rea-agents 1.7.0 → 2.1.0

package/dist/domain/functionComparison.js

@@ -1,17 +1,9 @@
-import { diffLines } from "diff";
-import { parseFunctionEvidence, } from "./functionDossierEvidence.js";
-import { commentProjection, combineCoverage, functionMatch, identityProjection, isAutoName, normalizeCfg, project, referenceKindProjection, referenceProjection, sorted, stringAndNameProjection, } from "./functionComparisonNormalization.js";
+import { parseFunctionEvidence } from "./functionDossierEvidence.js";
+import { functionMatch } from "./functionComparisonNormalization.js";
 import { functionComparisonResultSchema, } from "./functionComparisonSchemas.js";
-import { canonicalJson, dimensionResult, overallStatus, summarize, unresolvedDimension as buildUnresolvedDimension, } from "./functionComparisonResults.js";
+import { overallStatus, summarize, canonicalJson, } from "./functionComparisonResults.js";
+import { compareDimensions } from "./functionComparisonDimensions.js";
 export { functionComparisonInputSchema, functionComparisonResultSchema, } from "./functionComparisonSchemas.js";
-const unresolvedDimension = (...[dimension, status, links, leftCount, rightCount, limitations]) => buildUnresolvedDimension({
-    dimension,
-    status,
-    links,
-    leftCount,
-    rightCount,
-    limitations,
-});
 /** Compare two explicit function Evidence page sets without fuzzy matching. */
 export const compareFunctions = (leftInput, rightInput, offset, limit) => {
     const left = parseFunctionEvidence(leftInput);
@@ -52,156 +44,3 @@ export const compareFunctions = (leftInput, rightInput, offset, limit) => {
         ].sort((a, b) => a.localeCompare(b)),
     });
 };
-const compareDimensions = (left, right, links, providersDiffer) => [
-    compareIdentity(left, right, links, providersDiffer),
-    compareText("pseudocode", left.pseudocode.text, right.pseudocode.text, left.pseudocode.complete, right.pseudocode.complete, links, providersDiffer),
-    compareText("assembly", left.collections.assembly.items.join("\n"), right.collections.assembly.items.join("\n"), left.collections.assembly.complete, right.collections.assembly.complete, links, providersDiffer, left.collections.assembly.truncated || right.collections.assembly.truncated, "Assembly is opaque provider text; relocation normalization is unavailable."),
-    compareComments(left, right, links, providersDiffer),
-    compareCalls(left, right, links, providersDiffer),
-    compareReferences(left, right, links, providersDiffer),
-    compareStringsAndNames(left, right, links, providersDiffer),
-    compareCfg(left, right, links, providersDiffer),
-];
-const compareText = (...[dimension, left, right, leftComplete, rightComplete, links, providersDiffer, explicitTruncation, limitation,]) => {
-    const truncated = explicitTruncation ?? (!leftComplete || !rightComplete);
-    if (!leftComplete || !rightComplete || providersDiffer)
-        return unresolvedDimension(dimension, truncated ? "truncated" : "unknown", links, left.length, right.length, [
-            ...(limitation === undefined ? [] : [limitation]),
-            ...(providersDiffer
-                ? ["Exact text comparison requires one provider identity."]
-                : []),
-        ]);
-    const changes = diffLines(left, right, {
-        timeout: 100,
-        maxEditLength: 10_000,
-    });
-    if (changes === undefined)
-        return unresolvedDimension(dimension, "unknown", links, left.length, right.length, ["Bounded line diff exceeded its time or edit-distance limit."]);
-    const delta = changes.reduce((summary, change) => ({
-        added_lines: summary.added_lines + (change.added ? (change.count ?? 0) : 0),
-        removed_lines: summary.removed_lines + (change.removed ? (change.count ?? 0) : 0),
-        hunks: summary.hunks + (change.added || change.removed ? 1 : 0),
-    }), { added_lines: 0, removed_lines: 0, hunks: 0 });
-    return dimensionResult({
-        dimension,
-        status: delta.hunks === 0 ? "unchanged" : "changed",
-        left,
-        right,
-        links,
-        providersDiffer,
-        leftCount: [...left].length,
-        rightCount: [...right].length,
-        textDelta: delta,
-        limitations: limitation === undefined ? [] : [limitation],
-    });
-};
-const compareCollections = (...[dimension, left, right, leftCoverage, rightCoverage, links, providersDiffer,]) => {
-    if (!leftCoverage.complete || !rightCoverage.complete)
-        return unresolvedDimension(dimension, leftCoverage.truncated || rightCoverage.truncated
-            ? "truncated"
-            : "unknown", links, left.length, right.length, []);
-    return compareValues(dimension, sorted(left), sorted(right), links, true, true, providersDiffer);
-};
-const compareComments = (left, right, links, providersDiffer) => {
-    const leftValues = commentProjection(left);
-    const rightValues = commentProjection(right);
-    if (leftValues === null || rightValues === null)
-        return unresolvedDimension("comments", "unknown", links, left.collections.comments.items.length, right.collections.comments.items.length, ["Comment locations could not be normalized relative to the function."]);
-    return compareCollections("comments", leftValues, rightValues, left.collections.comments, right.collections.comments, links, providersDiffer);
-};
-const compareStringsAndNames = (left, right, links, providersDiffer) => {
-    const leftValues = stringAndNameProjection(left);
-    const rightValues = stringAndNameProjection(right);
-    if (leftValues === null || rightValues === null)
-        return unresolvedDimension("strings_names", "unknown", links, null, null, [
-            "Reference source locations could not be normalized to function offsets.",
-        ]);
-    return compareCollections("strings_names", leftValues, rightValues, combineCoverage(left.collections.referenced_strings, left.collections.referenced_names), combineCoverage(right.collections.referenced_strings, right.collections.referenced_names), links, providersDiffer);
-};
-const compareReferences = (left, right, links, providersDiffer) => {
-    const leftCoverage = combineCoverage(left.collections.incoming_references, left.collections.outgoing_references);
-    const rightCoverage = combineCoverage(right.collections.incoming_references, right.collections.outgoing_references);
-    if (!leftCoverage.complete || !rightCoverage.complete)
-        return unresolvedDimension("references", leftCoverage.truncated || rightCoverage.truncated
-            ? "truncated"
-            : "unknown", links, leftCoverage.items.length, rightCoverage.items.length, []);
-    const leftProjection = referenceProjection(left);
-    const rightProjection = referenceProjection(right);
-    if (leftProjection.length === 0 && rightProjection.length === 0)
-        return compareValues("references", leftProjection, rightProjection, links, true, true, providersDiffer);
-    if (canonicalJson(leftProjection) !== canonicalJson(rightProjection))
-        return dimensionResult({
-            dimension: "references",
-            status: "changed",
-            left: leftProjection,
-            right: rightProjection,
-            links,
-            providersDiffer,
-            leftCount: leftProjection.length,
-            rightCount: rightProjection.length,
-            textDelta: null,
-            limitations: [
-                "Reference endpoints differ independently of provider reference-kind metadata.",
-            ],
-        });
-    const leftKinds = referenceKindProjection(left);
-    const rightKinds = referenceKindProjection(right);
-    if (leftKinds !== null && rightKinds !== null)
-        return compareValues("references", leftKinds, rightKinds, links, true, true, providersDiffer);
-    return unresolvedDimension("references", "unknown", links, leftProjection.length, rightProjection.length, [
-        "At least one provider did not expose reference kinds, so equal endpoints do not prove equal edge semantics.",
-    ]);
-};
-const compareIdentity = (left, right, links, providersDiffer) => {
-    if (isAutoName(left.procedure.name) || isAutoName(right.procedure.name))
-        return unresolvedDimension("identity", "unknown", links, null, null, [
-            "Address-derived function names are not stable cross-version identity.",
-        ]);
-    return compareValues("identity", identityProjection(left), identityProjection(right), links, true, true, providersDiffer);
-};
-const compareCalls = (left, right, links, providersDiffer) => {
-    const leftValues = callProjection(left);
-    const rightValues = callProjection(right);
-    if ([...leftValues, ...rightValues].some(({ name }) => isAutoName(name)))
-        return unresolvedDimension("calls", "unknown", links, leftValues.length, rightValues.length, ["Address-derived callee or caller names cannot be matched safely."]);
-    return compareCollections("calls", leftValues, rightValues, combineCoverage(left.collections.callers, left.collections.callees), combineCoverage(right.collections.callers, right.collections.callees), links, providersDiffer);
-};
-const callProjection = (snapshot) => [
-    ...project(snapshot.collections.callers, ({ name }) => ({
-        direction: "in",
-        name,
-    })),
-    ...project(snapshot.collections.callees, ({ name }) => ({
-        direction: "out",
-        name,
-    })),
-];
-const compareCfg = (left, right, links, providersDiffer) => {
-    const leftBlocks = left.collections.basic_blocks;
-    const rightBlocks = right.collections.basic_blocks;
-    if (!leftBlocks.complete || !rightBlocks.complete)
-        return unresolvedDimension("cfg", leftBlocks.truncated || rightBlocks.truncated ? "truncated" : "unknown", links, leftBlocks.items.length, rightBlocks.items.length, []);
-    const leftGraph = normalizeCfg(leftBlocks.items);
-    const rightGraph = normalizeCfg(rightBlocks.items);
-    if (leftGraph === null || rightGraph === null)
-        return unresolvedDimension("cfg", "unknown", links, leftBlocks.items.length, rightBlocks.items.length, ["CFG addresses could not be normalized to local block indices."]);
-    return compareValues("cfg", leftGraph, rightGraph, links, true, true, providersDiffer);
-};
-const compareValues = (...[dimension, left, right, links, leftComplete, rightComplete, providersDiffer,]) => {
-    if (!leftComplete || !rightComplete)
-        return unresolvedDimension(dimension, "unknown", links, null, null, []);
-    const leftJson = canonicalJson(left);
-    const rightJson = canonicalJson(right);
-    return dimensionResult({
-        dimension,
-        status: leftJson === rightJson ? "unchanged" : "changed",
-        left,
-        right,
-        links,
-        providersDiffer,
-        leftCount: Array.isArray(left) ? left.length : null,
-        rightCount: Array.isArray(right) ? right.length : null,
-        textDelta: null,
-        limitations: [],
-    });
-};

package/dist/domain/functionComparisonDimensions.js

@@ -0,0 +1,164 @@
+import { diffLines } from "diff";
+import { commentProjection, combineCoverage, identityProjection, isAutoName, normalizeCfg, project, referenceKindProjection, referenceProjection, sorted, stringAndNameProjection, } from "./functionComparisonNormalization.js";
+import { canonicalJson, dimensionResult, unresolvedDimension as buildUnresolvedDimension, } from "./functionComparisonResults.js";
+const unresolvedDimension = (...[dimension, status, links, leftCount, rightCount, limitations]) => buildUnresolvedDimension({
+    dimension,
+    status,
+    links,
+    leftCount,
+    rightCount,
+    limitations,
+});
+export const compareDimensions = (left, right, links, providersDiffer) => [
+    compareIdentity(left, right, links, providersDiffer),
+    compareText("pseudocode", left.pseudocode.text, right.pseudocode.text, left.pseudocode.complete, right.pseudocode.complete, links, providersDiffer),
+    compareText("assembly", left.collections.assembly.items.join("\n"), right.collections.assembly.items.join("\n"), left.collections.assembly.complete, right.collections.assembly.complete, links, providersDiffer, left.collections.assembly.truncated || right.collections.assembly.truncated, "Assembly is opaque provider text; relocation normalization is unavailable."),
+    compareComments(left, right, links, providersDiffer),
+    compareCalls(left, right, links, providersDiffer),
+    compareReferences(left, right, links, providersDiffer),
+    compareStringsAndNames(left, right, links, providersDiffer),
+    compareCfg(left, right, links, providersDiffer),
+];
+const compareText = (...[dimension, left, right, leftComplete, rightComplete, links, providersDiffer, explicitTruncation, limitation,]) => {
+    const truncated = explicitTruncation ?? (!leftComplete || !rightComplete);
+    if (!leftComplete || !rightComplete || providersDiffer)
+        return unresolvedDimension(dimension, truncated ? "truncated" : "unknown", links, left.length, right.length, [
+            ...(limitation === undefined ? [] : [limitation]),
+            ...(providersDiffer
+                ? ["Exact text comparison requires one provider identity."]
+                : []),
+        ]);
+    const changes = diffLines(left, right, {
+        timeout: 100,
+        maxEditLength: 10_000,
+    });
+    if (changes === undefined)
+        return unresolvedDimension(dimension, "unknown", links, left.length, right.length, ["Bounded line diff exceeded its time or edit-distance limit."]);
+    const delta = changes.reduce((summary, change) => ({
+        added_lines: summary.added_lines + (change.added ? (change.count ?? 0) : 0),
+        removed_lines: summary.removed_lines + (change.removed ? (change.count ?? 0) : 0),
+        hunks: summary.hunks + (change.added || change.removed ? 1 : 0),
+    }), { added_lines: 0, removed_lines: 0, hunks: 0 });
+    return dimensionResult({
+        dimension,
+        status: delta.hunks === 0 ? "unchanged" : "changed",
+        left,
+        right,
+        links,
+        providersDiffer,
+        leftCount: [...left].length,
+        rightCount: [...right].length,
+        textDelta: delta,
+        limitations: limitation === undefined ? [] : [limitation],
+    });
+};
+const compareCollections = (...[dimension, left, right, leftCoverage, rightCoverage, links, providersDiffer,]) => {
+    if (!leftCoverage.complete || !rightCoverage.complete)
+        return unresolvedDimension(dimension, leftCoverage.truncated || rightCoverage.truncated
+            ? "truncated"
+            : "unknown", links, left.length, right.length, []);
+    return compareValues(dimension, sorted(left), sorted(right), links, true, true, providersDiffer);
+};
+const compareComments = (left, right, links, providersDiffer) => {
+    const leftValues = commentProjection(left);
+    const rightValues = commentProjection(right);
+    if (leftValues === null || rightValues === null)
+        return unresolvedDimension("comments", "unknown", links, left.collections.comments.items.length, right.collections.comments.items.length, ["Comment locations could not be normalized relative to the function."]);
+    return compareCollections("comments", leftValues, rightValues, left.collections.comments, right.collections.comments, links, providersDiffer);
+};
+const compareStringsAndNames = (left, right, links, providersDiffer) => {
+    const leftValues = stringAndNameProjection(left);
+    const rightValues = stringAndNameProjection(right);
+    if (leftValues === null || rightValues === null)
+        return unresolvedDimension("strings_names", "unknown", links, null, null, [
+            "Reference source locations could not be normalized to function offsets.",
+        ]);
+    return compareCollections("strings_names", leftValues, rightValues, combineCoverage(left.collections.referenced_strings, left.collections.referenced_names), combineCoverage(right.collections.referenced_strings, right.collections.referenced_names), links, providersDiffer);
+};
+const compareReferences = (left, right, links, providersDiffer) => {
+    const leftCoverage = combineCoverage(left.collections.incoming_references, left.collections.outgoing_references);
+    const rightCoverage = combineCoverage(right.collections.incoming_references, right.collections.outgoing_references);
+    if (!leftCoverage.complete || !rightCoverage.complete)
+        return unresolvedDimension("references", leftCoverage.truncated || rightCoverage.truncated
+            ? "truncated"
+            : "unknown", links, leftCoverage.items.length, rightCoverage.items.length, []);
+    const leftProjection = referenceProjection(left);
+    const rightProjection = referenceProjection(right);
+    if (leftProjection.length === 0 && rightProjection.length === 0)
+        return compareValues("references", leftProjection, rightProjection, links, true, true, providersDiffer);
+    if (canonicalJson(leftProjection) !== canonicalJson(rightProjection))
+        return dimensionResult({
+            dimension: "references",
+            status: "changed",
+            left: leftProjection,
+            right: rightProjection,
+            links,
+            providersDiffer,
+            leftCount: leftProjection.length,
+            rightCount: rightProjection.length,
+            textDelta: null,
+            limitations: [
+                "Reference endpoints differ independently of provider reference-kind metadata.",
+            ],
+        });
+    const leftKinds = referenceKindProjection(left);
+    const rightKinds = referenceKindProjection(right);
+    if (leftKinds !== null && rightKinds !== null)
+        return compareValues("references", leftKinds, rightKinds, links, true, true, providersDiffer);
+    return unresolvedDimension("references", "unknown", links, leftProjection.length, rightProjection.length, [
+        "At least one provider did not expose reference kinds, so equal endpoints do not prove equal edge semantics.",
+    ]);
+};
+const compareIdentity = (left, right, links, providersDiffer) => {
+    if (isAutoName(left.procedure.name) || isAutoName(right.procedure.name))
+        return unresolvedDimension("identity", "unknown", links, null, null, [
+            "Address-derived function names are not stable cross-version identity.",
+        ]);
+    return compareValues("identity", identityProjection(left), identityProjection(right), links, true, true, providersDiffer);
+};
+const compareCalls = (left, right, links, providersDiffer) => {
+    const leftValues = callProjection(left);
+    const rightValues = callProjection(right);
+    if ([...leftValues, ...rightValues].some(({ name }) => isAutoName(name)))
+        return unresolvedDimension("calls", "unknown", links, leftValues.length, rightValues.length, ["Address-derived callee or caller names cannot be matched safely."]);
+    return compareCollections("calls", leftValues, rightValues, combineCoverage(left.collections.callers, left.collections.callees), combineCoverage(right.collections.callers, right.collections.callees), links, providersDiffer);
+};
+const callProjection = (snapshot) => [
+    ...project(snapshot.collections.callers, ({ name }) => ({
+        direction: "in",
+        name,
+    })),
+    ...project(snapshot.collections.callees, ({ name }) => ({
+        direction: "out",
+        name,
+    })),
+];
+const compareCfg = (left, right, links, providersDiffer) => {
+    const leftBlocks = left.collections.basic_blocks;
+    const rightBlocks = right.collections.basic_blocks;
+    if (!leftBlocks.complete || !rightBlocks.complete)
+        return unresolvedDimension("cfg", leftBlocks.truncated || rightBlocks.truncated ? "truncated" : "unknown", links, leftBlocks.items.length, rightBlocks.items.length, []);
+    const leftGraph = normalizeCfg(leftBlocks.items);
+    const rightGraph = normalizeCfg(rightBlocks.items);
+    if (leftGraph === null || rightGraph === null)
+        return unresolvedDimension("cfg", "unknown", links, leftBlocks.items.length, rightBlocks.items.length, ["CFG addresses could not be normalized to local block indices."]);
+    return compareValues("cfg", leftGraph, rightGraph, links, true, true, providersDiffer);
+};
+const compareValues = (...[dimension, left, right, links, leftComplete, rightComplete, providersDiffer,]) => {
+    if (!leftComplete || !rightComplete)
+        return unresolvedDimension(dimension, "unknown", links, null, null, []);
+    const leftJson = canonicalJson(left);
+    const rightJson = canonicalJson(right);
+    return dimensionResult({
+        dimension,
+        status: leftJson === rightJson ? "unchanged" : "changed",
+        left,
+        right,
+        links,
+        providersDiffer,
+        leftCount: Array.isArray(left) ? left.length : null,
+        rightCount: Array.isArray(right) ? right.length : null,
+        textDelta: null,
+        limitations: [],
+    });
+};

package/dist/domain/functionComparisonSchemas.js

@@ -1,9 +1,4 @@
 import { z } from "zod";
-import { evidenceSchema } from "./evidence.js";
-const evidenceInput = z.union([
-    evidenceSchema,
-    z.array(evidenceSchema).min(1).max(100),
-]);
 const comparisonStatusSchema = z.enum([
     "unchanged",
     "added",
@@ -25,9 +20,9 @@ const dimensionNameSchema = z.enum([
 const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
 const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
 /** Strict bounded input for explicit function-to-function comparison. */
-export const functionComparisonInputSchema = z.object({
-    left: evidenceInput,
-    right: evidenceInput,
+export const functionComparisonInputSchema = z.strictObject({
+    left_evidence_ids: z.array(evidenceIdSchema).min(1).max(100),
+    right_evidence_ids: z.array(evidenceIdSchema).min(1).max(100),
     offset: z.number().int().min(0).default(0),
     limit: z.number().int().min(1).max(100).default(100),
     unknown_registry_approved: z.literal(true).optional(),

package/dist/domain/inputIssueProjection.js

@@ -0,0 +1,52 @@
+/** Project Zod failures to secret-safe caller correction metadata. */
+export const projectInputIssues = (issues, input) => issues.flatMap((issue) => projectIssue(issue, input));
+const projectIssue = (issue, input) => {
+    const path = issue.path.flatMap((part) => typeof part === "string" || typeof part === "number" ? [part] : []);
+    if (issue.code === "unrecognized_keys")
+        return issue.keys.map((key) => ({
+            path: [...path, key],
+            reason: "unknown_argument",
+        }));
+    if (issue.code === "invalid_type")
+        return [
+            {
+                path,
+                reason: valueAtPath(input, path) === undefined
+                    ? "missing_argument"
+                    : "invalid_type",
+                expected: safeExpected(issue.expected),
+            },
+        ];
+    if (issue.code === "too_small")
+        return [boundedIssue(path, "minimum", numericBound(issue.minimum))];
+    if (issue.code === "too_big")
+        return [boundedIssue(path, "maximum", numericBound(issue.maximum))];
+    if (issue.code === "invalid_format")
+        return [{ path, reason: "invalid_format", expected: issue.format }];
+    if (issue.code === "invalid_value")
+        return [
+            {
+                path,
+                reason: "invalid_value",
+                expected: issue.values.filter(isSafeExpected),
+            },
+        ];
+    return [{ path, reason: "invalid_value" }];
+};
+const valueAtPath = (input, path) => {
+    let current = input;
+    for (const part of path) {
+        if (typeof current !== "object" || current === null)
+            return undefined;
+        current = current[part];
+    }
+    return current;
+};
+const numericBound = (value) => typeof value === "number" && Number.isFinite(value) ? value : undefined;
+const isSafeExpected = (value) => value === null || ["string", "number", "boolean"].includes(typeof value);
+const safeExpected = (value) => isSafeExpected(value) ? value : "schema-defined value";
+const boundedIssue = (path, key, value) => ({
+    path,
+    reason: "out_of_range",
+    ...(value === undefined ? {} : { [key]: value }),
+});

package/dist/domain/javascriptApplicationAnalysis.js

@@ -0,0 +1,155 @@
+import { isAbsolute } from "node:path";
+import { z } from "zod";
+import { javascriptApplicationGraphSchema } from "./javascriptApplicationGraph.js";
+const MAX_GRAPH_NODES = 100_000;
+const MAX_GRAPH_EDGES = 200_000;
+const countSchema = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
+const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+/** Default hard bounds for one local JavaScript application analysis. */
+export const JAVASCRIPT_APPLICATION_ANALYSIS_DEFAULT_LIMITS = {
+    max_entries: 8_000,
+    max_total_artifact_bytes: 512 * 1_024 * 1_024,
+    max_artifact_entry_bytes: 128 * 1_024 * 1_024,
+    max_compression_ratio: 1_000,
+    max_depth: 64,
+    max_path_bytes: 4_096,
+    max_text_files: 5_000,
+    max_total_text_bytes: 128 * 1_024 * 1_024,
+    max_text_file_bytes: 8 * 1_024 * 1_024,
+    max_ast_nodes: 2_000_000,
+    max_findings: 8_000,
+    max_modules: 20_000,
+    max_source_map_sources: 5_000,
+    max_parse_milliseconds: 30_000,
+};
+/** Combined artifact, text, AST, and graph projection bounds. */
+export const javascriptApplicationAnalysisLimitsSchema = z
+    .strictObject({
+    max_entries: z.number().int().min(1).max(1_000_000).default(8_000),
+    max_total_artifact_bytes: z
+        .number()
+        .int()
+        .min(1)
+        .max(Number.MAX_SAFE_INTEGER)
+        .default(512 * 1_024 * 1_024),
+    max_artifact_entry_bytes: z
+        .number()
+        .int()
+        .min(1)
+        .max(Number.MAX_SAFE_INTEGER)
+        .default(128 * 1_024 * 1_024),
+    max_compression_ratio: z.number().min(1).max(100_000).default(1_000),
+    max_depth: z.number().int().min(1).max(100).default(64),
+    max_path_bytes: z.number().int().min(1).max(65_535).default(4_096),
+    max_text_files: z.number().int().min(1).max(100_000).default(5_000),
+    max_total_text_bytes: z
+        .number()
+        .int()
+        .min(1)
+        .max(512 * 1_024 * 1_024)
+        .default(128 * 1_024 * 1_024),
+    max_text_file_bytes: z
+        .number()
+        .int()
+        .min(1)
+        .max(64 * 1_024 * 1_024)
+        .default(8 * 1_024 * 1_024),
+    max_ast_nodes: z.number().int().min(1).max(20_000_000).default(2_000_000),
+    max_findings: z.number().int().min(1).max(200_000).default(8_000),
+    max_modules: z.number().int().min(1).max(100_000).default(20_000),
+    max_source_map_sources: z.number().int().min(1).max(100_000).default(5_000),
+    max_parse_milliseconds: z
+        .number()
+        .int()
+        .min(1)
+        .max(300_000)
+        .default(30_000),
+})
+    .superRefine((limits, context) => {
+    const projectedNodes = 7 * limits.max_entries +
+        2 * limits.max_findings +
+        limits.max_modules +
+        limits.max_source_map_sources +
+        1;
+    if (projectedNodes > MAX_GRAPH_NODES)
+        context.addIssue({
+            code: "custom",
+            path: ["max_entries"],
+            message: "Combined application-analysis limits can exceed the 100000-node graph contract",
+        });
+    const projectedEdges = 9 * limits.max_entries +
+        6 * limits.max_findings +
+        limits.max_modules +
+        limits.max_source_map_sources;
+    if (projectedEdges > MAX_GRAPH_EDGES)
+        context.addIssue({
+            code: "custom",
+            path: ["max_entries"],
+            message: "Combined application-analysis limits can exceed the 200000-edge graph contract",
+        });
+});
+/** Public target-free request for bounded static JavaScript application analysis. */
+export const analyzeJavaScriptApplicationInputSchema = z.strictObject({
+    input_path: z
+        .string()
+        .min(1)
+        .max(16_384)
+        .refine(isAbsolute, "JavaScript application input path must be absolute"),
+    format: z.enum(["auto", "asar", "directory"]).default("auto"),
+    approved: z.literal(true),
+    source_map_read_approved: z.boolean().default(false),
+    limits: javascriptApplicationAnalysisLimitsSchema.default(JAVASCRIPT_APPLICATION_ANALYSIS_DEFAULT_LIMITS),
+});
+/** Compact counts for the high-level Electron architecture/security surface. */
+const electronBoundarySummarySchema = z.strictObject({
+    browser_windows: countSchema,
+    explicit_web_preferences: countSchema,
+    preload_entrypoints: countSchema,
+    context_bridge_apis: countSchema,
+    exposed_api_members: countSchema,
+    ipc: z.strictObject({
+        operations: countSchema,
+        literal_channels: countSchema,
+        dynamic_channel_operations: countSchema,
+        renderer_transmissions: countSchema,
+        renderer_listeners: countSchema,
+        main_handlers: countSchema,
+        paired_renderer_transmissions: countSchema,
+        ambiguous_renderer_transmissions: countSchema,
+        unpaired_literal_renderer_transmissions: countSchema,
+    }),
+    sender_validation_observations: countSchema,
+    utility_processes: countSchema,
+    resolved_utility_entrypoints: countSchema,
+    native_addon_bindings: countSchema,
+    resolved_native_addon_bindings: countSchema,
+});
+const reconstructionStatisticsSchema = z.strictObject({
+    relevant_files: countSchema,
+    nested_asar_containers: countSchema,
+    text_files_selected: countSchema,
+    text_bytes_read: countSchema,
+    omitted_text_files: countSchema,
+    limit_omitted_text_files: countSchema,
+    policy_filtered_text_files: countSchema,
+    invalid_utf8_files: countSchema,
+    parsed_javascript_files: countSchema,
+    visited_ast_nodes: countSchema,
+    findings: countSchema,
+    modules: countSchema,
+    parse_failures: countSchema,
+    truncated_scopes: countSchema,
+});
+/** Strict high-level result returned inside Evidence v2. */
+export const javascriptApplicationAnalysisResultSchema = z.strictObject({
+    schema_version: z.literal(1),
+    input_path: z.string().min(1).max(16_384),
+    format: z.enum(["asar", "directory"]),
+    root_artifact_sha256: digestSchema,
+    inventory_manifest_id: z.string().regex(/^agm_[a-f0-9]{64}$/u),
+    inventory_graph_sha256: digestSchema,
+    graph: javascriptApplicationGraphSchema,
+    summary: electronBoundarySummarySchema,
+    statistics: reconstructionStatisticsSchema,
+    limitations: z.array(z.string().min(1).max(4_096)).max(1_000),
+});