rea-agents 2.0.0 → 2.2.0

package/dist/application/ElectronBoundaryAnalysis.js

@@ -1,4 +1,4 @@
-import { resolveArtifactPath } from "./JavaScriptArtifactGraphContext.js";
+import { resolveArtifactPathByContext } from "./JavaScriptArtifactPathResolution.js";
 /** Flatten all per-file IPC facts into deterministic application records. */
 export const collectElectronIpcRecords = (analysis) => analysis.files
     .flatMap(({ file, javascript }) => (javascript?.electron.ipc ?? []).map((finding) => ({
@@ -70,9 +70,20 @@ export const summarizeElectronBoundaries = (analysis) => {
         },
         sender_validation_observations: validations.length,
         utility_processes: utilities.length,
-        resolved_utility_entrypoints: utilities.filter(({ file, finding }) => resolvesToFile(file, finding.module_path, files)).length,
+        resolved_utility_entrypoints: utilities.filter(({ file, finding }) => resolvesToFile({
+            file,
+            specifier: finding.module_path,
+            context: finding.module_resolution_context ?? "module-specifier",
+            files,
+        })).length,
         native_addon_bindings: nativeBindings.length,
-        resolved_native_addon_bindings: nativeBindings.filter(({ file, finding }) => resolvesToFile(file, finding.specifier, files, "native-addon")).length,
+        resolved_native_addon_bindings: nativeBindings.filter(({ file, finding }) => resolvesToFile({
+            file,
+            specifier: finding.specifier,
+            context: "module-specifier",
+            files,
+            kind: "native-addon",
+        })).length,
     };
 };
 const compatibleIpcModes = (transmission, handler) => transmission.mode === "invoke"
@@ -85,12 +96,17 @@ const isRendererTransmission = ({ finding }) => finding.side === "renderer" &&
 const isPairableRendererTransmission = (record) => isRendererTransmission(record) && record.finding.operation !== "send-to-host";
 const isMainHandler = ({ finding }) => finding.side === "main" &&
     (finding.mode === "listen" || finding.mode === "handle");
-const resolvesToFile = (file, specifier, files, kind) => {
-    if (specifier === null)
+const resolvesToFile = (input) => {
+    if (input.specifier === null)
         return false;
-    const resolved = resolveArtifactPath(specifier, file.path, files);
+    const resolved = resolveArtifactPathByContext({
+        declaredPath: input.specifier,
+        sourcePath: input.file.path,
+        context: input.context,
+        files: input.files,
+    }).resolved_path;
     return (resolved !== null &&
-        (kind === undefined || files.get(resolved)?.kind === kind));
+        (input.kind === undefined || input.files.get(resolved)?.kind === input.kind));
 };
 const ipcRecordKey = (path, finding) => `${path}\0${String(finding.location.start.line)}:${String(finding.location.start.column)}\0${finding.side}\0${finding.operation}`;
 const compareCodePoints = (left, right) => left < right ? -1 : left > right ? 1 : 0;

package/dist/application/ElectronBoundaryGraphWindows.js

@@ -1,6 +1,7 @@
-import { artifactLocalIdentity, createElectronRoleNode, javascriptAnalysisCoverage, linkElectronRoleToAsset, resolveArtifactPath, } from "./JavaScriptArtifactGraphContext.js";
+import { artifactLocalIdentity, createElectronRoleNode, javascriptAnalysisCoverage, linkElectronRoleToAsset, } from "./JavaScriptArtifactGraphContext.js";
 import { astObservationEvidence } from "./JavaScriptArtifactGraphEvidence.js";
 import { addElectronAstEdge, addElectronInferenceEdge, electronFindingSourceNode, electronRangeKey, } from "./ElectronBoundaryGraphContext.js";
+import { resolveArtifactPathByContext } from "./JavaScriptArtifactPathResolution.js";
 /** Project BrowserWindow, contextBridge, preload, and utility-process facts. */
 export const addElectronWindowBoundaries = (context) => {
     for (const analyzed of context.analysis.files) {
@@ -40,6 +41,7 @@ const addBrowserWindow = (input) => {
                     web_preferences: value.web_preferences,
                     omitted_web_preferences: value.omitted_web_preferences,
                     preload_path: value.preload_path,
+                    preload_resolution_context: value.preload_resolution_context,
                     absence_means_default: false,
                 },
                 evidence: astObservationEvidence({
@@ -71,12 +73,16 @@ const addWindowPreload = (input, window) => {
     const declared = input.value.preload_path;
     if (declared === null)
         return;
-    const resolved = resolveArtifactPath(declared, input.file.path, input.context.filesByPath);
+    const resolution = resolveArtifactPathByContext({
+        declaredPath: declared,
+        sourcePath: input.file.path,
+        context: input.value.preload_resolution_context ?? "module-specifier",
+        files: input.context.filesByPath,
+    });
     const role = createElectronRoleNode(input.context, {
         kind: "electron-preload",
         anchor: input.file,
-        declaredPath: declared,
-        resolvedPath: resolved,
+        resolution,
         mechanism: "BrowserWindow:webPreferences.preload",
         range: input.value.location,
         coverage: input.coverage,
@@ -89,12 +95,18 @@ const addWindowPreload = (input, window) => {
         coverage: input.coverage,
         relation: "loads",
         operation: "associate-browser-window-preload",
-        properties: { declared_path: declared, resolved_path: resolved },
+        properties: {
+            declared_path: declared,
+            resolution_context: resolution.resolution_context,
+            resolved_path: resolution.resolved_path,
+            resolution_status: resolution.resolution_status,
+            limitations: resolution.limitations,
+        },
     });
     linkElectronRoleToAsset(input.context, {
         role,
         anchor: input.file,
-        path: resolved,
+        resolution,
         range: input.value.location,
         coverage: input.coverage,
     });
@@ -152,6 +164,7 @@ const addUtilityProcess = (input) => {
                 label: value.service_name ?? value.module_path,
                 properties: {
                     module_path: value.module_path,
+                    module_resolution_context: value.module_resolution_context,
                     module_expression: value.module_expression,
                     service_name: value.service_name,
                 },
@@ -180,7 +193,13 @@ const addUtilityProcess = (input) => {
     });
     if (value.module_path === null)
         return;
-    const resolved = resolveArtifactPath(value.module_path, file.path, context.filesByPath);
+    const resolution = resolveArtifactPathByContext({
+        declaredPath: value.module_path,
+        sourcePath: file.path,
+        context: value.module_resolution_context ?? "module-specifier",
+        files: context.filesByPath,
+    });
+    const resolved = resolution.resolved_path;
     const target = resolved === null
         ? undefined
         : (context.assetNodes.get(resolved) ?? context.fileNodes.get(resolved));
@@ -194,6 +213,11 @@ const addUtilityProcess = (input) => {
         coverage,
         relation: "maps_to",
         operation: "resolve-utility-process-entrypoint",
-        properties: { resolved_path: resolved },
+        properties: {
+            declared_path: value.module_path,
+            resolution_context: resolution.resolution_context,
+            resolved_path: resolved,
+            resolution_status: resolution.resolution_status,
+        },
     });
 };

package/dist/application/EnhancedToolPagination.js

@@ -0,0 +1,22 @@
+import { AnalysisOutputError } from "../domain/errors.js";
+import { parseAddressedPage } from "../domain/hopperValues.js";
+import { err, ok } from "../domain/result.js";
+/** Read all addressed entries while enforcing advancing provider pagination. */
+export const readAllAddressed = async (input) => {
+    const entries = [];
+    let offset = 0;
+    while (true) {
+        const result = await input.call(input.tool, { offset, limit: 500 }, input.signal);
+        if (!result.ok)
+            return result;
+        const page = parseAddressedPage(result.value);
+        if (!page.ok)
+            return page;
+        entries.push(...page.value.items);
+        if (!page.value.hasMore || page.value.nextOffset === null)
+            return ok(entries);
+        if (page.value.nextOffset <= offset)
+            return err(new AnalysisOutputError(input.tool, "provider returned a non-advancing pagination offset"));
+        offset = page.value.nextOffset;
+    }
+};

package/dist/application/EnhancedToolTypes.js

@@ -0,0 +1,4 @@
+import { AnalysisInputError } from "../domain/errors.js";
+import { err } from "../domain/result.js";
+import { enhancedInputSchemas, } from "../contracts/enhancedInputs.js";
+export const invalidEnhancedInput = (name, cause) => Promise.resolve(err(new AnalysisInputError(name, { cause })));

package/dist/application/EnhancedTools.js

@@ -1,8 +1,10 @@
 import { enhancedInputSchemas } from "../contracts/enhancedInputs.js";
-import { AnalysisInputError, AnalysisCancelledError, AnalysisOutputError, projectAnalysisError, } from "../domain/errors.js";
-import { addressDistance, parseDocuments, parseFunctionDossier, parseAddressedPage, parseListCount, parseRelatedAddresses, parseSegments, } from "../domain/hopperValues.js";
+import { AnalysisCancelledError, AnalysisOutputError, projectAnalysisError, } from "../domain/errors.js";
+import { addressDistance, parseAddressedPage, parseDocuments, parseFunctionDossier, parseListCount, parseRelatedAddresses, parseSegments, } from "../domain/hopperValues.js";
 import { err, ok } from "../domain/result.js";
 import { categorizeSwiftTypes, discoverObjcClasses, discoverObjcProtocols, discoverSwiftClasses, } from "../domain/symbolAnalysis.js";
+import { invalidEnhancedInput, } from "./EnhancedToolTypes.js";
+import { readAllAddressed } from "./EnhancedToolPagination.js";
 /**
  * Composes direct provider operations into bounded reverse-engineering tools.
  * Direct callers use `execute`; adapters that own validation use
@@ -20,13 +22,13 @@ export class EnhancedTools {
                 const parsed = enhancedInputSchemas.swift_classes.safeParse(input);
                 return parsed.success
                     ? this.executeValidated({ name, input: parsed.data }, signal)
-                    : invalidInput(name, parsed.error);
+                    : invalidEnhancedInput(name, parsed.error);
             }
             case "get_objc_classes": {
                 const parsed = enhancedInputSchemas.get_objc_classes.safeParse(input);
                 return parsed.success
                     ? this.executeValidated({ name, input: parsed.data }, signal)
-                    : invalidInput(name, parsed.error);
+                    : invalidEnhancedInput(name, parsed.error);
             }
             case "get_objc_protocols":
                 return this.executeValidated({ name, input: {} }, signal);
@@ -34,13 +36,13 @@ export class EnhancedTools {
                 const parsed = enhancedInputSchemas.batch_decompile.safeParse(input);
                 return parsed.success
                     ? this.executeValidated({ name, input: parsed.data }, signal)
-                    : invalidInput(name, parsed.error);
+                    : invalidEnhancedInput(name, parsed.error);
             }
             case "get_call_graph": {
                 const parsed = enhancedInputSchemas.get_call_graph.safeParse(input);
                 return parsed.success
                     ? this.executeValidated({ name, input: parsed.data }, signal)
-                    : invalidInput(name, parsed.error);
+                    : invalidEnhancedInput(name, parsed.error);
             }
             case "analyze_swift_types":
                 return this.executeValidated({ name, input: {} }, signal);
@@ -48,25 +50,25 @@ export class EnhancedTools {
                 const parsed = enhancedInputSchemas.find_xrefs_to_name.safeParse(input);
                 return parsed.success
                     ? this.executeValidated({ name, input: parsed.data }, signal)
-                    : invalidInput(name, parsed.error);
+                    : invalidEnhancedInput(name, parsed.error);
             }
             case "binary_overview": {
                 const parsed = enhancedInputSchemas.binary_overview.safeParse(input);
                 return parsed.success
                     ? this.executeValidated({ name, input: parsed.data }, signal)
-                    : invalidInput(name, parsed.error);
+                    : invalidEnhancedInput(name, parsed.error);
             }
             case "analyze_function": {
                 const parsed = enhancedInputSchemas.analyze_function.safeParse(input);
                 return parsed.success
                     ? this.executeValidated({ name, input: parsed.data }, signal)
-                    : invalidInput(name, parsed.error);
+                    : invalidEnhancedInput(name, parsed.error);
             }
             case "trace_feature": {
                 const parsed = enhancedInputSchemas.trace_feature.safeParse(input);
                 return parsed.success
                     ? this.executeValidated({ name, input: parsed.data }, signal)
-                    : invalidInput(name, parsed.error);
+                    : invalidEnhancedInput(name, parsed.error);
             }
         }
     }
@@ -100,7 +102,7 @@ export class EnhancedTools {
         return result.ok ? parseFunctionDossier(result.value) : result;
     }
     async #swiftClasses(pattern, signal) {
-        const procedures = await this.#allProcedures(signal);
+        const procedures = await this.#allAddressed("list_procedures", signal);
         return procedures.ok
             ? ok(discoverSwiftClasses(procedures.value, pattern))
             : procedures;
@@ -189,7 +191,7 @@ export class EnhancedTools {
         return ok(graph);
     }
     async #analyzeSwiftTypes(signal) {
-        const procedures = await this.#allProcedures(signal);
+        const procedures = await this.#allAddressed("list_procedures", signal);
         return procedures.ok
             ? ok(categorizeSwiftTypes(procedures.value))
             : procedures;
@@ -218,7 +220,7 @@ export class EnhancedTools {
         const [segmentsResult, documentsResult, procedures, stringsResult] = await Promise.all([
             this.#call("list_segments", {}, signal),
             this.#call("list_documents", {}, signal),
-            this.#allProcedures(signal),
+            this.#allAddressed("list_procedures", signal),
             this.#call("list_strings", {}, signal),
         ]);
         if (!segmentsResult.ok)
@@ -358,28 +360,12 @@ export class EnhancedTools {
             residual: [...residual],
         });
     }
-    async #allProcedures(signal) {
-        return this.#allAddressed("list_procedures", signal);
-    }
     async #allAddressed(tool, signal) {
-        const entries = [];
-        let offset = 0;
-        while (true) {
-            const result = await this.#call(tool, { offset, limit: 500 }, signal);
-            if (!result.ok)
-                return result;
-            const page = parseAddressedPage(result.value);
-            if (!page.ok)
-                return page;
-            entries.push(...page.value.items);
-            if (!page.value.hasMore || page.value.nextOffset === null) {
-                return ok(entries);
-            }
-            if (page.value.nextOffset <= offset) {
-                return err(new AnalysisOutputError(tool, "provider returned a non-advancing pagination offset"));
-            }
-            offset = page.value.nextOffset;
-        }
+        return readAllAddressed({
+            call: (name, arguments_, operationSignal) => this.#call(name, arguments_, operationSignal),
+            tool,
+            ...(signal === undefined ? {} : { signal }),
+        });
     }
     async #call(name, arguments_, signal) {
         if (signal?.aborted === true)
@@ -388,6 +374,3 @@ export class EnhancedTools {
         return execution.ok ? ok(execution.value.result) : execution;
     }
 }
-const invalidInput = (name, cause) => Promise.resolve(err(new AnalysisInputError(name, {
-    cause,
-})));

package/dist/application/InstrumentedJavaScriptReplayHost.js

@@ -0,0 +1,36 @@
+import { instrumentJavaScriptExport, } from "../domain/javascriptExportInstrumentation.js";
+/** Decorate one exact replay source with deterministic in-memory instrumentation. */
+export class InstrumentedJavaScriptReplayHost {
+    delegate;
+    input;
+    instrumentation = null;
+    constructor(delegate, input) {
+        this.delegate = delegate;
+        this.input = input;
+    }
+    async readSource(path, maximumBytes) {
+        const source = await this.delegate.readSource(path, maximumBytes);
+        if (path !== this.input.artifact_path)
+            return source;
+        const instrumented = instrumentJavaScriptExport(source.bytes, this.input);
+        if (instrumented.bytes.byteLength > maximumBytes)
+            throw new RangeError("Instrumented JavaScript exceeds the replay module byte limit");
+        this.instrumentation = instrumented;
+        return { canonicalPath: source.canonicalPath, bytes: instrumented.bytes };
+    }
+    identifyExecutable(path, versionArguments) {
+        return this.delegate.identifyExecutable(path, versionArguments);
+    }
+    identifyWorker() {
+        return this.delegate.identifyWorker();
+    }
+    identifyRuntimeClosure(nodePath) {
+        return this.delegate.identifyRuntimeClosure(nodePath);
+    }
+    seccompDigest() {
+        return this.delegate.seccompDigest();
+    }
+    probe(policy) {
+        return this.delegate.probe(policy);
+    }
+}

package/dist/application/InventoryProjectionEvidence.js

@@ -0,0 +1,41 @@
+import { z } from "zod";
+import { AnalysisInputError, AnalysisProtocolError, } from "../domain/errors.js";
+import { createEvidence, } from "../domain/evidence.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { err, ok } from "../domain/result.js";
+/** Parse one inventory projection and wrap its deterministic result in Evidence v2. */
+export const projectInventoryEvidence = (options) => {
+    const parsed = options.schema.safeParse(options.rawInput);
+    if (!parsed.success)
+        return err(new AnalysisInputError(options.operation, { cause: parsed.error }));
+    try {
+        const result = options.project(parsed.data);
+        const first = parsed.data.inventory_evidence[0];
+        return ok(createEvidence(first?.subject === null || first?.subject === undefined
+            ? undefined
+            : {
+                path: first.subject.local_path,
+                sha256: result.root_sha256,
+                format: options.subjectFormat(first),
+            }, options.provider, {
+            predicateType: options.predicateType,
+            operation: options.operation,
+            parameters: {
+                inventory_evidence_ids: [...result.source_evidence_ids],
+                limits: jsonValueSchema.parse(parsed.data.limits),
+            },
+            result: jsonValueSchema.parse(result),
+            rawResult: null,
+            confidence: "inferred",
+            authority: "analyst-inference",
+            environment: null,
+            limitations: result.limitations,
+            evidenceLinks: result.source_evidence_ids,
+        }));
+    }
+    catch (cause) {
+        return err(cause instanceof TypeError || cause instanceof z.ZodError
+            ? new AnalysisInputError(options.operation, { cause })
+            : new AnalysisProtocolError(options.protocolError, { cause }));
+    }
+};

package/dist/application/InvestigationProviders.js

@@ -27,6 +27,18 @@ export const MANAGED_WORKFLOW_PROVIDER = {
     name: "REA managed-code workflows",
     version: "1",
 };
+/** Provider identity for deterministic Apple application projections. */
+export const APPLE_APPLICATION_PROVIDER = {
+    id: "rea-apple-application",
+    name: "REA Apple application workflows",
+    version: "1",
+};
+/** Provider identity for deterministic Android application projections. */
+export const ANDROID_APPLICATION_PROVIDER = {
+    id: "rea-android-application",
+    name: "REA Android application workflows",
+    version: "1",
+};
 /** Provider identity for deterministic static JavaScript application analysis. */
 export const JAVASCRIPT_APPLICATION_PROVIDER = {
     id: "rea-javascript-application",

package/dist/application/InvestigationWorkspaceStore.js

@@ -5,27 +5,41 @@ import { isJsonWithinLimits } from "../domain/jsonLimits.js";
 import { InvestigationWorkspaceError } from "../domain/errors.js";
 import { parseInvestigationWorkspace, serializeInvestigationWorkspace, } from "../domain/investigationWorkspace.js";
 import { err, ok } from "../domain/result.js";
+const investigationWorkspaceCodec = {
+    parse: parseInvestigationWorkspace,
+    serialize: serializeInvestigationWorkspace,
+    validateNext: validateNextRevision,
+};
 /** Read a validated workspace, returning null only when it does not exist. */
-export const readInvestigationWorkspace = async (path, policy) => {
+export const readInvestigationWorkspace = async (path, policy) => readRevisionedWorkspace(path, policy, investigationWorkspaceCodec);
+/** Read one root-confined, owner-only revisioned workspace document. */
+export const readRevisionedWorkspace = async (path, policy, codec) => {
     if (policy.roots.length === 0)
         return err(new InvestigationWorkspaceError("read", "disabled"));
     try {
         const destination = await resolveDestination(path, policy.roots);
         if (destination === null)
             return err(new InvestigationWorkspaceError("read", "outside-root"));
-        return await readWorkspaceFile(destination, policy);
+        return await readWorkspaceFile(destination, policy, codec);
     }
     catch (cause) {
         return err(new InvestigationWorkspaceError("read", "io", { cause }));
     }
 };
 /** Atomically append one CAS-linked workspace revision under an exclusive lock. */
-export const writeInvestigationWorkspace = async (workspace, path, expectedRevision, policy) => {
+export const writeInvestigationWorkspace = async (workspace, path, expectedRevision, policy) => writeRevisionedWorkspace(path, policy, {
+    document: workspace,
+    expectedRevision,
+    codec: investigationWorkspaceCodec,
+});
+/** Atomically append one validated CAS-linked revision under an exclusive lock. */
+export const writeRevisionedWorkspace = async (path, policy, input) => {
+    const { document, expectedRevision, codec } = input;
     if (policy.roots.length === 0)
         return err(new InvestigationWorkspaceError("update", "disabled"));
     let encoded;
     try {
-        encoded = serializeInvestigationWorkspace(workspace);
+        encoded = codec.serialize(document);
     }
     catch (cause) {
         return err(new InvestigationWorkspaceError("update", "integrity", { cause }));
@@ -42,10 +56,10 @@ export const writeInvestigationWorkspace = async (workspace, path, expectedRevis
         if (!acquired.ok)
             return acquired;
         lock = acquired.value;
-        const current = await readWorkspaceFile(destination, policy);
+        const current = await readWorkspaceFile(destination, policy, codec);
         if (!current.ok)
             return current;
-        const checked = validateNextRevision(current.value, workspace, expectedRevision);
+        const checked = codec.validateNext(current.value, document, expectedRevision);
         if (!checked.ok)
             return checked;
         await writeFileAtomic(destination, encoded, {
@@ -76,7 +90,7 @@ const resolveDestination = async (path, roots) => {
     }
     return null;
 };
-const readWorkspaceFile = async (destination, policy) => {
+const readWorkspaceFile = async (destination, policy, codec) => {
     const stats = await lstat(destination).catch((cause) => {
         if (isFileNotFound(cause))
             return undefined;
@@ -101,7 +115,7 @@ const readWorkspaceFile = async (destination, policy) => {
     if (!isJsonWithinLimits(decoded, policy))
         return err(new InvestigationWorkspaceError("read", "too-large"));
     try {
-        return ok(parseInvestigationWorkspace(decoded));
+        return ok(codec.parse(decoded));
     }
     catch (cause) {
         return err(new InvestigationWorkspaceError("read", "integrity", { cause }));
@@ -168,7 +182,7 @@ const releaseLock = async (lock) => {
     await lock.handle.close().catch(() => undefined);
     await unlink(lock.path).catch(() => undefined);
 };
-const validateNextRevision = (current, next, expectedRevision) => {
+function validateNextRevision(current, next, expectedRevision) {
     if ((current?.revision ?? null) !== expectedRevision)
         return err(new InvestigationWorkspaceError("update", "revision-conflict"));
     if (current === null) {
@@ -182,7 +196,7 @@ const validateNextRevision = (current, next, expectedRevision) => {
         next.previous_revision_digest === current.revision_digest
         ? ok(null)
         : err(new InvestigationWorkspaceError("update", "revision-conflict"));
-};
+}
 const isFileNotFound = (cause) => errorCode(cause) === "ENOENT";
 const isAlreadyExists = (cause) => errorCode(cause) === "EEXIST";
 const errorCode = (cause) => typeof cause === "object" && cause !== null && "code" in cause

package/dist/application/JavaScriptArtifactAnalysis.js

@@ -1,5 +1,8 @@
 import { createHash } from "node:crypto";
 import { analyzeJavaScriptStaticSource } from "../domain/javascriptStaticAnalysis.js";
+import { analyzeJavaScriptSemantics } from "../domain/javascriptSemanticAnalysis.js";
+import { DEFAULT_JAVASCRIPT_SEMANTIC_LIMITS, } from "../domain/javascriptSemanticIr.js";
+import { analyzeJavaScriptJsonModule } from "./JavaScriptJsonModules.js";
 /** Analyze selected text files under one shared AST, finding, module, and time budget. */
 export const analyzeJavaScriptArtifactFiles = (fileSet, input, now) => {
     const state = emptyArtifactAnalysis();
@@ -23,6 +26,7 @@ const finalizeArtifactAnalysis = (state, input) => {
     return {
         files: state.files,
         packages: state.packages,
+        json_modules: state.jsonModules,
         html_scripts: state.htmlScripts.slice(0, input.limits.max_findings),
         source_maps: state.sourceMaps,
         visited_ast_nodes: state.visitedNodes,
@@ -46,14 +50,13 @@ const finalizeArtifactAnalysis = (state, input) => {
 };
 const analyzeArtifactFile = (file, context) => {
     const { state, input } = context;
-    if (file.kind === "package-json")
-        state.packages.push(parsePackage(file));
+    addStructuredObservations(file, state);
     if (file.kind === "html" && file.text.included)
         state.htmlScripts.push(...parseHtmlScripts(file.path, file.text.value, Math.max(0, input.limits.max_findings - state.findings)));
     if (file.kind === "source-map")
         addSourceMap(file, context);
     if (file.kind !== "javascript" || !file.text.included) {
-        state.files.push({ file, javascript: null });
+        state.files.push({ file, javascript: null, semantic: null });
         return;
     }
     const remainingNodes = input.limits.max_ast_nodes - state.visitedNodes;
@@ -63,7 +66,7 @@ const analyzeArtifactFile = (file, context) => {
         remainingFindings <= 0 ||
         remainingModules <= 0 ||
         context.now() > context.deadline) {
-        state.files.push({ file, javascript: null });
+        state.files.push({ file, javascript: null, semantic: null });
         state.truncatedScopes += 1;
         return;
     }
@@ -74,14 +77,33 @@ const analyzeArtifactFile = (file, context) => {
         deadline: context.deadline,
         now: context.now,
     });
-    state.files.push({ file, javascript: analysis });
+    const staticFindings = findingCount(analysis);
+    const semanticFindingBudget = Math.max(0, input.limits.max_findings - state.findings - staticFindings);
+    const semanticLimits = {
+        ...DEFAULT_JAVASCRIPT_SEMANTIC_LIMITS,
+        maxScopes: remainingNodes,
+        maxBindings: remainingNodes,
+        maxCallables: remainingNodes,
+        maxReferences: remainingNodes,
+        maxModuleLinks: semanticFindingBudget,
+    };
+    const semantics = analysis.parse_status === "complete" || analysis.parse_status === "partial"
+        ? analyzeJavaScriptSemantics(file.text.value, semanticLimits)
+        : null;
+    state.files.push({
+        file,
+        javascript: analysis,
+        semantic: semantics === null ? null : { ir: semantics, limits: semanticLimits },
+    });
     state.visitedNodes += analysis.visited_ast_nodes;
-    state.findings += findingCount(analysis);
+    state.findings += staticFindings + (semantics?.moduleLinks.length ?? 0);
     state.modules += analysis.bundler_registrations.reduce((count, registration) => count + registration.modules.length, 0);
     if (analysis.parse_status === "failed")
         state.parseFailures += 1;
     if (analysis.parse_status === "truncated")
         state.truncatedScopes += 1;
+    if (semantics?.coverage.status === "truncated")
+        state.truncatedScopes += 1;
 };
 const addSourceMap = (file, context) => {
     const sourceMap = parseSourceMap(file, {
@@ -96,6 +118,7 @@ const addSourceMap = (file, context) => {
 const emptyArtifactAnalysis = () => ({
     files: [],
     packages: [],
+    jsonModules: [],
     htmlScripts: [],
     sourceMaps: [],
     visitedNodes: 0,
@@ -105,6 +128,16 @@ const emptyArtifactAnalysis = () => ({
     truncatedScopes: 0,
     sourceMapSources: 0,
 });
+const addStructuredObservations = (file, state) => {
+    if (file.kind === "package-json")
+        state.packages.push(parsePackage(file));
+    if (file.kind !== "json")
+        return;
+    const json = analyzeJavaScriptJsonModule(file);
+    state.jsonModules.push(json);
+    if (json.status === "invalid")
+        state.parseFailures += 1;
+};
 const parsePackage = (file) => {
     if (!file.text.included)
         return unavailablePackage(file, "Package metadata text was unavailable.");
@@ -146,6 +179,7 @@ const unavailablePackage = (file, limitation) => ({
 });
 const parseHtmlScripts = (path, text, maximum) => {
     const scripts = [];
+    const baseHref = htmlBaseHref(text);
     const pattern = /<script\b[^>]*\bsrc\s*=\s*(["'])([^"']+)\1[^>]*>/giu;
     for (const match of text.matchAll(pattern)) {
         const script = match[2]?.slice(0, 4_096);
@@ -155,11 +189,16 @@ const parseHtmlScripts = (path, text, maximum) => {
         scripts.push({
             html_path: path,
             script_path: script,
+            base_href: baseHref,
             location: rangeForOffsets(text, start, start + match[0].length),
         });
     }
     return scripts;
 };
+const htmlBaseHref = (text) => {
+    const match = /<base\b[^>]*\bhref\s*=\s*(["'])([^"']+)\1[^>]*>/iu.exec(text);
+    return match?.[2]?.slice(0, 4_096) ?? null;
+};
 const parseSourceMap = (file, context) => {
     if (!file.text.included)
         return unavailableSourceMap(file);

package/dist/application/JavaScriptArtifactFiles.js

@@ -197,6 +197,8 @@ const relevantKind = (path) => {
     const lower = path.toLowerCase();
     if (lower === "package.json" || lower.endsWith("/package.json"))
         return "package-json";
+    if (lower.endsWith(".json"))
+        return "json";
     if (/\.(?:cjs|mjs|js|jsx|ts|tsx)$/u.test(lower))
         return "javascript";
     if (/\.html?$/u.test(lower))
@@ -215,10 +217,12 @@ const filePriority = (kind) => {
             return 1;
         case "javascript":
             return 2;
-        case "source-map":
+        case "json":
             return 3;
-        case "native-addon":
+        case "source-map":
             return 4;
+        case "native-addon":
+            return 5;
     }
 };
 const isFilesystemAsar = (entry, path) => entry.kind === "file" &&