rea-agents 1.6.0 → 2.0.0

package/dist/domain/analysisSnapshot.js

@@ -1,13 +1,14 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
+import { analysisProfileSchema, analysisProfilesEqual, committedProviderSchema, } from "./analysisProfile.js";
 import { evidenceBundleForTarget, evidenceBundleSchema, parseEvidenceBundle, } from "./evidenceBundle.js";
-import { evidenceLocationSchema, providerSchema, } from "./evidence.js";
+import { evidenceLocationSchema, } from "./evidence.js";
 import { jsonObjectSchema, jsonValueSchema, } from "./jsonValue.js";
 const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
 const architectureSchema = z.enum(["x86", "x86_64", "arm", "arm64"]);
 const formatSchema = z.enum([
-    "hopper",
+    "analysis-database",
     "mach-o",
     "elf",
     "pe",
@@ -21,11 +22,13 @@ const formatSchema = z.enum([
     "javascript",
     "source-map",
 ]);
+const kindSchema = z.enum(["executable", "database", "archive", "artifact"]);
 const subjectSchema = z.object({
     path: z.string().min(1),
     sha256: digestSchema,
     format: z.enum([
         ...formatSchema.options,
+        "hopper",
         "directory",
         "file",
         "unknown",
@@ -37,9 +40,24 @@ const subjectSchema = z.object({
 });
 const targetSchema = z.object({
     sha256: digestSchema,
+    kind: kindSchema,
     format: formatSchema,
     architecture: architectureSchema.nullable(),
-    loader_args: z.array(z.string()),
+});
+const bindingSchema = z
+    .object({
+    provider: committedProviderSchema,
+    analysis_profile: analysisProfileSchema,
+})
+    .superRefine((binding, context) => {
+    if (binding.provider.id !== binding.analysis_profile.provider.id ||
+        binding.provider.name !== binding.analysis_profile.provider.name ||
+        binding.provider.version !== binding.analysis_profile.provider.version)
+        context.addIssue({
+            code: "custom",
+            path: ["provider"],
+            message: "Snapshot binding provider does not match analysis profile",
+        });
 });
 const entrySchema = z.object({
     query_id: z.string().regex(/^query_[a-f0-9]{64}$/u),
@@ -48,16 +66,17 @@ const entrySchema = z.object({
     execution: z.object({
         result: jsonValueSchema,
         raw_result: jsonValueSchema.nullable(),
-        provider: providerSchema,
+        provider: committedProviderSchema,
         limitations: z.array(z.string()),
         locations: z.array(evidenceLocationSchema),
         subject: subjectSchema.nullable(),
     }),
 });
-/** Provider-neutral, deterministic cache of successful immutable analysis calls. */
-const analysisSnapshotSchema = z.object({
-    snapshot_version: z.literal(1),
+/** Provider- and profile-exact cache of successful immutable analysis calls. */
+export const analysisSnapshotSchema = z.object({
+    snapshot_version: z.literal(2),
     target: targetSchema,
+    binding: bindingSchema,
     entries: z.array(entrySchema).max(10_000),
     evidence_bundle: evidenceBundleSchema,
 });
@@ -71,19 +90,32 @@ const canonicalJson = (value) => {
 /** Project a binary into the path-free identity used for cache invalidation. */
 export const snapshotTarget = (target) => ({
     sha256: target.sha256,
+    kind: target.kind,
     format: target.format,
     architecture: target.architecture ?? null,
-    loader_args: [...target.loaderArgs],
 });
-/** Compare an open binary with the immutable identity in a snapshot. */
+/** Build the immutable provider/profile binding used by snapshot v2. */
+export const snapshotBinding = (profile) => bindingSchema.parse({
+    provider: profile.provider,
+    analysis_profile: profile,
+});
+/** Compare an open binary with the immutable target identity in a snapshot. */
 export const snapshotMatchesTarget = (snapshot, target) => snapshot.sha256 === target.sha256 &&
+    snapshot.kind === target.kind &&
     snapshot.format === target.format &&
-    snapshot.architecture === (target.architecture ?? null) &&
-    JSON.stringify(snapshot.loader_args) === JSON.stringify(target.loaderArgs);
-/** Find exact persisted CLI evidence without starting an analysis provider. */
+    snapshot.architecture === (target.architecture ?? null);
+/** Compare a snapshot binding with the selected concrete analysis profile. */
+export const snapshotMatchesProfile = (binding, profile) => binding.provider.id === profile.provider.id &&
+    binding.provider.name === profile.provider.name &&
+    binding.provider.version === profile.provider.version &&
+    analysisProfilesEqual(binding.analysis_profile, profile);
+/** Require an exact target and selected provider/profile cache partition. */
+export const snapshotMatchesBinding = (snapshot, target, profile) => snapshotMatchesTarget(snapshot.target, target) &&
+    snapshotMatchesProfile(snapshot.binding, profile);
+/** Find exact persisted CLI Evidence without starting an analysis provider. */
 export const snapshotEvidenceForQuery = (snapshot, query) => {
-    const { target, operation, parameters, provider } = query;
-    if (!snapshotMatchesTarget(snapshot.target, target))
+    const { target, bindingProfile, operation, parameters, provider, evidenceProfile, } = query;
+    if (!snapshotMatchesBinding(snapshot, target, bindingProfile))
         return undefined;
     const encodedParameters = canonicalJson(parameters);
     return snapshot.evidence_bundle.records.find((record) => record.subject?.digest.sha256 === target.sha256 &&
@@ -91,49 +123,56 @@ export const snapshotEvidenceForQuery = (snapshot, query) => {
         record.provider.id === provider.id &&
         record.provider.name === provider.name &&
         record.provider.version === provider.version &&
+        "analysis_profile" in record &&
+        analysisProfilesEqual(record.analysis_profile, evidenceProfile) &&
         canonicalJson(record.parameters) === encodedParameters);
 };
-/** Compute the stable lookup key for one provider-specific analysis query. */
-export const analysisQueryId = (target, operation, parameters, provider) => `query_${createHash("sha256")
-    .update(canonicalJson({
-    target,
-    operation,
-    parameters,
-    provider: {
-        id: provider.id,
-        name: provider.name,
-        version: provider.version,
-    },
-}))
+/** Compute the stable lookup key for one provider/profile-specific query. */
+export const analysisQueryId = (target, binding, operation, parameters) => `query_${createHash("sha256")
+    .update(canonicalJson({ target, binding, operation, parameters }))
     .digest("hex")}`;
 /** Create one serializable snapshot entry from a successful provider call. */
-export const createAnalysisSnapshotEntry = (target, operation, parameters, execution) => ({
-    query_id: analysisQueryId(target, operation, parameters, execution.provider),
-    operation,
-    parameters: jsonObjectSchema.parse(parameters),
-    execution: {
-        result: execution.result,
-        raw_result: execution.rawResult,
-        provider: execution.provider,
-        limitations: [...execution.limitations],
-        locations: [...execution.locations],
-        subject: execution.subject === null
-            ? null
-            : {
-                ...execution.subject,
-                architecture: execution.subject.architecture ?? null,
-            },
-    },
-});
-/** Parse a snapshot and reject altered query IDs or non-canonical entry order. */
+export const createAnalysisSnapshotEntry = (input) => {
+    const { target, binding, operation, parameters, execution } = input;
+    if (execution.analysisProfile === undefined ||
+        !snapshotMatchesProfile(binding, execution.analysisProfile) ||
+        execution.provider.id !== binding.provider.id ||
+        execution.provider.name !== binding.provider.name ||
+        execution.provider.version !== binding.provider.version)
+        throw new TypeError("Snapshot execution does not match its provider/profile binding");
+    return {
+        query_id: analysisQueryId(target, binding, operation, parameters),
+        operation,
+        parameters: jsonObjectSchema.parse(parameters),
+        execution: {
+            result: execution.result,
+            raw_result: execution.rawResult,
+            provider: binding.provider,
+            limitations: [...execution.limitations],
+            locations: [...execution.locations],
+            subject: execution.subject === null
+                ? null
+                : {
+                    ...execution.subject,
+                    architecture: execution.subject.architecture ?? null,
+                },
+        },
+    };
+};
+/** Parse v2 and reject legacy snapshots, altered query IDs, or non-canonical order. */
 export const parseAnalysisSnapshot = (input) => {
+    rejectLegacySnapshot(input);
     const parsed = analysisSnapshotSchema.parse(input);
     parseEvidenceBundle(parsed.evidence_bundle);
     if (JSON.stringify(evidenceBundleForTarget(parsed.evidence_bundle, parsed.target.sha256)) !== JSON.stringify(parsed.evidence_bundle))
         throw new TypeError("Analysis snapshot evidence contains records for another target");
     const ids = new Set();
     for (const entry of parsed.entries) {
-        const expected = analysisQueryId(parsed.target, entry.operation, entry.parameters, entry.execution.provider);
+        if (entry.execution.provider.id !== parsed.binding.provider.id ||
+            entry.execution.provider.name !== parsed.binding.provider.name ||
+            entry.execution.provider.version !== parsed.binding.provider.version)
+            throw new TypeError("Analysis snapshot entry provider does not match");
+        const expected = analysisQueryId(parsed.target, parsed.binding, entry.operation, entry.parameters);
         if (entry.query_id !== expected)
             throw new TypeError("Analysis snapshot query identifier does not match");
         if (ids.has(entry.query_id))
@@ -147,3 +186,10 @@ export const parseAnalysisSnapshot = (input) => {
 };
 /** Serialize a validated snapshot with byte-stable canonical entry ordering. */
 export const serializeAnalysisSnapshot = (snapshot) => `${canonicalJson(parseAnalysisSnapshot(snapshot))}\n`;
+const rejectLegacySnapshot = (input) => {
+    if (typeof input === "object" &&
+        input !== null &&
+        "snapshot_version" in input &&
+        input.snapshot_version === 1)
+        throw new TypeError("Analysis snapshot v1 is incompatible with profile-exact replay; recapture it as snapshot v2. Its Evidence bundle may be imported separately.");
+};

package/dist/domain/artifactComparison.js

@@ -1,7 +1,6 @@
 import canonicalize from "canonicalize";
 import { z } from "zod";
 import {} from "./artifactGraph.js";
-import { evidenceSchema } from "./evidence.js";
 import { parseArtifactInventoryEvidence, } from "./artifactInventoryEvidence.js";
 const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
 const comparisonStatusSchema = z.enum([
@@ -32,9 +31,9 @@ const comparisonDimensionSchema = z.enum([
     "integrity",
 ]);
 /** Strict Evidence-backed input for deterministic artifact comparison. */
-export const artifactComparisonInputSchema = z.object({
-    left: z.union([evidenceSchema, z.array(evidenceSchema).min(1).max(100)]),
-    right: z.union([evidenceSchema, z.array(evidenceSchema).min(1).max(100)]),
+export const artifactComparisonInputSchema = z.strictObject({
+    left_evidence_ids: z.array(evidenceIdSchema).min(1).max(100),
+    right_evidence_ids: z.array(evidenceIdSchema).min(1).max(100),
     offset: z.number().int().min(0).default(0),
     limit: z.number().int().min(1).max(500).default(100),
     unknown_registry_approved: z

package/dist/domain/artifactGraph.js

@@ -42,6 +42,7 @@ const artifactFormatSchema = z.enum([
     "elf",
     "pe",
     "hopper",
+    "analysis-database",
     "ipa",
     "apk",
     "plist",

package/dist/domain/binaryTarget.js

@@ -9,7 +9,7 @@ import { BinaryTargetError } from "./errors.js";
 import { err, ok } from "./result.js";
 const execFileAsync = promisify(execFile);
 /**
- * Resolve and classify a readable local target before Hopper is launched.
+ * Resolve and classify a readable local target before a provider is selected.
  * FAT Mach-O inputs select only a host-compatible architecture so setup remains
  * non-interactive; unsupported or ambiguous inputs are returned as typed errors.
  */
@@ -31,8 +31,7 @@ export const parseBinaryTarget = async (input, cwd = process.cwd(), hostArchitec
                 sourcePath: canonical,
                 sha256: await sha256File(path),
                 kind: "database",
-                format: "hopper",
-                loaderArgs: [],
+                format: "analysis-database",
             });
         const handle = await open(path, "r");
         let detected;
@@ -45,7 +44,6 @@ export const parseBinaryTarget = async (input, cwd = process.cwd(), hostArchitec
                     sha256: await sha256File(path),
                     kind: isArchiveFormat(artifactFormat) ? "archive" : "artifact",
                     format: artifactFormat,
-                    loaderArgs: [],
                 });
             detected = await readExecutableMetadata(handle, hostArchitecture);
         }
@@ -210,9 +208,8 @@ const readExecutableMetadata = async (handle, hostArchitecture) => {
     return parseExecutableHeader(bytes, hostArchitecture);
 };
 /**
- * Parse supported executable headers without I/O and derive explicit Hopper
- * loader arguments. The caller must supply the host architecture used for FAT
- * Mach-O slice selection.
+ * Parse supported executable headers without I/O. The caller supplies the host
+ * architecture used for deterministic FAT Mach-O slice selection.
  */
 export const parseExecutableHeader = (bytes, hostArchitecture) => {
     if (bytes.length >= 4 &&
@@ -240,7 +237,6 @@ const parseThinMachO = (bytes, magic) => {
         format: "mach-o",
         architecture,
         availableArchitectures: [architecture],
-        loaderArgs: ["-l", "Mach-O", hopperArchitectureFlag(architecture)],
     });
 };
 const parseFatMachO = (bytes, magic, host) => {
@@ -274,13 +270,6 @@ const parseFatMachO = (bytes, magic, host) => {
         format: "mach-o",
         architecture: preferred,
         availableArchitectures: architectures,
-        loaderArgs: [
-            "-l",
-            "FAT",
-            hopperArchitectureFlag(preferred),
-            "-l",
-            "Mach-O",
-        ],
     });
 };
 const parseElf = (bytes) => {
@@ -299,7 +288,6 @@ const parseElf = (bytes) => {
         format: "elf",
         architecture,
         availableArchitectures: [architecture],
-        loaderArgs: ["-l", "ELF", hopperArchitectureFlag(architecture)],
     });
 };
 const parsePe = (bytes) => {
@@ -320,7 +308,6 @@ const parsePeRecord = (record) => {
         format: "pe",
         architecture,
         availableArchitectures: [architecture],
-        loaderArgs: ["-l", "WinPE", hopperArchitectureFlag(architecture)],
     });
 };
 const machArchitecture = (cpu) => {
@@ -362,15 +349,3 @@ const peArchitecture = (machine) => {
     }
     return undefined;
 };
-const hopperArchitectureFlag = (architecture) => {
-    switch (architecture) {
-        case "x86":
-            return "--intel-32";
-        case "x86_64":
-            return "--intel-64";
-        case "arm":
-            return "--armv7";
-        case "arm64":
-            return "--aarch64";
-    }
-};

package/dist/domain/browserObservation.js

@@ -382,6 +382,7 @@ const browserResourceReconciliationSchema = z.discriminatedUnion("status", [
 ]);
 const browserScriptSchema = z.object({
     script_key: z.string().regex(/^scr_[a-f0-9]{64}(?:_[0-9]+)?$/u),
+    frame_id: z.string().nullable().default(null),
     url: z.string(),
     origin: z.string().nullable(),
     cdp_hash: z.string(),
@@ -464,6 +465,8 @@ const browserWorkerSchema = z.object({
     url: z.string(),
     origin: z.string().nullable(),
     attached: z.boolean(),
+    opener_target_id: z.string().nullable().default(null),
+    parent_frame_id: z.string().nullable().default(null),
 });
 const browserCspSourceSchema = z.object({
     kind: z.enum([

package/dist/domain/bundleComparison.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { z } from "zod";
-import { evidenceBundleSchema, parseEvidenceBundle, serializeEvidenceBundle, } from "./evidenceBundle.js";
+import { parseEvidenceBundle, serializeEvidenceBundle, } from "./evidenceBundle.js";
 const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
 const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
 const classificationSchema = z.enum([
@@ -12,9 +12,9 @@ const classificationSchema = z.enum([
     "history_diverged",
 ]);
 /** Strict bounded input for canonical Evidence bundle comparison. */
-export const bundleComparisonInputSchema = z.object({
-    left: evidenceBundleSchema,
-    right: evidenceBundleSchema,
+export const bundleComparisonInputSchema = z.strictObject({
+    left_bundle_path: z.string().min(1).max(4_096),
+    right_bundle_path: z.string().min(1).max(4_096),
     record_pairs: z
         .array(z.object({
         left_evidence_id: evidenceIdSchema,

package/dist/domain/electronObservation.js

@@ -38,6 +38,7 @@ export const inspectElectronPageInputSchema = z
         max_dom_nodes: z.number().int().min(1).max(10_000).default(2_000),
         max_scripts: z.number().int().min(1).max(2_000).default(500),
         max_resources: z.number().int().min(1).max(10_000).default(2_000),
+        max_workers: z.number().int().min(1).max(5_000).default(500),
         max_script_source_bytes: z
             .number()
             .int()
@@ -56,6 +57,7 @@ export const inspectElectronPageInputSchema = z
         max_dom_nodes: 2_000,
         max_scripts: 500,
         max_resources: 2_000,
+        max_workers: 500,
         max_script_source_bytes: 1_024 * 1_024,
         max_total_script_source_bytes: 4 * 1_024 * 1_024,
     }),
@@ -143,6 +145,7 @@ export const electronPageInspectionSchema = z.object({
         total: z.number().int().min(0),
         items: z.array(z.object({
             script_key: z.string().regex(/^electron_script_[a-f0-9]{64}$/u),
+            frame_id: z.string().nullable().default(null),
             file_path: z.string(),
             cdp_hash: z.string(),
             length: z.number().int().min(0),
@@ -158,5 +161,15 @@ export const electronPageInspectionSchema = z.object({
         mime_type: z.string(),
         content_size: z.number().min(0).nullable(),
     })),
+    workers: z
+        .array(z.object({
+        target_id: z.string().min(1).max(256),
+        type: z.string().min(1).max(100),
+        file_path: z.string(),
+        attached: z.boolean(),
+        opener_target_id: z.string().min(1).max(256).nullable(),
+        parent_frame_id: z.string().min(1).max(256).nullable(),
+    }))
+        .default([]),
     limitations: z.array(z.string()),
 });

package/dist/domain/electronStaticAnalysis.js

@@ -0,0 +1,9 @@
+import { inspectElectronBrowserNode } from "./electronStaticAnalysisBrowser.js";
+import { inspectElectronIpcNode } from "./electronStaticAnalysisIpc.js";
+import { inspectElectronNativeNode } from "./electronStaticAnalysisNative.js";
+/** Collect Electron-specific syntax during the shared inert AST traversal. */
+export const inspectElectronStaticNode = (node, context) => {
+    inspectElectronBrowserNode(node, context);
+    inspectElectronIpcNode(node, context);
+    inspectElectronNativeNode(node, context);
+};

package/dist/domain/electronStaticAnalysisBrowser.js

@@ -0,0 +1,194 @@
+import * as t from "@babel/types";
+import { boundedExpression, collectContextBridgeMembers, electronStaticValue, objectProperty, } from "./electronStaticAnalysisValues.js";
+import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
+import { argumentNode, calleeName, compareCodePoints, propertyName, range, staticPath, } from "./javascriptStaticAnalysisHelpers.js";
+const MAX_WEB_PREFERENCES = 64;
+/** Inspect BrowserWindow, contextBridge, and utility-process syntax. */
+export const inspectElectronBrowserNode = (node, context) => {
+    if (t.isNewExpression(node))
+        inspectBrowserWindow(node, context);
+    if (!t.isCallExpression(node))
+        return;
+    inspectContextBridge(node, context);
+    inspectUtilityProcess(node, context);
+};
+const inspectBrowserWindow = (node, context) => {
+    const name = calleeName(node.callee);
+    if (name !== "BrowserWindow" && !name.endsWith(".BrowserWindow"))
+        return;
+    const options = argumentNode(node.arguments[0]);
+    const collected = collectWindowOptions(context.source, options);
+    accountForStructure(context, collected.unknown, collected.omitted);
+    const finding = {
+        options_status: options === undefined
+            ? "missing"
+            : t.isObjectExpression(options)
+                ? "object-literal"
+                : "dynamic",
+        web_preferences_status: collected.status,
+        web_preferences: collected.preferences,
+        omitted_web_preferences: collected.omitted,
+        preload_path: collected.preloadPath,
+        module_key: null,
+        location: range(node),
+    };
+    addLocatedFinding(context, {
+        collection: context.accumulator.browserWindows,
+        key: `electron-window\0${name}`,
+        node,
+        value: finding,
+    });
+};
+const collectWindowOptions = (source, options) => {
+    if (!t.isObjectExpression(options))
+        return {
+            status: options === undefined ? "missing" : "dynamic",
+            preferences: [],
+            preloadPath: null,
+            unknown: options === undefined ? 0 : 1,
+            omitted: 0,
+        };
+    const property = objectProperty(options, "webPreferences");
+    if (property === undefined)
+        return {
+            status: "missing",
+            preferences: [],
+            preloadPath: null,
+            unknown: 0,
+            omitted: 0,
+        };
+    if (!t.isObjectExpression(property.value))
+        return {
+            status: "dynamic",
+            preferences: [],
+            preloadPath: null,
+            unknown: 1,
+            omitted: 0,
+        };
+    return collectWebPreferences(source, property.value);
+};
+const collectWebPreferences = (source, object) => {
+    const preferences = [];
+    let unknown = 0;
+    let preloadPath = null;
+    for (const property of object.properties) {
+        if (t.isSpreadElement(property)) {
+            unknown += 1;
+            preferences.push({
+                name: `[spread@${String(property.start ?? -1)}]`,
+                value: electronStaticValue(source, property.argument),
+            });
+            continue;
+        }
+        const name = propertyName(property.key);
+        if (name === "" || property.computed) {
+            unknown += 1;
+            preferences.push({
+                name: `[dynamic@${String(property.start ?? -1)}]`,
+                value: electronStaticValue(source, property),
+            });
+            continue;
+        }
+        if (t.isObjectMethod(property)) {
+            unknown += 1;
+            preferences.push({
+                name,
+                value: electronStaticValue(source, property),
+            });
+            continue;
+        }
+        const path = name === "preload" ? staticPath(property.value) : undefined;
+        if (path !== undefined)
+            preloadPath = path;
+        const value = path === undefined
+            ? electronStaticValue(source, property.value)
+            : { status: "literal", value: path, expression: null };
+        if (value.status === "dynamic")
+            unknown += 1;
+        preferences.push({ name, value });
+    }
+    preferences.sort((left, right) => compareCodePoints(left.name, right.name));
+    return {
+        status: "object-literal",
+        preferences: preferences.slice(0, MAX_WEB_PREFERENCES),
+        preloadPath,
+        unknown,
+        omitted: Math.max(0, preferences.length - MAX_WEB_PREFERENCES),
+    };
+};
+const inspectContextBridge = (node, context) => {
+    const name = calleeName(node.callee);
+    const main = name === "contextBridge.exposeInMainWorld" ||
+        name.endsWith(".contextBridge.exposeInMainWorld");
+    const isolated = name === "contextBridge.exposeInIsolatedWorld" ||
+        name.endsWith(".contextBridge.exposeInIsolatedWorld");
+    if (!main && !isolated)
+        return;
+    const keyNode = argumentNode(node.arguments[isolated ? 1 : 0]);
+    const apiNode = argumentNode(node.arguments[isolated ? 2 : 1]);
+    const key = electronStaticValue(context.source, keyNode);
+    const api = collectContextBridgeMembers(apiNode);
+    const worldId = isolated
+        ? electronStaticValue(context.source, argumentNode(node.arguments[0]))
+        : null;
+    const unknown = (key.status === "dynamic" ? 1 : 0) +
+        (worldId?.status === "dynamic" ? 1 : 0) +
+        api.unknown;
+    accountForStructure(context, unknown, api.omitted);
+    const finding = {
+        world: isolated ? "isolated" : "main",
+        world_id: worldId,
+        api_key: key.status === "literal" && typeof key.value === "string"
+            ? key.value
+            : null,
+        api_key_expression: key.status === "dynamic" ? key.expression : null,
+        api_status: api.status,
+        members: api.members,
+        unknown_members: api.unknown,
+        omitted_members: api.omitted,
+        module_key: null,
+        location: range(node),
+    };
+    addLocatedFinding(context, {
+        collection: context.accumulator.contextBridgeApis,
+        key: `context-bridge\0${isolated ? "isolated" : "main"}\0${finding.api_key ?? finding.api_key_expression ?? "[missing]"}`,
+        node,
+        value: finding,
+    });
+};
+const inspectUtilityProcess = (node, context) => {
+    const name = calleeName(node.callee);
+    if (name !== "utilityProcess.fork" && !name.endsWith(".utilityProcess.fork"))
+        return;
+    const moduleNode = argumentNode(node.arguments[0]);
+    const modulePath = moduleNode === undefined ? undefined : staticPath(moduleNode);
+    const options = argumentNode(node.arguments[2]);
+    const serviceName = t.isObjectExpression(options) &&
+        objectProperty(options, "serviceName") !== undefined
+        ? staticPath(objectProperty(options, "serviceName")?.value ?? options)
+        : undefined;
+    if (modulePath === undefined)
+        context.accumulator.unknownFindings += 1;
+    const finding = {
+        module_path: modulePath ?? null,
+        module_expression: modulePath === undefined
+            ? boundedExpression(context.source, moduleNode)
+            : null,
+        service_name: serviceName ?? null,
+        module_key: null,
+        location: range(node),
+    };
+    addLocatedFinding(context, {
+        collection: context.accumulator.utilityProcesses,
+        key: `electron-utility\0${modulePath ?? finding.module_expression ?? "[missing]"}`,
+        node,
+        value: finding,
+    });
+};
+const accountForStructure = (context, unknown, omitted) => {
+    context.accumulator.unknownFindings += unknown;
+    if (omitted === 0)
+        return;
+    context.accumulator.structuralTruncation = true;
+    context.accumulator.droppedFindings += omitted;
+};