devDependencies": {
-    "@electric-sql/pglite": "^0.4.5",
-    "@exodus/stasis": "^1.0.0-alpha.1",
-    "@noble/ciphers": "^2.2.0",
-    "@preventive/terminal": "^1.3.0",
+    "@electric-sql/pglite": "^0.5.8",
+    "@noble/ciphers": "^2.4.0",
+    "@preventive/terminal": "2.0.0-beta.3",
     "@rray/frontend": "^1.0.0",
-    "@stylistic/stylelint-plugin": "^5.1.0",
-    "@types/node": "^25.6.2",
-    "@types/ws": "^8.18.1",
+    "@stylistic/stylelint-plugin": "^5.3.1",
+    "@types/node": "^26.6.4",
+    "@types/ws": "^8.18.2",
+    "@vercel/functions": "^3.9.11",
     "brotli": "^1.3.3",
-    "esbuild": "^0.27.4",
-    "lit": "^3.3.2",
+    "esbuild": "^0.28.2",
+    "lit": "^3.3.3",
     "minify-html-literals": "^1.3.5",
-    "oxlint": "^1.63.0",
+    "oxlint": "^1.87.0",
     "prismjs": "^1.30.0",
-    "stylelint": "^17.11.0",
+    "stylelint": "^17.16.0",
     "stylelint-config-recommended": "^18.0.0",
-    "typescript": "^6.0.3"
+    "typescript": "^7.0.2"
   },
   "dependencies": {
-    "ws": "^8.20.1"
+    "@exodus/stasis": "1.0.0-beta.9",
+    "@exodus/stasis-core": "1.0.0-beta.9",
+    "@preventive/compare": "^1.2.0",
+    "@preventive/diff": "^1.0.2",
+    "@preventive/lockfile": "1.0.0",
+    "@preventive/publishers": "^1.1.0",
+    "@preventive/report": "1.0.0-alpha.9",
+    "@preventive/sourcemap": "1.0.0-alpha.1",
+    "@preventive/upstream": "1.1.0",
+    "css-tree": "^3.2.1",
+    "oxc-minify": "^0.152.0",
+    "oxc-parser": "^0.152.0",
+    "oxfmt": "^0.72.0",
+    "semver": "^7.8.5",
+    "ws": "^8.22.0"
   },
   "peerDependencies": {
     "@neondatabase/serverless": "^1.0.2",
-    "@vercel/blob": "^2.3.3"
+    "@vercel/blob": "^2.3.3",
+    "@vercel/functions": "^3.9.11"
   },
   "peerDependenciesMeta": {
     "@neondatabase/serverless": {
@@ -135,6 +371,9 @@
     },
     "@vercel/blob": {
       "optional": true
+    },
+    "@vercel/functions": {
+      "optional": true
     }
   },
   "packageManager": "pnpm@10.33.4+sha512.1c67b3b359b2d408119ba1ed289f34b8fc3c6873412bec6fd264fbdc82489e510fcbecb9ce9d22dae7f3b76269d8441046014bdca53b9979cd7a561ad631b800"

package/risk/files/characters.js

@@ -0,0 +1,196 @@
+// The characters a text holds that can make it read other than it runs, or
+// hide text in it: control and bidirectional characters, and the invisible
+// characters a payload or a name no one sees can be spelled in (variation
+// selectors, Hangul fillers, tags). Shared with a code viewer that shows each
+// as a labelled box (ui/view/control-chars.js), which leaves what spells an
+// emoji, a recommended flag or a line's end as it is (passed).
+
+// What a text holds beyond printing characters and its line breaks: the C0
+// controls other than tab, line feed and carriage return, DEL, the C1
+// controls, and the bidirectional controls that can make code read other than
+// it runs ("Trojan Source"); and the invisible characters that can hide text
+// in it (invisibleCharacters), as a payload hidden in
+// variation selectors or a variable named by a Hangul filler.
+export const CONTROLS = /(?![\t\n\r])\p{Cc}|[\u202A-\u202E\u2066-\u2069]/gu
+const NON_ASCII = /\P{ASCII}/u
+
+// A file's text: `kind` 'ascii' or 'utf8', by whether it holds anything past
+// ASCII, else 'binary' (which the server tells by its bytes, sending no
+// text); `controls` the control and invisible characters a text holds, how
+// often by code point, or null for none.
+export function npmTextEncoding(text) {
+  if (typeof text !== 'string') return { kind: 'binary', controls: null }
+  const controls = new Map()
+  for (const [char] of text.matchAll(CONTROLS)) controls.set(char.codePointAt(0), (controls.get(char.codePointAt(0)) ?? 0) + 1)
+  // The invisible characters are all past ASCII: looked for in a text that
+  // has any, from its first.
+  const past = text.search(NON_ASCII)
+  if (past !== -1) for (const [code, times] of invisibleCharacters(text, past) ?? []) controls.set(code, times)
+  return { kind: past === -1 ? 'ascii' : 'utf8', controls: controls.size > 0 ? controls : null }
+}
+
+// A pictograph is an assigned one (Emoji): Extended_Pictographic also takes
+// in code points reserved for emoji to come, unassigned, each boxed itself,
+// and a joiner or selector beside one would go unseen.
+const EMOJI_BEFORE = /(?=\p{Emoji})\p{Extended_Pictographic}(?:\u{FE0F}|[\u{1F3FB}-\u{1F3FF}])?$/u
+const EMOJI_AFTER = /^(?=\p{Emoji})\p{Extended_Pictographic}/u
+const PICTOGRAPH_BEFORE = /(?=\p{Emoji})\p{Extended_Pictographic}$/u
+const KEYCAP_BASE = /^[\d#*]$/u
+const isTag = code => code >= 0xe0020 && code <= 0xe007f
+// The subdivision flags Unicode recommends (RGI), their tags spelling the
+// subdivision after a black flag: England's, Scotland's and Wales's. Others
+// show as a black flag and their tags as nothing, as a payload in them would.
+const FLAGS = new Set(['gbeng', 'gbsct', 'gbwls'])
+const tagged = (text, from, to) => to - from === 10 ? String.fromCodePoint(...Array.from({ length: 5 }, (_, i) => text.codePointAt(from + 2 * i) - 0xe0000)) : ''
+
+// Where to go on from where `code` at `at` in `text` stays text, else -1 for
+// one to show. A CR before a newline is part of the line end, as is one that
+// ends `text` where `lineEnd` says a newline follows it. A joiner between two
+// emoji joins them into one, a recommended subdivision flag's tags, up to the
+// cancel tag, name its region (FLAGS), and the text or emoji presentation
+// selector after a pictograph, or the emoji one between a keycap's digit, #
+// or * and its mark, draws it; after a letter or a digit alone it is another
+// name.
+export function passed(text, at, code, lineEnd) {
+  if (code === 0x0d && (text[at + 1] === '\n' || lineEnd && at + 1 === text.length)) return at + 1
+  if (code === 0x200d && EMOJI_BEFORE.test(text.slice(Math.max(0, at - 4), at)) && EMOJI_AFTER.test(text.slice(at + 1, at + 3))) return at + 1
+  if ((code === 0xfe0e || code === 0xfe0f) && PICTOGRAPH_BEFORE.test(text.slice(Math.max(0, at - 2), at))) return at + 1
+  if (code === 0xfe0f && KEYCAP_BASE.test(text[at - 1] ?? '') && text[at + 1] === '\u20E3') return at + 1
+  if (isTag(code) && !isTag(text.codePointAt(at - 2))) {
+    let end = at
+    while (isTag(text.codePointAt(end))) end += 2
+    if (text.codePointAt(at - 2) === 0x1f3f4 && text.codePointAt(end - 2) === 0xe007f && FLAGS.has(tagged(text, at, end - 2))) return end
+  }
+  return -1
+}
+
+// Those text is hidden in, as a file's Invisible chars label counts them
+// (readability.js), where they show: variation selectors (a payload, a
+// byte a selector), Hangul fillers (a name no one sees) and tags (ASCII no one
+// sees). Not the format characters, a BOM or a zero-width space, which text
+// has its uses for, nor the other marks that show as nothing (the combining
+// grapheme joiner, the Khmer inherent vowels and the Mongolian free variation
+// selectors), which tables of the characters a name may hold, as JavaScript
+// parsers have, hold too; nor what of these hides nothing (benign).
+const INVISIBLE = /[\u115F\u1160\u3164\uFFA0\u{E0001}\u{E0020}-\u{E007F}]|[\uFE00-\uFE0F]|[\u{E0100}-\u{E01EF}]/u
+// The code units they are in, to look for them by, faster than by code point:
+// the high surrogate starting those past the Basic Multilingual Plane (tags,
+// the selectors' supplement) too, told apart from its others once found. No
+// `u`, which would read a pair as the one code point it spells.
+// eslint-disable-next-line require-unicode-regexp
+const INVISIBLE_UNITS = /[\uFE00-\uFE0F\u115F\u1160\u3164\uFFA0\uDB40]/g
+// A table's code points, from its ranges in hex (`30 2018-2019`).
+const codePoints = ranges => new Set(ranges.split(' ').flatMap(range => {
+  const [from, to = from] = range.split('-').map(digits => Number.parseInt(digits, 16))
+  return Array.from({ length: to - from + 1 }, (_, i) => from + i)
+}))
+// The variation sequences Unicode registers, which hide nothing, though Code
+// shows their selectors after a letter or a digit, another name there: VS1 to
+// VS14's on other than an ideograph (StandardizedVariants.txt, Unicode
+// 18.0.0), each selector's bases, as an HTML entity table's math symbols, and
+// the emoji with a text and an emoji presentation, VS15 and VS16 after each
+// (emoji-variation-sequences.txt), as a heading's anchor keeps one (`#`).
+const STANDARDIZED = new Map([
+  [0xfe00, '30 1000 1002 1004 1010-1011 1015 1019-101a 101c-101d 1022 1031 1075'
+    + ' 1078 107a 1080 2018-2019 201c-201d 210b 2110 2112 211b 212c 2130-2131'
+    + ' 2133 2205 2229-222a 223d 2242-2243 2248 2268-2269 2272-2273 228a-228b'
+    + ' 2293-2295 2297 229c 22cd 22da-22dd 29b7 2a3c-2a3d 2a6c 2a9d-2a9e'
+    + ' 2aac-2aad 2acb-2acc 3001-3002 31c0 31c6 31c9 31cf-31d2 31d4-31d5 31d7'
+    + ' 31db-31dd 31e5 a856 a85c a85e-a860 a868 aa60-aa66 aa6b-aa6c aa6f aa7a'
+    + ' ff01 ff0c ff0e ff10 ff1a-ff1b ff1f 10ac5-10ac6 10ad6-10ad7 10ae1 13091'
+    + ' 1310f 1311c 13121 13127 13139 131a0 131b1 131b8-131b9 131cb 131e0'
+    + ' 131f9-131fa 1327b 1327f 13285 1328c 132aa 132cb 132dc 132e7 13307'
+    + ' 1331b 13322 1333c 13377-13378 13399-1339a 133d3 133e4-133e5 133e7'
+    + ' 133ee 133f2 133f5-133f6 13416 13419-1341a 13423 13443-13446'
+    + ' 13be8-13bea 13f72 1d49c 1d49e-1d49f 1d4a2 1d4a5-1d4a6 1d4a9-1d4ac'
+    + ' 1d4ae-1d4b5 1db10'],
+  [0xfe01, '2018-2019 201c-201d 210b 2110 2112 211b 212c 2130-2131 2133 3001-3002'
+    + ' 31c6 31cf 31dd ff01 ff0c ff0e ff1a-ff1b ff1f 13093 13132 13139 13187'
+    + ' 131b1 131ee 131f8-131fa 13257 1327f 1328b 132a4 13308 13312-13314'
+    + ' 1331b 13321-13322 13331 133e8 13419 13f1f 14274 1d49c 1d49e-1d49f'
+    + ' 1d4a2 1d4a5-1d4a6 1d4a9-1d4ac 1d4ae-1d4b5'],
+  [0xfe02, '2018-2019 201c-201d 13117 13139 13183 131a0 131ba 131ee 13216 1327b'
+    + ' 132a4 132e7 132e9 132f8 132fd 13302-13303 13310-13314 1331c 13321'
+    + ' 13331 1334a 13361 13373 1337d 13385 133af-133b0 133bf 133db 133dd'
+    + ' 13419 1342c 1342e 14274 1d4cf'],
+  [0xfe03, '13012 130b8 130ba 1310f 1312f 13139 13184 1319c-1319d 1319f 131b1'
+    + ' 131db 13205 13296 13338 13419'],
+  [0xfe04, '13139 1340d'],
+  [0xfe05, '13139 14274'],
+  [0xfe06, '1312f 13139 13184 131db 131ee 13205 132a4 132e9 1332b 13338'
+    + ' 13370-13371 13419 14274'],
+].map(([selector, bases]) => [selector, codePoints(bases)]))
+const EMOJI = codePoints('23 2a 30-39 a9 ae 203c 2049 2122 2139 2194-2199 21a9-21aa 231a-231b 2328'
+  + ' 23cf 23e9-23f3 23f8-23fa 24c2 25aa-25ab 25b6 25c0 25fb-25fe 2600-2604 260e'
+  + ' 2611 2614-2615 2618 261d 2620 2622-2623 2626 262a 262e-262f 2638-263a 2640'
+  + ' 2642 2648-2653 265f-2660 2663 2665-2666 2668 267b 267e-267f 2692-2697 2699'
+  + ' 269b-269c 26a0-26a1 26a7 26aa-26ab 26b0-26b1 26bd-26be 26c4-26c5 26c8'
+  + ' 26ce-26cf 26d1 26d3-26d4 26e9-26ea 26f0-26f5 26f7-26fa 26fd 2702 2705'
+  + ' 2708-270d 270f 2712 2714 2716 271d 2721 2728 2733-2734 2744 2747 274c 274e'
+  + ' 2753-2755 2757 2763-2764 2795-2797 27a1 27b0 27bf 2934-2935 2b05-2b07'
+  + ' 2b1b-2b1c 2b50 2b55 3030 303d 3297 3299 1f004 1f170-1f171 1f17e-1f17f'
+  + ' 1f202 1f21a 1f22f 1f237 1f30d-1f30f 1f315 1f31c 1f321 1f324-1f32c 1f336'
+  + ' 1f378 1f37d 1f393 1f396-1f397 1f399-1f39b 1f39e-1f39f 1f3a7 1f3ac-1f3ae'
+  + ' 1f3c2 1f3c4 1f3c6 1f3ca-1f3ce 1f3d4-1f3e0 1f3ed 1f3f3 1f3f5 1f3f7 1f408'
+  + ' 1f415 1f41f 1f426 1f43f 1f441-1f442 1f446-1f449 1f44d-1f44e 1f453 1f46a'
+  + ' 1f47d 1f4a3 1f4b0 1f4b3 1f4bb 1f4bf 1f4cb 1f4da 1f4df 1f4e4-1f4e6'
+  + ' 1f4ea-1f4ed 1f4f7 1f4f9-1f4fb 1f4fd 1f508 1f50d 1f512-1f513 1f549-1f54a'
+  + ' 1f550-1f567 1f56f-1f570 1f573-1f579 1f587 1f58a-1f58d 1f590 1f5a5 1f5a8'
+  + ' 1f5b1-1f5b2 1f5bc 1f5c2-1f5c4 1f5d1-1f5d3 1f5dc-1f5de 1f5e1 1f5e3 1f5e8'
+  + ' 1f5ef 1f5f3 1f5fa 1f610 1f687 1f68d 1f691 1f694 1f698 1f6ad 1f6b2'
+  + ' 1f6b9-1f6ba 1f6bc 1f6cb 1f6cd-1f6cf 1f6e0-1f6e5 1f6e9 1f6f0 1f6f3')
+// The blocks of variation selectors, as those tables write them out as ranges.
+const BLOCKS = [[0xfe00, 0xfe0f], [0xe0100, 0xe01ef]]
+// The compatibility jamo but their filler.
+const JAMO = [[0x3131, 0x3163], [0x3165, 0x318e]]
+
+// The code point before `at` in `text`, a pair of surrogates read as one.
+function codePointBefore(text, at) {
+  if (at === 0) return undefined
+  const pair = at >= 2 ? text.codePointAt(at - 2) : 0
+  return pair > 0xffff ? pair : text.codePointAt(at - 1)
+}
+const within = (code, ...ranges) => code !== undefined && ranges.some(([from, to]) => code >= from && code <= to)
+
+// Whether the one shown as `code` at `at` hides nothing: a Hangul filler
+// composing Hangul (the initial consonant's before a vowel, a syllable with
+// none, or the vowel's after an initial consonant, one with none), or a
+// compatibility or halfwidth jamo's among those jamo, as a codepage's table
+// lists them, though not one after a syllable, a name that reads as it; a
+// variation sequence Unicode registers; a block of selectors written out as a
+// range in a table (`VS1-VS16`); or an emoji's presentation selector doubled,
+// as copying text leaves it.
+function benign(text, at, code) {
+  const end = at + (code > 0xffff ? 2 : 1)
+  const after = text.codePointAt(end), before = codePointBefore(text, at)
+  switch (code) {
+    case 0x115f: return within(after, [0x1161, 0x11a7], [0xd7b0, 0xd7c6])
+    case 0x1160: return within(before, [0x1100, 0x115e], [0xa960, 0xa97c])
+    case 0x3164: return within(before, ...JAMO) || within(after, ...JAMO)
+    case 0xffa0: return within(before, [0xffa1, 0xffdc]) || within(after, [0xffa1, 0xffdc])
+    default: return (code === 0xfe0e || code === 0xfe0f ? EMOJI.has(before) : STANDARDIZED.get(code)?.has(before))
+      || BLOCKS.some(([from, to]) => code === from && text[end] === '-' && text.codePointAt(end + 1) === to
+        || code === to && text[at - 1] === '-' && codePointBefore(text, at - 1) === from)
+      || (code === 0xfe0e || code === 0xfe0f) && before === code && PICTOGRAPH_BEFORE.test(text.slice(Math.max(0, at - 3), at - 1))
+  }
+}
+
+// How many of each a text holds, by code point, or null for none: each one
+// a code viewer shows (passed), visited alone, not each character it shows. `from`:
+// where to look from, as the first character past ASCII, since all of them are.
+export function invisibleCharacters(text, from = 0) {
+  let found = null
+  INVISIBLE_UNITS.lastIndex = from
+  for (let match = INVISIBLE_UNITS.exec(text); match; match = INVISIBLE_UNITS.exec(text)) {
+    const at = match.index, code = text.codePointAt(at)
+    if (!INVISIBLE.test(String.fromCodePoint(code))) continue
+    const next = passed(text, at, code, false)
+    if (next !== -1) INVISIBLE_UNITS.lastIndex = next
+    else if (!benign(text, at, code)) {
+      found ??= new Map()
+      found.set(code, (found.get(code) ?? 0) + 1)
+    }
+  }
+  return found
+}
+