rea-agents 1.7.0 → 2.0.0

package/dist/application/JavaScriptApplicationEvidence.js

@@ -0,0 +1,26 @@
+import { createEvidence, } from "../domain/evidence.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { JAVASCRIPT_APPLICATION_PROVIDER } from "./InvestigationProviders.js";
+/** Create Evidence v2 for one deterministic local JavaScript application graph. */
+export const createJavaScriptApplicationEvidence = (input, result) => createEvidence({
+    path: result.input_path,
+    sha256: result.root_artifact_sha256,
+    format: result.format,
+}, JAVASCRIPT_APPLICATION_PROVIDER, {
+    predicateType: "rea.javascript-application-analysis/v1",
+    operation: "analyze_javascript_application",
+    parameters: parameters(input),
+    result: jsonValueSchema.parse(result),
+    rawResult: null,
+    confidence: "derived",
+    authority: "shipped-artifact",
+    environment: null,
+    limitations: result.limitations,
+    locations: [{ kind: "artifact-path", path: "artifact-root" }],
+});
+const parameters = (input) => ({
+    format: input.format,
+    approved: input.approved,
+    source_map_read_approved: input.source_map_read_approved,
+    limits: input.limits,
+});

package/dist/application/JavaScriptApplicationEvidenceGraph.js

@@ -0,0 +1,89 @@
+import { JAVASCRIPT_APPLICATION_PROVIDER, JAVASCRIPT_RUNTIME_RECONCILIATION_PROVIDER, MANAGED_WORKFLOW_PROVIDER, } from "./InvestigationProviders.js";
+import { parseEvidence } from "../domain/evidence.js";
+import { analyzeJavaScriptApplicationInputSchema, javascriptApplicationAnalysisResultSchema, } from "../domain/javascriptApplicationAnalysis.js";
+import { javascriptRuntimeReconciliationResultSchema } from "../domain/javascriptRuntimeReconciliationSchemas.js";
+import { managedApplicationGraphResultSchema } from "../domain/managedApplicationGraph.js";
+/** Parse and authenticate one REA-produced JavaScript Application Graph Evidence. */
+export const parseApplicationGraphEvidence = (input) => {
+    const evidence = parseEvidence(input);
+    if (evidence.operation === "analyze_javascript_application" &&
+        evidence.predicate_type === "rea.javascript-application-analysis/v1" &&
+        providerMatches(evidence, JAVASCRIPT_APPLICATION_PROVIDER))
+        return staticApplicationSource(evidence);
+    if (evidence.operation === "reconcile_javascript_runtime" &&
+        evidence.predicate_type === "rea.javascript-runtime-reconciliation/v1" &&
+        providerMatches(evidence, JAVASCRIPT_RUNTIME_RECONCILIATION_PROVIDER))
+        return staticRuntimeSource(evidence);
+    if (evidence.operation === "project_managed_application_graph" &&
+        evidence.predicate_type === "rea.managed-application-graph/v1" &&
+        providerMatches(evidence, MANAGED_WORKFLOW_PROVIDER))
+        return managedApplicationSource(evidence);
+    throw new TypeError("Application workflow requires authenticated analyze_javascript_application, reconcile_javascript_runtime, or project_managed_application_graph Evidence");
+};
+const staticApplicationSource = (evidence) => {
+    if (evidence.authority !== "shipped-artifact" ||
+        evidence.confidence !== "derived")
+        throw new TypeError("JavaScript application Evidence authority or confidence is invalid");
+    const result = javascriptApplicationAnalysisResultSchema.parse(evidence.normalized_result);
+    analyzeJavaScriptApplicationInputSchema.parse({
+        input_path: result.input_path,
+        ...evidence.parameters,
+    });
+    assertApplicationSubject(evidence, result);
+    return {
+        evidence,
+        graph: result.graph,
+        kind: "static-application",
+        rootArtifactSha256: result.root_artifact_sha256,
+    };
+};
+const staticRuntimeSource = (evidence) => {
+    if (evidence.authority !== "analyst-inference" ||
+        evidence.confidence !== "inferred")
+        throw new TypeError("JavaScript runtime reconciliation Evidence authority or confidence is invalid");
+    const result = javascriptRuntimeReconciliationResultSchema.parse(evidence.normalized_result);
+    if (result.evidence_links.some((evidenceId) => !evidence.evidence_links.includes(evidenceId)))
+        throw new TypeError("Runtime reconciliation result references Evidence outside its envelope");
+    const applicationLayer = result.static_layers.find(({ role }) => role === "application");
+    if (applicationLayer === undefined)
+        throw new TypeError("Runtime reconciliation application layer is missing");
+    return {
+        evidence,
+        graph: result.graph,
+        kind: "static-runtime-reconciliation",
+        rootArtifactSha256: applicationLayer.root_artifact_sha256,
+    };
+};
+const managedApplicationSource = (evidence) => {
+    if (evidence.authority !== "analyst-inference" ||
+        evidence.confidence !== "inferred")
+        throw new TypeError("Managed application graph Evidence authority or confidence is invalid");
+    const result = managedApplicationGraphResultSchema.parse(evidence.normalized_result);
+    if (result.evidence_links.some((evidenceId) => !evidence.evidence_links.includes(evidenceId)))
+        throw new TypeError("Managed application graph result references Evidence outside its envelope");
+    return {
+        evidence,
+        graph: result.graph,
+        kind: "managed-application",
+        rootArtifactSha256: result.root_artifact_sha256,
+    };
+};
+const assertApplicationSubject = (evidence, result) => {
+    if (evidence.subject === null ||
+        evidence.subject.digest.sha256 !== result.root_artifact_sha256 ||
+        evidence.subject.format !== result.format)
+        throw new TypeError("JavaScript application Evidence subject does not match its result");
+};
+const providerMatches = (evidence, provider) => evidence.provider.id === provider.id &&
+    evidence.provider.name === provider.name &&
+    evidence.provider.version === provider.version;
+/** Parse unique, artifact-bound Evidence that may extend a native handoff. */
+export const parseNativeApplicationEvidence = (inputs) => {
+    const parsed = inputs.map((input) => parseEvidence(input));
+    if (parsed.some(({ subject }) => subject === null))
+        throw new TypeError("Native handoff Evidence requires an artifact subject");
+    const ids = parsed.map(({ evidence_id: id }) => id);
+    if (new Set(ids).size !== ids.length)
+        throw new TypeError("Native handoff Evidence must be unique");
+    return parsed;
+};

package/dist/application/JavaScriptApplicationService.js

@@ -0,0 +1,74 @@
+import { z } from "zod";
+import { ArtifactReaderFailure } from "../artifacts/ArtifactReader.js";
+import { analyzeJavaScriptApplicationInputSchema, javascriptApplicationAnalysisResultSchema, } from "../domain/javascriptApplicationAnalysis.js";
+import { AnalysisCapabilityUnavailableError, AnalysisInputError, AnalysisProtocolError, ArtifactOperationError, PermissionRequiredError, } from "../domain/errors.js";
+import { err, ok } from "../domain/result.js";
+import { createJavaScriptApplicationEvidence } from "./JavaScriptApplicationEvidence.js";
+import { reconstructJavaScriptArtifact } from "./JavaScriptArtifactReconstruction.js";
+const OPERATION = "analyze_javascript_application";
+/** Authorize and statically analyze one local JavaScript/Electron application. */
+export const analyzeJavaScriptApplication = async (authority, rawInput, options = {}) => {
+    const parsed = analyzeJavaScriptApplicationInputSchema.safeParse(rawInput);
+    if (!parsed.success)
+        return err(new AnalysisInputError(OPERATION));
+    return analyzeJavaScriptApplicationValidated(authority, parsed.data, options);
+};
+/** Analyze input already parsed by a trusted adapter boundary. */
+export const analyzeJavaScriptApplicationValidated = async (authority, input, options = {}) => {
+    if (authority === undefined)
+        return err(new AnalysisCapabilityUnavailableError("rea-javascript-application", OPERATION, "JavaScript application permission policy is not configured"));
+    const authorized = await authority.authorize({
+        capability: "investigation_input",
+        roots: [input.input_path],
+        executables: [],
+        environment_names: [],
+        network: "none",
+        mount: false,
+        operation_identity: `${OPERATION}:${input.input_path}`,
+    }, "read");
+    if (!authorized.ok)
+        return err(authorized.error instanceof PermissionRequiredError
+            ? authorized.error
+            : new ArtifactOperationError(OPERATION, "path", {
+                logicalPath: input.input_path,
+                declaredSha256: null,
+                calculatedSha256: null,
+                unpacked: false,
+            }));
+    await options.progress?.report({
+        phase: "analyze_javascript_application",
+        completed: 0,
+        total: 1,
+        message: "Inventorying and parsing approved application artifacts",
+    });
+    try {
+        const reconstructed = await reconstructJavaScriptArtifact({
+            input_path: input.input_path,
+            format: input.format,
+            source_map_read_approved: input.source_map_read_approved,
+            limits: input.limits,
+        }, options.signal);
+        const { electron_summary: summary, ...application } = reconstructed;
+        const result = javascriptApplicationAnalysisResultSchema.parse({
+            schema_version: 1,
+            ...application,
+            summary,
+            limitations: reconstructed.graph.limitations,
+        });
+        await options.progress?.report({
+            phase: "analyze_javascript_application",
+            completed: 1,
+            total: 1,
+            message: "Application graph and Electron boundaries reconstructed",
+            terminal: true,
+        });
+        return ok(createJavaScriptApplicationEvidence(input, result));
+    }
+    catch (cause) {
+        if (cause instanceof ArtifactReaderFailure)
+            return err(new ArtifactOperationError(OPERATION, cause.reason, cause.details));
+        if (cause instanceof z.ZodError)
+            return err(new AnalysisProtocolError("JavaScript application analysis produced an invalid result", { cause }));
+        return err(new ArtifactOperationError(OPERATION, "io"));
+    }
+};

package/dist/application/JavaScriptApplicationWorkflowEvidence.js

@@ -0,0 +1,29 @@
+import { createEvidence, } from "../domain/evidence.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { JAVASCRIPT_APPLICATION_WORKFLOW_PROVIDER } from "./InvestigationProviders.js";
+/** Create derived Evidence for one bounded application-graph feature trace. */
+export const createApplicationFeatureTraceEvidence = (parameters, result) => createEvidence(undefined, JAVASCRIPT_APPLICATION_WORKFLOW_PROVIDER, {
+    predicateType: "rea.application-feature-trace/v1",
+    operation: "trace_application_feature",
+    parameters,
+    result: jsonValueSchema.parse(result),
+    rawResult: null,
+    confidence: "inferred",
+    authority: "analyst-inference",
+    environment: null,
+    limitations: result.limitations,
+    evidenceLinks: result.evidence_links,
+});
+/** Create derived Evidence for one tiered application version comparison. */
+export const createApplicationVersionComparisonEvidence = (parameters, result) => createEvidence(undefined, JAVASCRIPT_APPLICATION_WORKFLOW_PROVIDER, {
+    predicateType: "rea.application-version-comparison/v1",
+    operation: "compare_application_versions",
+    parameters,
+    result: jsonValueSchema.parse(result),
+    rawResult: null,
+    confidence: "inferred",
+    authority: "analyst-inference",
+    environment: null,
+    limitations: result.limitations,
+    evidenceLinks: result.evidence_links,
+});

package/dist/application/JavaScriptApplicationWorkflowService.js

@@ -0,0 +1,90 @@
+import { z } from "zod";
+import { AnalysisInputError, AnalysisProtocolError, } from "../domain/errors.js";
+import { projectInputIssues } from "../domain/inputIssueProjection.js";
+import { compareJavaScriptApplicationVersions } from "../domain/javascriptApplicationVersionComparison.js";
+import { compareApplicationVersionsInputSchema } from "../domain/javascriptApplicationVersionComparisonSchemas.js";
+import { traceApplicationFeature } from "../domain/javascriptFeatureTrace.js";
+import { traceApplicationFeatureInputSchema } from "../domain/javascriptFeatureTraceSchemas.js";
+import { err, ok } from "../domain/result.js";
+import { parseApplicationGraphEvidence, parseNativeApplicationEvidence, } from "./JavaScriptApplicationEvidenceGraph.js";
+import { createApplicationFeatureTraceEvidence, createApplicationVersionComparisonEvidence, } from "./JavaScriptApplicationWorkflowEvidence.js";
+/** Authenticate Evidence and derive one bounded cross-layer feature trace. */
+export const traceApplicationFeatureEvidence = (rawInput) => {
+    const operation = "trace_application_feature";
+    const parsed = traceApplicationFeatureInputSchema.safeParse(rawInput);
+    if (!parsed.success)
+        return err(new AnalysisInputError(operation, undefined, projectInputIssues(parsed.error.issues, rawInput)));
+    return traceApplicationFeatureEvidenceValidated(parsed.data);
+};
+/** Derive one feature trace from input parsed by a trusted adapter. */
+export const traceApplicationFeatureEvidenceValidated = (input) => {
+    const operation = "trace_application_feature";
+    try {
+        const source = parseApplicationGraphEvidence(input.application);
+        const nativeEvidence = parseNativeApplicationEvidence(input.native_observations);
+        const result = traceApplicationFeature({
+            sourceEvidenceId: source.evidence.evidence_id,
+            graph: source.graph,
+            nativeEvidence,
+            seed: input.seed,
+            direction: input.direction,
+            limits: input.limits,
+        });
+        return ok(createApplicationFeatureTraceEvidence({
+            application_evidence_id: source.evidence.evidence_id,
+            native_evidence_ids: nativeEvidence.map(({ evidence_id: id }) => id),
+            seed: input.seed,
+            direction: input.direction,
+            limits: input.limits,
+        }, result));
+    }
+    catch (cause) {
+        return workflowFailure(operation, cause);
+    }
+};
+/** Authenticate both graphs and derive a tiered cross-version change graph. */
+export const compareApplicationVersionsEvidence = (rawInput) => {
+    const operation = "compare_application_versions";
+    const parsed = compareApplicationVersionsInputSchema.safeParse(rawInput);
+    if (!parsed.success)
+        return err(new AnalysisInputError(operation, undefined, projectInputIssues(parsed.error.issues, rawInput)));
+    return compareApplicationVersionsEvidenceValidated(parsed.data);
+};
+/** Compare versions from input parsed by a trusted adapter. */
+export const compareApplicationVersionsEvidenceValidated = (input) => {
+    const operation = "compare_application_versions";
+    try {
+        const left = parseApplicationGraphEvidence(input.left);
+        const right = parseApplicationGraphEvidence(input.right);
+        const leftNative = parseNativeApplicationEvidence(input.left_native_observations);
+        const rightNative = parseNativeApplicationEvidence(input.right_native_observations);
+        const result = compareJavaScriptApplicationVersions({
+            left: {
+                evidenceId: left.evidence.evidence_id,
+                rootArtifactSha256: left.rootArtifactSha256,
+                graph: left.graph,
+            },
+            right: {
+                evidenceId: right.evidence.evidence_id,
+                rootArtifactSha256: right.rootArtifactSha256,
+                graph: right.graph,
+            },
+            leftNativeEvidence: leftNative,
+            rightNativeEvidence: rightNative,
+            limits: input.limits,
+        });
+        return ok(createApplicationVersionComparisonEvidence({
+            left_evidence_id: left.evidence.evidence_id,
+            right_evidence_id: right.evidence.evidence_id,
+            left_native_evidence_ids: leftNative.map(({ evidence_id: id }) => id),
+            right_native_evidence_ids: rightNative.map(({ evidence_id: id }) => id),
+            limits: input.limits,
+        }, result));
+    }
+    catch (cause) {
+        return workflowFailure(operation, cause);
+    }
+};
+const workflowFailure = (operation, cause) => err(cause instanceof z.ZodError || cause instanceof TypeError
+    ? new AnalysisInputError(operation)
+    : new AnalysisProtocolError("JavaScript application workflow produced an invalid result", { cause }));

package/dist/application/JavaScriptArtifactAnalysis.js

@@ -284,7 +284,13 @@ const findingCount = (analysis) => analysis.references.length +
     analysis.storage.length +
     analysis.role_paths.length +
     analysis.source_map_urls.length +
-    analysis.bundler_registrations.length;
+    analysis.bundler_registrations.length +
+    analysis.electron.browser_windows.length +
+    analysis.electron.context_bridge_apis.length +
+    analysis.electron.ipc.length +
+    analysis.electron.sender_validations.length +
+    analysis.electron.utility_processes.length +
+    analysis.electron.native_addon_bindings.length;
 const rangeForOffsets = (text, start, end) => ({
     start: pointForOffset(text, start),
     end: pointForOffset(text, end),

package/dist/application/JavaScriptArtifactGraphBuilder.js

@@ -5,6 +5,8 @@ import { addJavaScriptHtmlRoles, addJavaScriptSourceMapOriginals, } from "./Java
 import { addJavaScriptStaticFindings } from "./JavaScriptArtifactGraphFindings.js";
 import { completeReconstructionCoverage, partialReconstructionCoverage, } from "./JavaScriptArtifactGraphEvidence.js";
 import { addJavaScriptArtifactContainers, addJavaScriptArtifactFiles, addJavaScriptBundlerNodes, addJavaScriptPackageNodes, createJavaScriptArtifactRootNode, } from "./JavaScriptArtifactGraphStructure.js";
+import { addElectronBoundaries } from "./ElectronBoundaryGraph.js";
+import { classifyElectronIpcPairings, collectElectronIpcRecords, } from "./ElectronBoundaryAnalysis.js";
 /** Project bounded artifact and AST facts into JavaScript Application Graph v1. */
 export const buildJavaScriptArtifactGraph = (snapshot, fileSet, analysis, input) => {
     const accumulator = new JavaScriptArtifactGraphAccumulator();
@@ -27,6 +29,7 @@ export const buildJavaScriptArtifactGraph = (snapshot, fileSet, analysis, input)
     const packageRoots = addJavaScriptPackageNodes(context);
     addJavaScriptBundlerNodes(context);
     addJavaScriptStaticFindings(context);
+    addElectronBoundaries(context);
     addJavaScriptHtmlRoles(context);
     addJavaScriptSourceMapOriginals(context);
     const coverage = graphCoverage(context);
@@ -48,10 +51,12 @@ const graphCoverage = (context) => {
     const sourceMapPolicyGap = context.analysis.source_maps.some(({ status }) => status === "not-approved");
     const malformedStructuredData = context.analysis.packages.some(({ status }) => status !== "included") ||
         context.analysis.source_maps.some(({ status }) => status === "invalid");
+    const partialJavaScript = context.analysis.files.some(({ javascript }) => javascript !== null && javascript.parse_status === "partial");
     const unknownGap = context.analysis.parse_failures > 0 ||
         context.fileSet.invalid_utf8_files > 0 ||
         sourceMapPolicyGap ||
-        malformedStructuredData;
+        malformedStructuredData ||
+        partialJavaScript;
     if (context.analysis.truncated_scopes > 0)
         return partialReconstructionCoverage(reconstructionLimits(context.input), null, true);
     if (exactLimitOmissions > 0)
@@ -60,21 +65,59 @@ const graphCoverage = (context) => {
         return partialReconstructionCoverage(reconstructionLimits(context.input), null, false);
     return completeReconstructionCoverage(reconstructionLimits(context.input));
 };
-const graphLimitations = (context, coverage) => [
-    ...context.analysis.limitations,
-    "Webpack/Rspack factories were recovered from AST literals; REA did not invoke push handlers or bundle bootstrap code.",
-    "Static imports, entrypoints, workers, endpoints, and storage relationships do not prove runtime execution.",
-    ...(context.accumulator.omittedObservations() === 0
-        ? []
-        : [
-            "Repeated content identities exceeded the per-node observation bound; containment edges still preserve inventoried paths.",
-        ]),
-    ...(coverage === "complete"
-        ? []
-        : [
-            "Graph coverage is incomplete; unavailable facts remain explicit and must not be read as absence.",
-        ]),
-];
+const graphLimitations = (context, coverage) => {
+    const ipc = collectElectronIpcRecords(context.analysis);
+    const pairings = classifyElectronIpcPairings(ipc);
+    const electronFindings = context.analysis.files.reduce((count, { javascript }) => count +
+        (javascript === null
+            ? 0
+            : javascript.electron.browser_windows.length +
+                javascript.electron.context_bridge_apis.length +
+                javascript.electron.ipc.length +
+                javascript.electron.sender_validations.length +
+                javascript.electron.utility_processes.length +
+                javascript.electron.native_addon_bindings.length), 0);
+    return [
+        ...context.analysis.limitations,
+        "Webpack/Rspack factories were recovered from AST literals; REA did not invoke push handlers or bundle bootstrap code.",
+        "Static imports, entrypoints, workers, endpoints, and storage relationships do not prove runtime execution.",
+        ...(electronFindings === 0
+            ? []
+            : [
+                "Electron relationships are derived from inert syntax; runtime registration, reachability, defaults, and enforcement remain unproven.",
+            ]),
+        ...(ipc.some(({ finding }) => finding.channel === null)
+            ? [
+                "Dynamic IPC channel expressions remain unresolved and are never paired by textual similarity.",
+            ]
+            : []),
+        ...(pairings.some(({ status }) => status === "ambiguous")
+            ? [
+                "Some literal IPC channels have multiple compatible main handlers; ambiguous calls are not paired to any handler.",
+            ]
+            : []),
+        ...(context.analysis.files.some(({ javascript }) => (javascript?.electron.sender_validations.length ?? 0) > 0)
+            ? [
+                "Sender, frame, URL, and origin checks are observations only; REA does not claim that they enforce a complete authorization policy.",
+            ]
+            : []),
+        ...(context.analysis.files.some(({ javascript }) => (javascript?.electron.native_addon_bindings.length ?? 0) > 0)
+            ? [
+                "Native member names are requested by JavaScript syntax and are not verified binary exports in this workflow.",
+            ]
+            : []),
+        ...(context.accumulator.omittedObservations() === 0
+            ? []
+            : [
+                "Repeated content identities exceeded the per-node observation bound; containment edges still preserve inventoried paths.",
+            ]),
+        ...(coverage === "complete"
+            ? []
+            : [
+                "Graph coverage is incomplete; unavailable facts remain explicit and must not be read as absence.",
+            ]),
+    ];
+};
 const reconstructionLimits = (input) => [
     {
         name: "max-entries",

package/dist/application/JavaScriptArtifactGraphEvidence.js

@@ -19,20 +19,30 @@ export const artifactObservationEvidence = (input) => ({
     evidence_ids: [],
 });
 /** Exact AST syntax evidence with an actionable source range. */
-export const astObservationEvidence = (input) => ({
-    authority: "ast-static-analysis",
-    state: "observed",
-    confidence: "exact",
-    artifact: artifactReference(input.sha256),
-    location: {
-        available: true,
-        value: { kind: "source-range", source: input.path, ...input.range },
-    },
-    extractor: { ...EXTRACTOR, operation: input.operation },
-    coverage: input.coverage,
-    limitations: [...(input.limitations ?? [])],
-    evidence_ids: [],
-});
+export const astObservationEvidence = (input) => {
+    const limitations = [
+        ...(input.limitations ?? []),
+        ...(input.coverage.status === "complete"
+            ? []
+            : [
+                "AST coverage is incomplete; omitted or dynamic facts must not be interpreted as absence.",
+            ]),
+    ];
+    return {
+        authority: "ast-static-analysis",
+        state: "observed",
+        confidence: "exact",
+        artifact: artifactReference(input.sha256),
+        location: {
+            available: true,
+            value: { kind: "source-range", source: input.path, ...input.range },
+        },
+        extractor: { ...EXTRACTOR, operation: input.operation },
+        coverage: input.coverage,
+        limitations,
+        evidence_ids: [],
+    };
+};
 /** Explicit static relationship inference; never promoted to observation. */
 export const staticInferenceEvidence = (input) => ({
     authority: "static-relationship-inference",

package/dist/application/JavaScriptArtifactReconstruction.js

@@ -8,6 +8,7 @@ import { readJavaScriptArtifactFiles } from "./JavaScriptArtifactFiles.js";
 import { buildJavaScriptArtifactGraph } from "./JavaScriptArtifactGraphBuilder.js";
 import { artifactLimitsForReconstruction, javascriptArtifactReconstructionInputSchema, } from "./JavaScriptArtifactReconstructionInput.js";
 import { scanCanonicalArtifactInventory } from "./ArtifactInventory.js";
+import { summarizeElectronBoundaries } from "./ElectronBoundaryAnalysis.js";
 /** Reconstruct one local ASAR or extracted directory without executing code. */
 export const reconstructJavaScriptArtifact = async (rawInput, signal) => {
     const input = javascriptArtifactReconstructionInputSchema.parse(rawInput);
@@ -26,9 +27,11 @@ export const reconstructJavaScriptArtifact = async (rawInput, signal) => {
         return {
             input_path: path,
             format,
+            root_artifact_sha256: snapshot.manifest.root_sha256,
             inventory_manifest_id: snapshot.manifest.manifest_id,
             inventory_graph_sha256: snapshot.manifest.graph_sha256,
             graph,
+            electron_summary: summarizeElectronBoundaries(analysis),
             statistics: {
                 relevant_files: files.files.length,
                 nested_asar_containers: files.containers.length,

package/dist/application/JavaScriptArtifactReconstructionInput.js

@@ -1,92 +1,11 @@
 import { z } from "zod";
-const MAX_GRAPH_NODES = 100_000;
-const MAX_GRAPH_EDGES = 200_000;
-const reconstructionLimitsSchema = z
-    .strictObject({
-    max_entries: z.number().int().min(1).max(1_000_000).default(8_000),
-    max_total_artifact_bytes: z
-        .number()
-        .int()
-        .min(1)
-        .max(Number.MAX_SAFE_INTEGER)
-        .default(512 * 1_024 * 1_024),
-    max_artifact_entry_bytes: z
-        .number()
-        .int()
-        .min(1)
-        .max(Number.MAX_SAFE_INTEGER)
-        .default(128 * 1_024 * 1_024),
-    max_compression_ratio: z.number().min(1).max(100_000).default(1_000),
-    max_depth: z.number().int().min(1).max(100).default(64),
-    max_path_bytes: z.number().int().min(1).max(65_535).default(4_096),
-    max_text_files: z.number().int().min(1).max(100_000).default(5_000),
-    max_total_text_bytes: z
-        .number()
-        .int()
-        .min(1)
-        .max(512 * 1_024 * 1_024)
-        .default(128 * 1_024 * 1_024),
-    max_text_file_bytes: z
-        .number()
-        .int()
-        .min(1)
-        .max(64 * 1_024 * 1_024)
-        .default(8 * 1_024 * 1_024),
-    max_ast_nodes: z.number().int().min(1).max(20_000_000).default(2_000_000),
-    max_findings: z.number().int().min(1).max(200_000).default(10_000),
-    max_modules: z.number().int().min(1).max(100_000).default(20_000),
-    max_source_map_sources: z.number().int().min(1).max(100_000).default(5_000),
-    max_parse_milliseconds: z
-        .number()
-        .int()
-        .min(1)
-        .max(300_000)
-        .default(30_000),
-})
-    .superRefine((limits, context) => {
-    const projectedNodes = 7 * limits.max_entries +
-        limits.max_findings +
-        limits.max_modules +
-        limits.max_source_map_sources +
-        1;
-    if (projectedNodes > MAX_GRAPH_NODES)
-        context.addIssue({
-            code: "custom",
-            path: ["max_entries"],
-            message: "Combined reconstruction limits can exceed the 100000-node graph contract",
-        });
-    const projectedEdges = 9 * limits.max_entries +
-        5 * limits.max_findings +
-        limits.max_modules +
-        limits.max_source_map_sources;
-    if (projectedEdges > MAX_GRAPH_EDGES)
-        context.addIssue({
-            code: "custom",
-            path: ["max_entries"],
-            message: "Combined reconstruction limits can exceed the 200000-edge graph contract",
-        });
-});
+import { JAVASCRIPT_APPLICATION_ANALYSIS_DEFAULT_LIMITS, javascriptApplicationAnalysisLimitsSchema, } from "../domain/javascriptApplicationAnalysis.js";
 /** Local ASAR/directory reconstruction request with explicit source-map authority. */
 export const javascriptArtifactReconstructionInputSchema = z.strictObject({
     input_path: z.string().min(1).max(16_384),
     format: z.enum(["auto", "asar", "directory"]).default("auto"),
     source_map_read_approved: z.boolean().default(false),
-    limits: reconstructionLimitsSchema.default({
-        max_entries: 8_000,
-        max_total_artifact_bytes: 512 * 1_024 * 1_024,
-        max_artifact_entry_bytes: 128 * 1_024 * 1_024,
-        max_compression_ratio: 1_000,
-        max_depth: 64,
-        max_path_bytes: 4_096,
-        max_text_files: 5_000,
-        max_total_text_bytes: 128 * 1_024 * 1_024,
-        max_text_file_bytes: 8 * 1_024 * 1_024,
-        max_ast_nodes: 2_000_000,
-        max_findings: 10_000,
-        max_modules: 20_000,
-        max_source_map_sources: 5_000,
-        max_parse_milliseconds: 30_000,
-    }),
+    limits: javascriptApplicationAnalysisLimitsSchema.default(JAVASCRIPT_APPLICATION_ANALYSIS_DEFAULT_LIMITS),
 });
 /** Project reconstruction limits into the shared artifact traversal policy. */
 export const artifactLimitsForReconstruction = (input) => ({