export const BULK_ADVISORY_ERROR_BODY_MAX_CHARS = 4096;

export const BULK_ADVISORY_RESPONSE_BODY_MAX_BYTES = 8 * 1024 * 1024;

export const BULK_ADVISORY_REQUEST_TIMEOUT_MS = 60_000;

const MAX_TIMER_TIMEOUT_MS = 2_147_000_000;

const SEVERITY_RANK = {

info: 0,

low: 1,

}

function resolveBulkAdvisoryRequestTimeoutMs() {

return parsePositiveIntegerEnv(

"OPENCLAW_PNPM_AUDIT_BULK_TIMEOUT_MS",

BULK_ADVISORY_REQUEST_TIMEOUT_MS,

return clampTimerTimeoutMs(

parsePositiveIntegerEnv(

"OPENCLAW_PNPM_AUDIT_BULK_TIMEOUT_MS",

BULK_ADVISORY_REQUEST_TIMEOUT_MS,

),

);

}

);

}

function clampTimerTimeoutMs(valueMs) {

const value = Number.isFinite(valueMs) ? valueMs : BULK_ADVISORY_REQUEST_TIMEOUT_MS;

return Math.min(Math.max(Math.floor(value), 1), MAX_TIMER_TIMEOUT_MS);

}

async function withBulkAdvisoryTimeout({ label, timeoutMs, run }) {

const resolvedTimeoutMs = clampTimerTimeoutMs(timeoutMs);

const controller = new AbortController();

let timeout;

const timeoutPromise = new Promise((_resolve, reject) => {

timeout = setTimeout(() => {

const error = new Error(`${label} exceeded timeout of ${timeoutMs}ms`);

const error = new Error(`${label} exceeded timeout of ${resolvedTimeoutMs}ms`);

controller.abort(error);

reject(error);

}, timeoutMs);

}, resolvedTimeoutMs);

});

try {

return await Promise.race([run({ signal: controller.signal, timeoutPromise }), timeoutPromise]);

import { mkdtemp, rm, writeFile } from "node:fs/promises";

import { tmpdir } from "node:os";

import path from "node:path";

import { MAX_TIMER_TIMEOUT_MS } from "@openclaw/normalization-core/number-coercion";

import { describe, expect, it } from "vitest";

import {

collectProdResolvedPackagesFromLockfile,

expect(signal?.aborted).toBe(true);

});

it("clamps oversized bulk advisory request timers before scheduling", async () => {

let signal: AbortSignal | undefined;

const request = fetchBulkAdvisories({

payload: { axios: ["1.0.0"] },

timeoutMs: MAX_TIMER_TIMEOUT_MS + 1,

fetchImpl: (async (_url, init) => {

signal = init?.signal ?? undefined;

await new Promise<void>((resolve, reject) => {

const timer = setTimeout(resolve, 25);

signal?.addEventListener(

"abort",

() => {

clearTimeout(timer);

reject(new Error("aborted"));

},

{ once: true },

);

});

return new Response("{}", { status: 200 });

}) as typeof fetch,

});

await expect(request).resolves.toEqual({});

expect(signal?.aborted).toBe(false);

});

it("cancels stalled successful bulk advisory response bodies on request timeout", async () => {

let cancelled = false;

const body = new ReadableStream({