rea-agents 1.6.0 → 2.0.0

package/dist/application/InvestigationProviders.js

@@ -1,9 +1,50 @@
+import { createAnalysisProfile, } from "../domain/analysisProfile.js";
+/** Provider identity for deterministic composed analysis workflows. */
+export const REA_WORKFLOW_PROVIDER = {
+    id: "rea-workflow",
+    name: "REA composed investigation workflow",
+    version: "1",
+};
+/** Commit a workflow result to the exact upstream deep-analysis profile. */
+export const workflowAnalysisProfile = (upstream) => createAnalysisProfile(REA_WORKFLOW_PROVIDER, 1, {
+    upstream_analysis_profile: upstream,
+});
 /** Provider identity for deterministic artifact inventories. */
 export const ARTIFACT_GRAPH_PROVIDER = {
     id: "rea-artifact-graph",
     name: "REA safe artifact graph provider",
     version: "1",
 };
+/** Provider identity for execution-free managed PE/CLI analysis. */
+export const MANAGED_STATIC_PROVIDER = {
+    id: "rea-dotnet-static",
+    name: "REA managed static analysis provider",
+    version: "1",
+};
+/** Provider identity for deterministic managed-code comparison workflows. */
+export const MANAGED_WORKFLOW_PROVIDER = {
+    id: "rea-dotnet-workflows",
+    name: "REA managed-code workflows",
+    version: "1",
+};
+/** Provider identity for deterministic static JavaScript application analysis. */
+export const JAVASCRIPT_APPLICATION_PROVIDER = {
+    id: "rea-javascript-application",
+    name: "REA JavaScript application analyzer",
+    version: "1",
+};
+/** Provider identity for static/passive-runtime JavaScript reconciliation. */
+export const JAVASCRIPT_RUNTIME_RECONCILIATION_PROVIDER = {
+    id: "rea-javascript-runtime-reconciliation",
+    name: "REA JavaScript runtime reconciliation",
+    version: "1",
+};
+/** Provider identity for graph-native feature tracing and version comparison. */
+export const JAVASCRIPT_APPLICATION_WORKFLOW_PROVIDER = {
+    id: "rea-javascript-application-workflows",
+    name: "REA JavaScript application workflows",
+    version: "1",
+};
 /** Provider identity for deterministic cross-artifact comparisons. */
 export const ARTIFACT_COMPARISON_PROVIDER = {
     id: "rea-artifact-comparison",

package/dist/application/JavaScriptApplicationEvidence.js

@@ -0,0 +1,26 @@
+import { createEvidence, } from "../domain/evidence.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { JAVASCRIPT_APPLICATION_PROVIDER } from "./InvestigationProviders.js";
+/** Create Evidence v2 for one deterministic local JavaScript application graph. */
+export const createJavaScriptApplicationEvidence = (input, result) => createEvidence({
+    path: result.input_path,
+    sha256: result.root_artifact_sha256,
+    format: result.format,
+}, JAVASCRIPT_APPLICATION_PROVIDER, {
+    predicateType: "rea.javascript-application-analysis/v1",
+    operation: "analyze_javascript_application",
+    parameters: parameters(input),
+    result: jsonValueSchema.parse(result),
+    rawResult: null,
+    confidence: "derived",
+    authority: "shipped-artifact",
+    environment: null,
+    limitations: result.limitations,
+    locations: [{ kind: "artifact-path", path: "artifact-root" }],
+});
+const parameters = (input) => ({
+    format: input.format,
+    approved: input.approved,
+    source_map_read_approved: input.source_map_read_approved,
+    limits: input.limits,
+});

package/dist/application/JavaScriptApplicationEvidenceGraph.js

@@ -0,0 +1,89 @@
+import { JAVASCRIPT_APPLICATION_PROVIDER, JAVASCRIPT_RUNTIME_RECONCILIATION_PROVIDER, MANAGED_WORKFLOW_PROVIDER, } from "./InvestigationProviders.js";
+import { parseEvidence } from "../domain/evidence.js";
+import { analyzeJavaScriptApplicationInputSchema, javascriptApplicationAnalysisResultSchema, } from "../domain/javascriptApplicationAnalysis.js";
+import { javascriptRuntimeReconciliationResultSchema } from "../domain/javascriptRuntimeReconciliationSchemas.js";
+import { managedApplicationGraphResultSchema } from "../domain/managedApplicationGraph.js";
+/** Parse and authenticate one REA-produced JavaScript Application Graph Evidence. */
+export const parseApplicationGraphEvidence = (input) => {
+    const evidence = parseEvidence(input);
+    if (evidence.operation === "analyze_javascript_application" &&
+        evidence.predicate_type === "rea.javascript-application-analysis/v1" &&
+        providerMatches(evidence, JAVASCRIPT_APPLICATION_PROVIDER))
+        return staticApplicationSource(evidence);
+    if (evidence.operation === "reconcile_javascript_runtime" &&
+        evidence.predicate_type === "rea.javascript-runtime-reconciliation/v1" &&
+        providerMatches(evidence, JAVASCRIPT_RUNTIME_RECONCILIATION_PROVIDER))
+        return staticRuntimeSource(evidence);
+    if (evidence.operation === "project_managed_application_graph" &&
+        evidence.predicate_type === "rea.managed-application-graph/v1" &&
+        providerMatches(evidence, MANAGED_WORKFLOW_PROVIDER))
+        return managedApplicationSource(evidence);
+    throw new TypeError("Application workflow requires authenticated analyze_javascript_application, reconcile_javascript_runtime, or project_managed_application_graph Evidence");
+};
+const staticApplicationSource = (evidence) => {
+    if (evidence.authority !== "shipped-artifact" ||
+        evidence.confidence !== "derived")
+        throw new TypeError("JavaScript application Evidence authority or confidence is invalid");
+    const result = javascriptApplicationAnalysisResultSchema.parse(evidence.normalized_result);
+    analyzeJavaScriptApplicationInputSchema.parse({
+        input_path: result.input_path,
+        ...evidence.parameters,
+    });
+    assertApplicationSubject(evidence, result);
+    return {
+        evidence,
+        graph: result.graph,
+        kind: "static-application",
+        rootArtifactSha256: result.root_artifact_sha256,
+    };
+};
+const staticRuntimeSource = (evidence) => {
+    if (evidence.authority !== "analyst-inference" ||
+        evidence.confidence !== "inferred")
+        throw new TypeError("JavaScript runtime reconciliation Evidence authority or confidence is invalid");
+    const result = javascriptRuntimeReconciliationResultSchema.parse(evidence.normalized_result);
+    if (result.evidence_links.some((evidenceId) => !evidence.evidence_links.includes(evidenceId)))
+        throw new TypeError("Runtime reconciliation result references Evidence outside its envelope");
+    const applicationLayer = result.static_layers.find(({ role }) => role === "application");
+    if (applicationLayer === undefined)
+        throw new TypeError("Runtime reconciliation application layer is missing");
+    return {
+        evidence,
+        graph: result.graph,
+        kind: "static-runtime-reconciliation",
+        rootArtifactSha256: applicationLayer.root_artifact_sha256,
+    };
+};
+const managedApplicationSource = (evidence) => {
+    if (evidence.authority !== "analyst-inference" ||
+        evidence.confidence !== "inferred")
+        throw new TypeError("Managed application graph Evidence authority or confidence is invalid");
+    const result = managedApplicationGraphResultSchema.parse(evidence.normalized_result);
+    if (result.evidence_links.some((evidenceId) => !evidence.evidence_links.includes(evidenceId)))
+        throw new TypeError("Managed application graph result references Evidence outside its envelope");
+    return {
+        evidence,
+        graph: result.graph,
+        kind: "managed-application",
+        rootArtifactSha256: result.root_artifact_sha256,
+    };
+};
+const assertApplicationSubject = (evidence, result) => {
+    if (evidence.subject === null ||
+        evidence.subject.digest.sha256 !== result.root_artifact_sha256 ||
+        evidence.subject.format !== result.format)
+        throw new TypeError("JavaScript application Evidence subject does not match its result");
+};
+const providerMatches = (evidence, provider) => evidence.provider.id === provider.id &&
+    evidence.provider.name === provider.name &&
+    evidence.provider.version === provider.version;
+/** Parse unique, artifact-bound Evidence that may extend a native handoff. */
+export const parseNativeApplicationEvidence = (inputs) => {
+    const parsed = inputs.map((input) => parseEvidence(input));
+    if (parsed.some(({ subject }) => subject === null))
+        throw new TypeError("Native handoff Evidence requires an artifact subject");
+    const ids = parsed.map(({ evidence_id: id }) => id);
+    if (new Set(ids).size !== ids.length)
+        throw new TypeError("Native handoff Evidence must be unique");
+    return parsed;
+};

package/dist/application/JavaScriptApplicationService.js

@@ -0,0 +1,74 @@
+import { z } from "zod";
+import { ArtifactReaderFailure } from "../artifacts/ArtifactReader.js";
+import { analyzeJavaScriptApplicationInputSchema, javascriptApplicationAnalysisResultSchema, } from "../domain/javascriptApplicationAnalysis.js";
+import { AnalysisCapabilityUnavailableError, AnalysisInputError, AnalysisProtocolError, ArtifactOperationError, PermissionRequiredError, } from "../domain/errors.js";
+import { err, ok } from "../domain/result.js";
+import { createJavaScriptApplicationEvidence } from "./JavaScriptApplicationEvidence.js";
+import { reconstructJavaScriptArtifact } from "./JavaScriptArtifactReconstruction.js";
+const OPERATION = "analyze_javascript_application";
+/** Authorize and statically analyze one local JavaScript/Electron application. */
+export const analyzeJavaScriptApplication = async (authority, rawInput, options = {}) => {
+    const parsed = analyzeJavaScriptApplicationInputSchema.safeParse(rawInput);
+    if (!parsed.success)
+        return err(new AnalysisInputError(OPERATION));
+    return analyzeJavaScriptApplicationValidated(authority, parsed.data, options);
+};
+/** Analyze input already parsed by a trusted adapter boundary. */
+export const analyzeJavaScriptApplicationValidated = async (authority, input, options = {}) => {
+    if (authority === undefined)
+        return err(new AnalysisCapabilityUnavailableError("rea-javascript-application", OPERATION, "JavaScript application permission policy is not configured"));
+    const authorized = await authority.authorize({
+        capability: "investigation_input",
+        roots: [input.input_path],
+        executables: [],
+        environment_names: [],
+        network: "none",
+        mount: false,
+        operation_identity: `${OPERATION}:${input.input_path}`,
+    }, "read");
+    if (!authorized.ok)
+        return err(authorized.error instanceof PermissionRequiredError
+            ? authorized.error
+            : new ArtifactOperationError(OPERATION, "path", {
+                logicalPath: input.input_path,
+                declaredSha256: null,
+                calculatedSha256: null,
+                unpacked: false,
+            }));
+    await options.progress?.report({
+        phase: "analyze_javascript_application",
+        completed: 0,
+        total: 1,
+        message: "Inventorying and parsing approved application artifacts",
+    });
+    try {
+        const reconstructed = await reconstructJavaScriptArtifact({
+            input_path: input.input_path,
+            format: input.format,
+            source_map_read_approved: input.source_map_read_approved,
+            limits: input.limits,
+        }, options.signal);
+        const { electron_summary: summary, ...application } = reconstructed;
+        const result = javascriptApplicationAnalysisResultSchema.parse({
+            schema_version: 1,
+            ...application,
+            summary,
+            limitations: reconstructed.graph.limitations,
+        });
+        await options.progress?.report({
+            phase: "analyze_javascript_application",
+            completed: 1,
+            total: 1,
+            message: "Application graph and Electron boundaries reconstructed",
+            terminal: true,
+        });
+        return ok(createJavaScriptApplicationEvidence(input, result));
+    }
+    catch (cause) {
+        if (cause instanceof ArtifactReaderFailure)
+            return err(new ArtifactOperationError(OPERATION, cause.reason, cause.details));
+        if (cause instanceof z.ZodError)
+            return err(new AnalysisProtocolError("JavaScript application analysis produced an invalid result", { cause }));
+        return err(new ArtifactOperationError(OPERATION, "io"));
+    }
+};

package/dist/application/JavaScriptApplicationWorkflowEvidence.js

@@ -0,0 +1,29 @@
+import { createEvidence, } from "../domain/evidence.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { JAVASCRIPT_APPLICATION_WORKFLOW_PROVIDER } from "./InvestigationProviders.js";
+/** Create derived Evidence for one bounded application-graph feature trace. */
+export const createApplicationFeatureTraceEvidence = (parameters, result) => createEvidence(undefined, JAVASCRIPT_APPLICATION_WORKFLOW_PROVIDER, {
+    predicateType: "rea.application-feature-trace/v1",
+    operation: "trace_application_feature",
+    parameters,
+    result: jsonValueSchema.parse(result),
+    rawResult: null,
+    confidence: "inferred",
+    authority: "analyst-inference",
+    environment: null,
+    limitations: result.limitations,
+    evidenceLinks: result.evidence_links,
+});
+/** Create derived Evidence for one tiered application version comparison. */
+export const createApplicationVersionComparisonEvidence = (parameters, result) => createEvidence(undefined, JAVASCRIPT_APPLICATION_WORKFLOW_PROVIDER, {
+    predicateType: "rea.application-version-comparison/v1",
+    operation: "compare_application_versions",
+    parameters,
+    result: jsonValueSchema.parse(result),
+    rawResult: null,
+    confidence: "inferred",
+    authority: "analyst-inference",
+    environment: null,
+    limitations: result.limitations,
+    evidenceLinks: result.evidence_links,
+});

package/dist/application/JavaScriptApplicationWorkflowService.js

@@ -0,0 +1,90 @@
+import { z } from "zod";
+import { AnalysisInputError, AnalysisProtocolError, } from "../domain/errors.js";
+import { projectInputIssues } from "../domain/inputIssueProjection.js";
+import { compareJavaScriptApplicationVersions } from "../domain/javascriptApplicationVersionComparison.js";
+import { compareApplicationVersionsInputSchema } from "../domain/javascriptApplicationVersionComparisonSchemas.js";
+import { traceApplicationFeature } from "../domain/javascriptFeatureTrace.js";
+import { traceApplicationFeatureInputSchema } from "../domain/javascriptFeatureTraceSchemas.js";
+import { err, ok } from "../domain/result.js";
+import { parseApplicationGraphEvidence, parseNativeApplicationEvidence, } from "./JavaScriptApplicationEvidenceGraph.js";
+import { createApplicationFeatureTraceEvidence, createApplicationVersionComparisonEvidence, } from "./JavaScriptApplicationWorkflowEvidence.js";
+/** Authenticate Evidence and derive one bounded cross-layer feature trace. */
+export const traceApplicationFeatureEvidence = (rawInput) => {
+    const operation = "trace_application_feature";
+    const parsed = traceApplicationFeatureInputSchema.safeParse(rawInput);
+    if (!parsed.success)
+        return err(new AnalysisInputError(operation, undefined, projectInputIssues(parsed.error.issues, rawInput)));
+    return traceApplicationFeatureEvidenceValidated(parsed.data);
+};
+/** Derive one feature trace from input parsed by a trusted adapter. */
+export const traceApplicationFeatureEvidenceValidated = (input) => {
+    const operation = "trace_application_feature";
+    try {
+        const source = parseApplicationGraphEvidence(input.application);
+        const nativeEvidence = parseNativeApplicationEvidence(input.native_observations);
+        const result = traceApplicationFeature({
+            sourceEvidenceId: source.evidence.evidence_id,
+            graph: source.graph,
+            nativeEvidence,
+            seed: input.seed,
+            direction: input.direction,
+            limits: input.limits,
+        });
+        return ok(createApplicationFeatureTraceEvidence({
+            application_evidence_id: source.evidence.evidence_id,
+            native_evidence_ids: nativeEvidence.map(({ evidence_id: id }) => id),
+            seed: input.seed,
+            direction: input.direction,
+            limits: input.limits,
+        }, result));
+    }
+    catch (cause) {
+        return workflowFailure(operation, cause);
+    }
+};
+/** Authenticate both graphs and derive a tiered cross-version change graph. */
+export const compareApplicationVersionsEvidence = (rawInput) => {
+    const operation = "compare_application_versions";
+    const parsed = compareApplicationVersionsInputSchema.safeParse(rawInput);
+    if (!parsed.success)
+        return err(new AnalysisInputError(operation, undefined, projectInputIssues(parsed.error.issues, rawInput)));
+    return compareApplicationVersionsEvidenceValidated(parsed.data);
+};
+/** Compare versions from input parsed by a trusted adapter. */
+export const compareApplicationVersionsEvidenceValidated = (input) => {
+    const operation = "compare_application_versions";
+    try {
+        const left = parseApplicationGraphEvidence(input.left);
+        const right = parseApplicationGraphEvidence(input.right);
+        const leftNative = parseNativeApplicationEvidence(input.left_native_observations);
+        const rightNative = parseNativeApplicationEvidence(input.right_native_observations);
+        const result = compareJavaScriptApplicationVersions({
+            left: {
+                evidenceId: left.evidence.evidence_id,
+                rootArtifactSha256: left.rootArtifactSha256,
+                graph: left.graph,
+            },
+            right: {
+                evidenceId: right.evidence.evidence_id,
+                rootArtifactSha256: right.rootArtifactSha256,
+                graph: right.graph,
+            },
+            leftNativeEvidence: leftNative,
+            rightNativeEvidence: rightNative,
+            limits: input.limits,
+        });
+        return ok(createApplicationVersionComparisonEvidence({
+            left_evidence_id: left.evidence.evidence_id,
+            right_evidence_id: right.evidence.evidence_id,
+            left_native_evidence_ids: leftNative.map(({ evidence_id: id }) => id),
+            right_native_evidence_ids: rightNative.map(({ evidence_id: id }) => id),
+            limits: input.limits,
+        }, result));
+    }
+    catch (cause) {
+        return workflowFailure(operation, cause);
+    }
+};
+const workflowFailure = (operation, cause) => err(cause instanceof z.ZodError || cause instanceof TypeError
+    ? new AnalysisInputError(operation)
+    : new AnalysisProtocolError("JavaScript application workflow produced an invalid result", { cause }));

package/dist/application/JavaScriptArtifactAnalysis.js

@@ -0,0 +1,305 @@
+import { createHash } from "node:crypto";
+import { analyzeJavaScriptStaticSource } from "../domain/javascriptStaticAnalysis.js";
+/** Analyze selected text files under one shared AST, finding, module, and time budget. */
+export const analyzeJavaScriptArtifactFiles = (fileSet, input, now) => {
+    const state = emptyArtifactAnalysis();
+    const context = {
+        state,
+        input,
+        deadline: now() + input.limits.max_parse_milliseconds,
+        now,
+    };
+    for (const file of fileSet.files)
+        analyzeArtifactFile(file, context);
+    return finalizeArtifactAnalysis(state, input);
+};
+const finalizeArtifactAnalysis = (state, input) => {
+    const omittedHtmlFindings = Math.max(0, state.htmlScripts.length + state.findings - input.limits.max_findings);
+    const findings = Math.min(input.limits.max_findings, state.findings + state.htmlScripts.length);
+    const sourceMapTruncations = state.sourceMaps.filter(({ status }) => status === "truncated").length;
+    const truncatedScopes = state.truncatedScopes +
+        sourceMapTruncations +
+        (omittedHtmlFindings > 0 ? 1 : 0);
+    return {
+        files: state.files,
+        packages: state.packages,
+        html_scripts: state.htmlScripts.slice(0, input.limits.max_findings),
+        source_maps: state.sourceMaps,
+        visited_ast_nodes: state.visitedNodes,
+        findings,
+        modules: state.modules,
+        parse_failures: state.parseFailures,
+        truncated_scopes: truncatedScopes,
+        limitations: [
+            "JavaScript and HTML were parsed as inert text; bundle bootstrap code was never executed.",
+            "Static paths and relationships may remain unresolved when expressions are dynamic or obfuscated.",
+            ...(input.source_map_read_approved
+                ? []
+                : [
+                    "Source maps were inventoried but their contents were not read without separate approval.",
+                ]),
+            ...(truncatedScopes === 0
+                ? []
+                : ["One or more static-analysis scopes reached an approved bound."]),
+        ],
+    };
+};
+const analyzeArtifactFile = (file, context) => {
+    const { state, input } = context;
+    if (file.kind === "package-json")
+        state.packages.push(parsePackage(file));
+    if (file.kind === "html" && file.text.included)
+        state.htmlScripts.push(...parseHtmlScripts(file.path, file.text.value, Math.max(0, input.limits.max_findings - state.findings)));
+    if (file.kind === "source-map")
+        addSourceMap(file, context);
+    if (file.kind !== "javascript" || !file.text.included) {
+        state.files.push({ file, javascript: null });
+        return;
+    }
+    const remainingNodes = input.limits.max_ast_nodes - state.visitedNodes;
+    const remainingFindings = input.limits.max_findings - state.findings;
+    const remainingModules = input.limits.max_modules - state.modules;
+    if (remainingNodes <= 0 ||
+        remainingFindings <= 0 ||
+        remainingModules <= 0 ||
+        context.now() > context.deadline) {
+        state.files.push({ file, javascript: null });
+        state.truncatedScopes += 1;
+        return;
+    }
+    const analysis = analyzeJavaScriptStaticSource(file.text.value, {
+        maxAstNodes: remainingNodes,
+        maxFindings: remainingFindings,
+        maxModules: remainingModules,
+        deadline: context.deadline,
+        now: context.now,
+    });
+    state.files.push({ file, javascript: analysis });
+    state.visitedNodes += analysis.visited_ast_nodes;
+    state.findings += findingCount(analysis);
+    state.modules += analysis.bundler_registrations.reduce((count, registration) => count + registration.modules.length, 0);
+    if (analysis.parse_status === "failed")
+        state.parseFailures += 1;
+    if (analysis.parse_status === "truncated")
+        state.truncatedScopes += 1;
+};
+const addSourceMap = (file, context) => {
+    const sourceMap = parseSourceMap(file, {
+        deadline: context.deadline,
+        now: context.now,
+        maximumSources: Math.max(0, context.input.limits.max_source_map_sources -
+            context.state.sourceMapSources),
+    });
+    context.state.sourceMaps.push(sourceMap);
+    context.state.sourceMapSources += sourceMap.sources.length;
+};
+const emptyArtifactAnalysis = () => ({
+    files: [],
+    packages: [],
+    htmlScripts: [],
+    sourceMaps: [],
+    visitedNodes: 0,
+    findings: 0,
+    modules: 0,
+    parseFailures: 0,
+    truncatedScopes: 0,
+    sourceMapSources: 0,
+});
+const parsePackage = (file) => {
+    if (!file.text.included)
+        return unavailablePackage(file, "Package metadata text was unavailable.");
+    let value;
+    try {
+        value = JSON.parse(file.text.value);
+    }
+    catch {
+        return invalidPackage(file, "package.json is not valid JSON.");
+    }
+    if (!isRecord(value))
+        return invalidPackage(file, "package.json root is not an object.");
+    return {
+        path: file.path,
+        sha256: file.sha256,
+        status: "included",
+        name: boundedString(value.name),
+        version: boundedString(value.version),
+        main: boundedString(value.main),
+        renderer: boundedString(value.renderer) ??
+            boundedString(value.browser) ??
+            boundedString(value.module),
+        limitation: null,
+    };
+};
+const invalidPackage = (file, limitation) => ({
+    ...unavailablePackage(file, limitation),
+    status: "invalid",
+});
+const unavailablePackage = (file, limitation) => ({
+    path: file.path,
+    sha256: file.sha256,
+    status: "unavailable",
+    name: null,
+    version: null,
+    main: null,
+    renderer: null,
+    limitation,
+});
+const parseHtmlScripts = (path, text, maximum) => {
+    const scripts = [];
+    const pattern = /<script\b[^>]*\bsrc\s*=\s*(["'])([^"']+)\1[^>]*>/giu;
+    for (const match of text.matchAll(pattern)) {
+        const script = match[2]?.slice(0, 4_096);
+        if (script === undefined || scripts.length >= maximum)
+            break;
+        const start = match.index;
+        scripts.push({
+            html_path: path,
+            script_path: script,
+            location: rangeForOffsets(text, start, start + match[0].length),
+        });
+    }
+    return scripts;
+};
+const parseSourceMap = (file, context) => {
+    if (!file.text.included)
+        return unavailableSourceMap(file);
+    if (context.now() > context.deadline)
+        return truncatedSourceMap(file, null, "Parse deadline reached before source-map decoding.");
+    let value;
+    try {
+        value = JSON.parse(file.text.value);
+    }
+    catch {
+        return invalidSourceMap(file, "Source map is not valid JSON.");
+    }
+    if (context.now() > context.deadline)
+        return truncatedSourceMap(file, null, "Parse deadline elapsed during source-map decoding.");
+    const maps = flattenSourceMaps(value, 10_000);
+    if (maps === undefined)
+        return invalidSourceMap(file, "Source map is not a bounded version 3 map.");
+    return collectSourceMapOriginals(file, maps, context);
+};
+const collectSourceMapOriginals = (file, maps, context) => {
+    const sources = [];
+    let total = 0;
+    for (const map of maps) {
+        const names = map.sources;
+        if (!Array.isArray(names))
+            return invalidSourceMap(file, "Source map has no sources array.");
+        const contents = Array.isArray(map.sourcesContent)
+            ? map.sourcesContent
+            : [];
+        const root = typeof map.sourceRoot === "string" ? map.sourceRoot : "";
+        for (const [index, raw] of names.entries()) {
+            if (total % 1_024 === 0 && context.now() > context.deadline)
+                return {
+                    path: file.path,
+                    sha256: file.sha256,
+                    status: "truncated",
+                    sources,
+                    omitted_sources: null,
+                    limitation: "Parse deadline elapsed during source-map traversal.",
+                };
+            if (typeof raw !== "string")
+                return invalidSourceMap(file, "Source map contains a non-string source name.");
+            total += 1;
+            if (sources.length >= context.maximumSources)
+                continue;
+            const content = typeof contents[index] === "string" ? contents[index] : null;
+            sources.push({
+                source: resolveSourceName(root, raw),
+                content,
+                content_sha256: content === null ? null : sha256(content),
+            });
+        }
+    }
+    const omitted = total - sources.length;
+    return {
+        path: file.path,
+        sha256: file.sha256,
+        status: omitted === 0 ? "included" : "truncated",
+        sources,
+        omitted_sources: omitted,
+        limitation: omitted === 0
+            ? null
+            : "Original-source inventory reached the approved source-map limit.",
+    };
+};
+const unavailableSourceMap = (file) => {
+    if (file.text.included)
+        throw new TypeError("Expected unavailable source-map text");
+    const notApproved = file.text.reason === "not-approved";
+    return {
+        path: file.path,
+        sha256: file.sha256,
+        status: notApproved ? "not-approved" : "invalid",
+        sources: [],
+        omitted_sources: 0,
+        limitation: notApproved
+            ? "Source-map content requires separate approval."
+            : "Source-map text was unavailable within approved limits.",
+    };
+};
+const flattenSourceMaps = (root, maximum) => {
+    if (!isRecord(root) || root.version !== 3)
+        return undefined;
+    const maps = [];
+    const pending = [root];
+    while (pending.length > 0) {
+        const map = pending.pop();
+        if (map === undefined || map.version !== 3)
+            return undefined;
+        if (Array.isArray(map.sections)) {
+            if (pending.length + maps.length + map.sections.length > maximum)
+                return undefined;
+            for (const section of map.sections) {
+                if (!isRecord(section) || !isRecord(section.map))
+                    return undefined;
+                pending.push(section.map);
+            }
+        }
+        else
+            maps.push(map);
+    }
+    return maps;
+};
+const truncatedSourceMap = (file, omitted, limitation) => ({
+    path: file.path,
+    sha256: file.sha256,
+    status: "truncated",
+    sources: [],
+    omitted_sources: omitted,
+    limitation,
+});
+const invalidSourceMap = (file, limitation) => ({
+    path: file.path,
+    sha256: file.sha256,
+    status: "invalid",
+    sources: [],
+    omitted_sources: 0,
+    limitation,
+});
+const findingCount = (analysis) => analysis.references.length +
+    analysis.endpoints.length +
+    analysis.storage.length +
+    analysis.role_paths.length +
+    analysis.source_map_urls.length +
+    analysis.bundler_registrations.length +
+    analysis.electron.browser_windows.length +
+    analysis.electron.context_bridge_apis.length +
+    analysis.electron.ipc.length +
+    analysis.electron.sender_validations.length +
+    analysis.electron.utility_processes.length +
+    analysis.electron.native_addon_bindings.length;
+const rangeForOffsets = (text, start, end) => ({
+    start: pointForOffset(text, start),
+    end: pointForOffset(text, end),
+});
+const pointForOffset = (text, offset) => {
+    const lines = text.slice(0, offset).split("\n");
+    return { line: lines.length, column: lines.at(-1)?.length ?? 0 };
+};
+const resolveSourceName = (root, source) => `${root}${root !== "" && !root.endsWith("/") ? "/" : ""}${source}`.slice(0, 4_096);
+const boundedString = (value) => typeof value === "string" && value.length > 0 ? value.slice(0, 4_096) : null;
+const sha256 = (value) => createHash("sha256").update(value).digest("hex");
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);

package/dist/application/JavaScriptArtifactAnalysisTypes.js

@@ -0,0 +1 @@
+export {};