rea-agents 1.7.0 → 2.0.0

package/dist/domain/electronStaticAnalysisNative.js

@@ -0,0 +1,164 @@
+import * as t from "@babel/types";
+import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
+import { argumentNode, calleeName, compareCodePoints, propertyName, range, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
+const MAX_NATIVE_MEMBERS = 64;
+/** Inspect JavaScript-side imports and re-exports of native .node addons. */
+export const inspectElectronNativeNode = (node, context) => {
+    if (t.isImportDeclaration(node))
+        inspectImport(node, context);
+    else if (t.isExportNamedDeclaration(node))
+        inspectNamedExport(node, context);
+    else if (t.isExportAllDeclaration(node))
+        inspectExportAll(node, context);
+    else if (t.isVariableDeclarator(node))
+        inspectRequireBinding(node, context);
+    else if (t.isAssignmentExpression(node))
+        inspectReExport(node, context);
+};
+const inspectImport = (node, context) => {
+    if (!isNativeSpecifier(node.source.value))
+        return;
+    const members = node.specifiers.map((specifier) => {
+        if (t.isImportDefaultSpecifier(specifier))
+            return "default";
+        if (t.isImportNamespaceSpecifier(specifier))
+            return "*";
+        return propertyName(specifier.imported) || "[dynamic-import]";
+    });
+    addBinding({
+        context,
+        node,
+        specifier: node.source.value,
+        kind: "import",
+        members,
+    });
+};
+const inspectNamedExport = (node, context) => {
+    if (node.source === null ||
+        node.source === undefined ||
+        !isNativeSpecifier(node.source.value))
+        return;
+    const members = node.specifiers.map((specifier) => {
+        if (t.isExportSpecifier(specifier))
+            return propertyName(specifier.local);
+        return "*";
+    });
+    addBinding({
+        context,
+        node,
+        specifier: node.source.value,
+        kind: "re-export",
+        members,
+    });
+};
+const inspectExportAll = (node, context) => {
+    if (node.source === undefined || !isNativeSpecifier(node.source.value))
+        return;
+    addBinding({
+        context,
+        node,
+        specifier: node.source.value,
+        kind: "re-export",
+        members: ["*"],
+    });
+};
+const inspectRequireBinding = (node, context) => {
+    const required = nativeRequire(node.init);
+    if (required === undefined)
+        return;
+    addBinding({
+        context,
+        node,
+        specifier: required.specifier,
+        kind: "require",
+        members: required.member === null ? bindingMembers(node.id) : [required.member],
+    });
+};
+const inspectReExport = (node, context) => {
+    const required = nativeRequire(node.right);
+    if (required === undefined || !isModuleExport(node.left))
+        return;
+    addBinding({
+        context,
+        node,
+        specifier: required.specifier,
+        kind: "re-export",
+        members: [required.member ?? exportedMember(node.left) ?? "*"],
+    });
+};
+const addBinding = (input) => {
+    const { context, node, specifier, kind } = input;
+    const unique = [
+        ...new Set(input.members.filter((member) => member !== "")),
+    ].sort(compareCodePoints);
+    const members = (unique.length === 0 ? ["*"] : unique).slice(0, MAX_NATIVE_MEMBERS);
+    const omitted = Math.max(0, unique.length - MAX_NATIVE_MEMBERS);
+    if (omitted > 0) {
+        context.accumulator.structuralTruncation = true;
+        context.accumulator.droppedFindings += omitted;
+    }
+    addLocatedFinding(context, {
+        collection: context.accumulator.nativeAddonBindings,
+        key: `native-addon-binding\0${kind}\0${specifier}\0${members.join("\0")}`,
+        node,
+        value: {
+            specifier,
+            binding_kind: kind,
+            members,
+            members_truncated: omitted > 0,
+            module_key: null,
+            location: range(node),
+        },
+    });
+};
+const nativeRequire = (node) => {
+    if (t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) {
+        const nested = t.isNode(node.object)
+            ? nativeRequire(node.object)
+            : undefined;
+        if (nested === undefined)
+            return undefined;
+        const member = propertyName(node.property);
+        return { ...nested, member: member === "" ? nested.member : member };
+    }
+    if (!t.isCallExpression(node))
+        return undefined;
+    const name = calleeName(node.callee);
+    if (name !== "require" &&
+        !name.endsWith(".require") &&
+        !name.includes("__webpack_require__"))
+        return undefined;
+    const specifier = stringValue(argumentNode(node.arguments[0]));
+    return specifier !== undefined && isNativeSpecifier(specifier)
+        ? { specifier, member: null }
+        : undefined;
+};
+const bindingMembers = (pattern) => {
+    if (t.isIdentifier(pattern))
+        return ["*"];
+    if (!t.isObjectPattern(pattern))
+        return ["*"];
+    return pattern.properties.map((property) => {
+        if (t.isRestElement(property))
+            return "*";
+        return propertyName(property.key) || "[dynamic-import]";
+    });
+};
+const isModuleExport = (node) => {
+    const name = calleeName(node);
+    return (name === "module.exports" ||
+        name.startsWith("module.exports.") ||
+        name.startsWith("exports."));
+};
+const exportedMember = (node) => {
+    const name = calleeName(node);
+    if (name.startsWith("module.exports."))
+        return name.slice("module.exports.".length);
+    if (name.startsWith("exports."))
+        return name.slice("exports.".length);
+    return undefined;
+};
+const isNativeSpecifier = (specifier) => {
+    const path = specifier.split("#", 1)[0]?.split("?", 1)[0] ?? "";
+    return path.toLowerCase().endsWith(".node");
+};

package/dist/domain/electronStaticAnalysisTypes.js

@@ -0,0 +1 @@
+export {};

package/dist/domain/electronStaticAnalysisValues.js

@@ -0,0 +1,103 @@
+import * as t from "@babel/types";
+import { compareCodePoints, propertyName, sourceSlice, } from "./javascriptStaticAnalysisHelpers.js";
+const MAX_EXPRESSION_CHARACTERS = 4_096;
+/** Preserve one literal value or the exact bounded inert expression. */
+export const electronStaticValue = (source, node) => {
+    const literal = literalValue(node);
+    return literal.found
+        ? { status: "literal", value: literal.value, expression: null }
+        : {
+            status: "dynamic",
+            value: null,
+            expression: boundedExpression(source, node),
+        };
+};
+/** Return an actionable bounded expression without evaluating it. */
+export const boundedExpression = (source, node) => {
+    if (node === null || node === undefined)
+        return "[missing-expression]";
+    const expression = sourceSlice(source, node).trim();
+    return (expression === "" ? `[${node.type}]` : expression).slice(0, MAX_EXPRESSION_CHARACTERS);
+};
+/** Read one named object property without following spreads or bindings. */
+export const objectProperty = (object, name) => object.properties.find((property) => t.isObjectProperty(property) && propertyName(property.key) === name);
+/** Classify a handler argument while retaining its exact source range. */
+export const handlerKind = (node) => {
+    if (node === null || node === undefined)
+        return "missing";
+    if (t.isArrowFunctionExpression(node) ||
+        t.isFunctionExpression(node) ||
+        t.isFunctionDeclaration(node))
+        return "inline-function";
+    if (t.isIdentifier(node))
+        return "identifier";
+    if (t.isMemberExpression(node) || t.isOptionalMemberExpression(node))
+        return "member-expression";
+    return "dynamic-expression";
+};
+/** Collect bounded dotted keys from one literal contextBridge API object. */
+export const collectContextBridgeMembers = (node, maximum = 128) => {
+    if (node === null || node === undefined)
+        return {
+            status: "missing",
+            members: [],
+            unknown: 0,
+            omitted: 0,
+        };
+    if (!t.isObjectExpression(node))
+        return {
+            status: "dynamic",
+            members: [],
+            unknown: 1,
+            omitted: 0,
+        };
+    const state = { members: [], unknown: 0 };
+    collectMembersAt(node, "", 0, state);
+    const members = [...new Set(state.members)].sort(compareCodePoints);
+    return {
+        status: "object-literal",
+        members: members.slice(0, maximum),
+        unknown: state.unknown,
+        omitted: Math.max(0, members.length - maximum),
+    };
+};
+const collectMembersAt = (object, prefix, depth, state) => {
+    if (depth >= 8) {
+        state.unknown += 1;
+        return;
+    }
+    for (const property of object.properties) {
+        if (t.isSpreadElement(property)) {
+            state.unknown += 1;
+            continue;
+        }
+        const name = propertyName(property.key);
+        if (name === "" || property.computed) {
+            state.unknown += 1;
+            continue;
+        }
+        const path = (prefix === "" ? name : `${prefix}.${name}`).slice(0, MAX_EXPRESSION_CHARACTERS);
+        state.members.push(path);
+        if (t.isObjectProperty(property) && t.isObjectExpression(property.value))
+            collectMembersAt(property.value, path, depth + 1, state);
+    }
+};
+const literalValue = (node) => {
+    if (t.isStringLiteral(node) || t.isNumericLiteral(node))
+        return { found: true, value: node.value };
+    if (t.isBooleanLiteral(node))
+        return { found: true, value: node.value };
+    if (t.isNullLiteral(node))
+        return { found: true, value: null };
+    if (t.isTemplateLiteral(node) && node.expressions.length === 0)
+        return {
+            found: true,
+            value: (node.quasis[0]?.value.cooked ??
+                node.quasis[0]?.value.raw ??
+                "").slice(0, MAX_EXPRESSION_CHARACTERS),
+        };
+    if (t.isUnaryExpression(node, { operator: "-" }) &&
+        t.isNumericLiteral(node.argument))
+        return { found: true, value: -node.argument.value };
+    return { found: false };
+};

package/dist/domain/errors.js

@@ -28,6 +28,7 @@ const ANALYSIS_ERROR_TAGS = [
     "NoBinaryOpenError",
     "BinaryTargetError",
     "PermissionRequiredError",
+    "ReplayPlanStaleError",
 ];
 /** Base class for expected analysis, provider, and session failures. */
 export class AnalysisError extends Error {
@@ -46,10 +47,12 @@ export class AnalysisProtocolError extends AnalysisError {
 /** Caller input failed provider-neutral application parsing. */
 export class AnalysisInputError extends AnalysisError {
     operation;
+    issues;
     _tag = "AnalysisInputError";
-    constructor(operation, options) {
+    constructor(operation, options, issues = []) {
         super(`Invalid analysis input for ${operation}`, options);
         this.operation = operation;
+        this.issues = issues;
     }
 }
 /** Provider output failed provider-neutral application parsing. */
@@ -196,6 +199,20 @@ export class ArtifactOperationError extends AnalysisError {
 export class EvidenceIntegrityError extends AnalysisError {
     _tag = "EvidenceIntegrityError";
 }
+/** A session Evidence reference is missing or has the wrong semantic identity. */
+export class EvidenceReferenceError extends EvidenceIntegrityError {
+    evidenceId;
+    reason;
+    expected;
+    actual;
+    constructor(evidenceId, reason, expected, actual) {
+        super(`Evidence reference ${reason}: ${evidenceId}`);
+        this.evidenceId = evidenceId;
+        this.reason = reason;
+        this.expected = expected;
+        this.actual = actual;
+    }
+}
 /** A bounded evidence ledger cannot accept more records or serialized bytes. */
 export class EvidenceLimitError extends AnalysisError {
     limit;
@@ -329,6 +346,17 @@ export class PermissionRequiredError extends AnalysisError {
         this.restartRequired = restartRequired;
     }
 }
+/** Approved replay commitment no longer matches the immediately rebuilt plan. */
+export class ReplayPlanStaleError extends AnalysisError {
+    approvedDigest;
+    actualDigest;
+    _tag = "ReplayPlanStaleError";
+    constructor(approvedDigest, actualDigest) {
+        super("Controlled replay plan changed before execution");
+        this.approvedDigest = approvedDigest;
+        this.actualDigest = actualDigest;
+    }
+}
 /** Project expected failures into exhaustive, secret-safe caller fields. */
 export const projectAnalysisError = (error) => {
     assertKnownTag(error._tag);
@@ -350,6 +378,8 @@ export const projectAnalysisError = (error) => {
     };
 };
 const errorCode = (error) => {
+    if (error instanceof ReplayPlanStaleError)
+        return "plan_stale";
     if (error instanceof PermissionRequiredError)
         return "permission_required";
     if (error instanceof ProviderSelectionError &&
@@ -453,9 +483,35 @@ const errorCode = (error) => {
         case "UnknownRegistryError":
         case "PermissionRequiredError":
             throw new TypeError("Unhandled specialized analysis error");
+        case "ReplayPlanStaleError":
+            throw new TypeError("Unhandled specialized replay error");
     }
 };
 const errorDetails = (error) => {
+    if (error instanceof AnalysisInputError && error.issues.length > 0)
+        return {
+            operation: error.operation,
+            issues: error.issues.map((issue) => ({
+                path: [...issue.path],
+                reason: issue.reason,
+                ...(issue.expected === undefined ? {} : { expected: issue.expected }),
+                ...(issue.minimum === undefined ? {} : { minimum: issue.minimum }),
+                ...(issue.maximum === undefined ? {} : { maximum: issue.maximum }),
+            })),
+        };
+    if (error instanceof EvidenceReferenceError)
+        return {
+            evidence_id: error.evidenceId,
+            reason: error.reason,
+            expected: error.expected,
+            actual: error.actual,
+        };
+    if (error instanceof ReplayPlanStaleError)
+        return {
+            approved_plan_digest: error.approvedDigest,
+            actual_plan_digest: error.actualDigest,
+            application_code_admitted: false,
+        };
     if (error instanceof PermissionRequiredError)
         return {
             capability: error.requested.capability,
@@ -555,12 +611,17 @@ const missingScopeDetails = (scope) => ({
     ...(scope.mount === undefined ? {} : { mount: scope.mount }),
 });
 const RETRYABLE_CODES = new Set([
+    "invalid_request",
     "provider_timeout",
     "cancelled",
     "revision_conflict",
     "provider_unavailable",
 ]);
 const remediationAction = (error) => {
+    if (error instanceof AnalysisInputError)
+        return "Correct the listed arguments and retry.";
+    if (error instanceof ReplayPlanStaleError)
+        return "Review the rebuilt replay plan and explicitly approve its new digest.";
     if (error instanceof PermissionRequiredError)
         return error.elicitationSupported
             ? "Approve the exact missing scope, then retry the operation."
@@ -568,6 +629,8 @@ const remediationAction = (error) => {
     return userMessage(error);
 };
 const errorCategory = (error) => {
+    if (error instanceof ReplayPlanStaleError)
+        return "integrity_mismatch";
     if (error instanceof PermissionRequiredError)
         return "permission_required";
     if (error instanceof ProviderSelectionError &&
@@ -632,6 +695,8 @@ const STATIC_ERROR_CATEGORIES = {
     BinaryTargetError: "unavailable",
 };
 const userMessage = (error) => {
+    if (error instanceof ReplayPlanStaleError)
+        return "The controlled replay plan changed before execution. Refresh the current state and try again.";
     if (error instanceof PermissionRequiredError)
         return "This operation needs additional local permission. Review the requested scope and remediation.";
     if (error instanceof AnalysisInputError)
@@ -770,6 +835,7 @@ const KNOWN_ERROR_TAGS = {
     NoBinaryOpenError: true,
     BinaryTargetError: true,
     PermissionRequiredError: true,
+    ReplayPlanStaleError: true,
 };
 const assertKnownTag = (tag) => {
     if (KNOWN_ERROR_TAGS[tag] !== true)

package/dist/domain/functionComparisonSchemas.js

@@ -1,9 +1,4 @@
 import { z } from "zod";
-import { evidenceSchema } from "./evidence.js";
-const evidenceInput = z.union([
-    evidenceSchema,
-    z.array(evidenceSchema).min(1).max(100),
-]);
 const comparisonStatusSchema = z.enum([
     "unchanged",
     "added",
@@ -25,9 +20,9 @@ const dimensionNameSchema = z.enum([
 const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
 const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
 /** Strict bounded input for explicit function-to-function comparison. */
-export const functionComparisonInputSchema = z.object({
-    left: evidenceInput,
-    right: evidenceInput,
+export const functionComparisonInputSchema = z.strictObject({
+    left_evidence_ids: z.array(evidenceIdSchema).min(1).max(100),
+    right_evidence_ids: z.array(evidenceIdSchema).min(1).max(100),
     offset: z.number().int().min(0).default(0),
     limit: z.number().int().min(1).max(100).default(100),
     unknown_registry_approved: z.literal(true).optional(),

package/dist/domain/inputIssueProjection.js

@@ -0,0 +1,52 @@
+/** Project Zod failures to secret-safe caller correction metadata. */
+export const projectInputIssues = (issues, input) => issues.flatMap((issue) => projectIssue(issue, input));
+const projectIssue = (issue, input) => {
+    const path = issue.path.flatMap((part) => typeof part === "string" || typeof part === "number" ? [part] : []);
+    if (issue.code === "unrecognized_keys")
+        return issue.keys.map((key) => ({
+            path: [...path, key],
+            reason: "unknown_argument",
+        }));
+    if (issue.code === "invalid_type")
+        return [
+            {
+                path,
+                reason: valueAtPath(input, path) === undefined
+                    ? "missing_argument"
+                    : "invalid_type",
+                expected: safeExpected(issue.expected),
+            },
+        ];
+    if (issue.code === "too_small")
+        return [boundedIssue(path, "minimum", numericBound(issue.minimum))];
+    if (issue.code === "too_big")
+        return [boundedIssue(path, "maximum", numericBound(issue.maximum))];
+    if (issue.code === "invalid_format")
+        return [{ path, reason: "invalid_format", expected: issue.format }];
+    if (issue.code === "invalid_value")
+        return [
+            {
+                path,
+                reason: "invalid_value",
+                expected: issue.values.filter(isSafeExpected),
+            },
+        ];
+    return [{ path, reason: "invalid_value" }];
+};
+const valueAtPath = (input, path) => {
+    let current = input;
+    for (const part of path) {
+        if (typeof current !== "object" || current === null)
+            return undefined;
+        current = current[part];
+    }
+    return current;
+};
+const numericBound = (value) => typeof value === "number" && Number.isFinite(value) ? value : undefined;
+const isSafeExpected = (value) => value === null || ["string", "number", "boolean"].includes(typeof value);
+const safeExpected = (value) => isSafeExpected(value) ? value : "schema-defined value";
+const boundedIssue = (path, key, value) => ({
+    path,
+    reason: "out_of_range",
+    ...(value === undefined ? {} : { [key]: value }),
+});

package/dist/domain/javascriptApplicationAnalysis.js

@@ -0,0 +1,155 @@
+import { isAbsolute } from "node:path";
+import { z } from "zod";
+import { javascriptApplicationGraphSchema } from "./javascriptApplicationGraph.js";
+const MAX_GRAPH_NODES = 100_000;
+const MAX_GRAPH_EDGES = 200_000;
+const countSchema = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
+const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+/** Default hard bounds for one local JavaScript application analysis. */
+export const JAVASCRIPT_APPLICATION_ANALYSIS_DEFAULT_LIMITS = {
+    max_entries: 8_000,
+    max_total_artifact_bytes: 512 * 1_024 * 1_024,
+    max_artifact_entry_bytes: 128 * 1_024 * 1_024,
+    max_compression_ratio: 1_000,
+    max_depth: 64,
+    max_path_bytes: 4_096,
+    max_text_files: 5_000,
+    max_total_text_bytes: 128 * 1_024 * 1_024,
+    max_text_file_bytes: 8 * 1_024 * 1_024,
+    max_ast_nodes: 2_000_000,
+    max_findings: 8_000,
+    max_modules: 20_000,
+    max_source_map_sources: 5_000,
+    max_parse_milliseconds: 30_000,
+};
+/** Combined artifact, text, AST, and graph projection bounds. */
+export const javascriptApplicationAnalysisLimitsSchema = z
+    .strictObject({
+    max_entries: z.number().int().min(1).max(1_000_000).default(8_000),
+    max_total_artifact_bytes: z
+        .number()
+        .int()
+        .min(1)
+        .max(Number.MAX_SAFE_INTEGER)
+        .default(512 * 1_024 * 1_024),
+    max_artifact_entry_bytes: z
+        .number()
+        .int()
+        .min(1)
+        .max(Number.MAX_SAFE_INTEGER)
+        .default(128 * 1_024 * 1_024),
+    max_compression_ratio: z.number().min(1).max(100_000).default(1_000),
+    max_depth: z.number().int().min(1).max(100).default(64),
+    max_path_bytes: z.number().int().min(1).max(65_535).default(4_096),
+    max_text_files: z.number().int().min(1).max(100_000).default(5_000),
+    max_total_text_bytes: z
+        .number()
+        .int()
+        .min(1)
+        .max(512 * 1_024 * 1_024)
+        .default(128 * 1_024 * 1_024),
+    max_text_file_bytes: z
+        .number()
+        .int()
+        .min(1)
+        .max(64 * 1_024 * 1_024)
+        .default(8 * 1_024 * 1_024),
+    max_ast_nodes: z.number().int().min(1).max(20_000_000).default(2_000_000),
+    max_findings: z.number().int().min(1).max(200_000).default(8_000),
+    max_modules: z.number().int().min(1).max(100_000).default(20_000),
+    max_source_map_sources: z.number().int().min(1).max(100_000).default(5_000),
+    max_parse_milliseconds: z
+        .number()
+        .int()
+        .min(1)
+        .max(300_000)
+        .default(30_000),
+})
+    .superRefine((limits, context) => {
+    const projectedNodes = 7 * limits.max_entries +
+        2 * limits.max_findings +
+        limits.max_modules +
+        limits.max_source_map_sources +
+        1;
+    if (projectedNodes > MAX_GRAPH_NODES)
+        context.addIssue({
+            code: "custom",
+            path: ["max_entries"],
+            message: "Combined application-analysis limits can exceed the 100000-node graph contract",
+        });
+    const projectedEdges = 9 * limits.max_entries +
+        6 * limits.max_findings +
+        limits.max_modules +
+        limits.max_source_map_sources;
+    if (projectedEdges > MAX_GRAPH_EDGES)
+        context.addIssue({
+            code: "custom",
+            path: ["max_entries"],
+            message: "Combined application-analysis limits can exceed the 200000-edge graph contract",
+        });
+});
+/** Public target-free request for bounded static JavaScript application analysis. */
+export const analyzeJavaScriptApplicationInputSchema = z.strictObject({
+    input_path: z
+        .string()
+        .min(1)
+        .max(16_384)
+        .refine(isAbsolute, "JavaScript application input path must be absolute"),
+    format: z.enum(["auto", "asar", "directory"]).default("auto"),
+    approved: z.literal(true),
+    source_map_read_approved: z.boolean().default(false),
+    limits: javascriptApplicationAnalysisLimitsSchema.default(JAVASCRIPT_APPLICATION_ANALYSIS_DEFAULT_LIMITS),
+});
+/** Compact counts for the high-level Electron architecture/security surface. */
+const electronBoundarySummarySchema = z.strictObject({
+    browser_windows: countSchema,
+    explicit_web_preferences: countSchema,
+    preload_entrypoints: countSchema,
+    context_bridge_apis: countSchema,
+    exposed_api_members: countSchema,
+    ipc: z.strictObject({
+        operations: countSchema,
+        literal_channels: countSchema,
+        dynamic_channel_operations: countSchema,
+        renderer_transmissions: countSchema,
+        renderer_listeners: countSchema,
+        main_handlers: countSchema,
+        paired_renderer_transmissions: countSchema,
+        ambiguous_renderer_transmissions: countSchema,
+        unpaired_literal_renderer_transmissions: countSchema,
+    }),
+    sender_validation_observations: countSchema,
+    utility_processes: countSchema,
+    resolved_utility_entrypoints: countSchema,
+    native_addon_bindings: countSchema,
+    resolved_native_addon_bindings: countSchema,
+});
+const reconstructionStatisticsSchema = z.strictObject({
+    relevant_files: countSchema,
+    nested_asar_containers: countSchema,
+    text_files_selected: countSchema,
+    text_bytes_read: countSchema,
+    omitted_text_files: countSchema,
+    limit_omitted_text_files: countSchema,
+    policy_filtered_text_files: countSchema,
+    invalid_utf8_files: countSchema,
+    parsed_javascript_files: countSchema,
+    visited_ast_nodes: countSchema,
+    findings: countSchema,
+    modules: countSchema,
+    parse_failures: countSchema,
+    truncated_scopes: countSchema,
+});
+/** Strict high-level result returned inside Evidence v2. */
+export const javascriptApplicationAnalysisResultSchema = z.strictObject({
+    schema_version: z.literal(1),
+    input_path: z.string().min(1).max(16_384),
+    format: z.enum(["asar", "directory"]),
+    root_artifact_sha256: digestSchema,
+    inventory_manifest_id: z.string().regex(/^agm_[a-f0-9]{64}$/u),
+    inventory_graph_sha256: digestSchema,
+    graph: javascriptApplicationGraphSchema,
+    summary: electronBoundarySummarySchema,
+    statistics: reconstructionStatisticsSchema,
+    limitations: z.array(z.string().min(1).max(4_096)).max(1_000),
+});