rea-agents 3.0.0 → 3.1.0

package/dist/application/CapabilityInventory.js

@@ -1,28 +1,13 @@
 import { z } from "zod";
+import { providerCapability, } from "../contracts/toolOutputSchemaPrimitives.js";
 import { GENERATED_MCP_TOOL_CATALOG } from "../generatedMcpToolCatalog.js";
+import { clientRequirementsFor, NO_CLIENT_FEATURES, } from "./CapabilityClientRequirements.js";
 const statusSchema = z.object({
     open: z.boolean(),
     kind: z.enum(["executable", "database", "archive", "artifact"]).optional(),
     format: z.string().optional(),
-    capabilities: z.array(z.object({
-        operation: z.string(),
-        available: z.boolean(),
-        reason: z.string().nullable(),
-        availability_code: z.string().nullable().optional(),
-    })),
+    capabilities: z.array(providerCapability),
 });
-const NO_CLIENT_FEATURES = {
-    elicitation_form: false,
-    elicitation_url: false,
-    roots: false,
-    sampling: false,
-};
-const CLIENT_FEATURE_REQUIREMENTS = {
-    capture_process_scenario: {
-        required: [],
-        optional: ["elicitation_form"],
-    },
-};
 const ENHANCED_REQUIREMENTS = {
     swift_classes: ["list_procedures"],
     get_objc_classes: ["list_names"],
@@ -46,24 +31,24 @@ const ENHANCED_REQUIREMENTS = {
         "resolve_containing_procedure",
     ],
 };
-const SESSION_COMPOSITION_REQUIREMENTS = {
-    get_navigation_context: [
-        "current_document",
-        "current_address",
-        "resolve_containing_procedure",
-    ],
-};
+const NAVIGATION_CONTEXT_MODES = [
+    {
+        name: "current_selection",
+        requirements: [
+            "current_document",
+            "current_address",
+            "resolve_containing_procedure",
+        ],
+    },
+    {
+        name: "explicit_document",
+        requirements: ["current_address", "resolve_containing_procedure"],
+    },
+];
 /** Build stable per-operation availability for discovery and tool visibility. */
 export const buildCapabilityInventory = (sessionStatus, policy, clientFeatures = NO_CLIENT_FEATURES) => {
     const status = statusSchema.parse(sessionStatus);
-    const descriptors = new Map(status.capabilities.map((descriptor) => [
-        descriptor.operation,
-        {
-            available: descriptor.available,
-            reason: descriptor.reason,
-            availability_code: descriptor.availability_code ?? null,
-        },
-    ]));
+    const descriptors = new Map(status.capabilities.map((descriptor) => [descriptor.operation, descriptor]));
     return GENERATED_MCP_TOOL_CATALOG.map((contract) => {
         const availability = availabilityFor({
             name: contract.name,
@@ -75,16 +60,15 @@ export const buildCapabilityInventory = (sessionStatus, policy, clientFeatures =
         });
         const clientRequirements = clientRequirementsFor(contract.name, clientFeatures);
         const clientBlocked = clientRequirements.missing_required.length > 0;
-        return {
+        const facts = {
             name: contract.name,
             surface: contract.kind,
-            available: availability.reason === "available" && !clientBlocked,
-            reason: clientBlocked
-                ? "client_capability_missing"
-                : availability.reason,
-            remediation: clientBlocked
-                ? `Use an MCP client that supports: ${clientRequirements.missing_required.join(", ")}.`
-                : availability.remediation,
+            ...(availability.defaultModeAvailable === undefined
+                ? {}
+                : { default_mode_available: availability.defaultModeAvailable }),
+            ...(availability.modes === undefined
+                ? {}
+                : { modes: [...availability.modes] }),
             client_requirements: clientRequirements,
             effects: { ...contract.effects },
             annotations: {
@@ -94,24 +78,31 @@ export const buildCapabilityInventory = (sessionStatus, policy, clientFeatures =
                 open_world: contract.annotations.openWorldHint ?? true,
             },
         };
+        if (clientBlocked)
+            return {
+                ...facts,
+                available: false,
+                reason: "client_capability_missing",
+                remediation: `Use an MCP client that supports: ${clientRequirements.missing_required.join(", ")}.`,
+            };
+        return availability.reason === "available"
+            ? {
+                ...facts,
+                available: true,
+                reason: availability.reason,
+                remediation: null,
+            }
+            : {
+                ...facts,
+                available: false,
+                reason: availability.reason,
+                remediation: availability.remediation,
+            };
     }).sort((left, right) => left.name.localeCompare(right.name));
 };
-const clientRequirementsFor = (name, clientFeatures) => {
-    const requirements = CLIENT_FEATURE_REQUIREMENTS[name] ?? {
-        required: [],
-        optional: [],
-    };
-    return {
-        required: [...requirements.required],
-        optional: [...requirements.optional],
-        missing_required: requirements.required.filter((feature) => !clientFeatures[feature]),
-        missing_optional: requirements.optional.filter((feature) => !clientFeatures[feature]),
-    };
-};
 const availabilityFor = (context) => {
-    const sessionComposition = SESSION_COMPOSITION_REQUIREMENTS[context.name];
-    if (sessionComposition !== undefined)
-        return composedAvailabilityFor(sessionComposition, context.descriptors);
+    if (context.name === "get_navigation_context")
+        return navigationContextAvailability(context.descriptors);
     const javascriptApplication = javascriptApplicationAvailability(context);
     if (javascriptApplication !== null)
         return javascriptApplication;
@@ -166,13 +157,9 @@ const policyAvailability = ({ name, kind, policy, }) => {
             reason: "policy_disabled",
             remediation: "Configure or grant an evidence_read root.",
         };
-    if (kind === "electron-provider")
-        return policy.electronObservationEnabled === true
-            ? { reason: "available", remediation: null }
-            : {
-                reason: "policy_disabled",
-                remediation: "Enable Electron observation and configure a loopback CDP endpoint and canonical file roots.",
-            };
+    const electron = electronPolicyAvailability(name, kind, policy);
+    if (electron !== null)
+        return electron;
     if (kind === "runtime-provider")
         return policy.v8InspectorObservationEnabled === true
             ? { reason: "available", remediation: null }
@@ -184,6 +171,23 @@ const policyAvailability = ({ name, kind, policy, }) => {
         return { reason: "available", remediation: null };
     return null;
 };
+const electronPolicyAvailability = (name, kind, policy) => {
+    if (kind !== "electron-provider")
+        return null;
+    if (name === "capture_electron_scenario")
+        return policy.electronAutomationEnabled === true
+            ? { reason: "available", remediation: null }
+            : {
+                reason: "policy_disabled",
+                remediation: "Enable active Electron automation and configure exact executable and application roots.",
+            };
+    return policy.electronObservationEnabled === true
+        ? { reason: "available", remediation: null }
+        : {
+            reason: "policy_disabled",
+            remediation: "Enable Electron observation and configure a loopback CDP endpoint and canonical file roots.",
+        };
+};
 const browserPolicyAvailability = (name, kind, policy) => {
     if (name === "capture_browser_scenario")
         return policy.browserScenarioEnabled === true
@@ -272,3 +276,70 @@ const composedAvailabilityFor = (requirements, descriptors) => {
         };
     return { reason: "available", remediation: null };
 };
+const navigationContextAvailability = (descriptors) => {
+    const modeResults = NAVIGATION_CONTEXT_MODES.map((mode) => {
+        const availability = composedAvailabilityFor(mode.requirements, descriptors);
+        if (availability.reason === "available")
+            return {
+                name: mode.name,
+                available: true,
+                reason: availability.reason,
+                missing_operations: [],
+                remediation: null,
+            };
+        return {
+            name: mode.name,
+            available: false,
+            reason: availability.reason,
+            missing_operations: mode.requirements.filter((operation) => {
+                const descriptor = descriptors.get(operation);
+                return descriptor === undefined || descriptor.available === false;
+            }),
+            remediation: availability.remediation,
+        };
+    });
+    const modes = modeResults.map((mode) => mode.available
+        ? {
+            name: mode.name,
+            available: true,
+            missing_operations: [],
+            remediation: null,
+        }
+        : {
+            name: mode.name,
+            available: false,
+            missing_operations: [...mode.missing_operations],
+            remediation: mode.remediation,
+        });
+    const availableMode = modeResults.find((mode) => mode.available);
+    const failures = modeResults.flatMap((mode) => mode.available ? [] : [mode]);
+    const failure = failures.sort((left, right) => navigationFailurePriority(left.reason) -
+        navigationFailurePriority(right.reason))[0];
+    const specificFailureRemediation = failure?.reason === "provider_missing" ? undefined : failure?.remediation;
+    const facts = {
+        defaultModeAvailable: modes[0]?.available ?? false,
+        modes,
+    };
+    if (availableMode !== undefined)
+        return { ...facts, reason: "available", remediation: null };
+    return {
+        ...facts,
+        reason: failure?.reason ?? "provider_missing",
+        remediation: specificFailureRemediation ??
+            `Configure a provider for one of: ${modes
+                .flatMap((mode) => mode.missing_operations)
+                .join(", ")}.`,
+    };
+};
+const navigationFailurePriority = (reason) => {
+    switch (reason) {
+        case "unsupported_host":
+            return 0;
+        case "provider_unavailable":
+            return 1;
+        case "provider_missing":
+            return 2;
+        default:
+            return 3;
+    }
+};

package/dist/application/CrossVersionInventory.js

@@ -6,6 +6,7 @@ import { err, ok } from "../domain/result.js";
 import { paginateArtifactInventory, } from "./ArtifactInventory.js";
 import { scanAuthorizedArtifactInventory } from "./AuthorizedArtifactInventory.js";
 import { ARTIFACT_GRAPH_PROVIDER } from "./InvestigationProviders.js";
+import { resolveArtifactIntegrityPolicy } from "./ArtifactInventory/policy.js";
 export const AUTOMATIC_RUN_LIMITATION = "Automatic cross-version runs compare shipped artifact structure only; they do not execute either version.";
 /** Start both independent version scans while preserving left/right identity. */
 export const scanVersionInventories = async (options, scanner = scanAuthorizedArtifactInventory) => {
@@ -27,12 +28,12 @@ export const scanVersions = async (input, inputRoots, signal, integrityContinueE
         if (signal?.aborted === true)
             return err(new AnalysisCancelledError("find_changed_behavior"));
         const limits = artifactLimits(input.options);
-        const integrity = {
-            mode: input.integrity_policy,
-            approved: input.integrity_continue_approved,
-            enabled: integrityContinueEnabled,
-            maxMismatches: input.max_integrity_mismatches,
-        };
+        const integrity = resolveArtifactIntegrityPolicy(input.integrity_policy === "fail"
+            ? { mode: "fail" }
+            : {
+                mode: input.integrity_policy,
+                maxMismatches: input.max_integrity_mismatches,
+            }, integrityContinueEnabled);
         return ok(await scanVersionInventories({
             leftPath: input.left_path,
             rightPath: input.right_path,

package/dist/application/ElectronActiveEvidence.js

@@ -0,0 +1,55 @@
+import { createEvidence } from "../domain/evidence.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { digestJson } from "./JavaScriptReplayPlanning.js";
+/** Create Evidence v2 without retaining arbitrary runtime argument values. */
+export const createElectronActiveEvidence = (input, result, provider) => createEvidence(undefined, provider, {
+    predicateType: "rea.electron-active-scenario/v1",
+    operation: "capture_electron_scenario",
+    parameters: parameters(input),
+    result: jsonValueSchema.parse(result),
+    confidence: "observed",
+    authority: "controlled-replay",
+    environment: {
+        id: `${result.application.electron_version}@${process.platform}`,
+        platform: process.platform,
+        architecture: process.arch,
+        isolation: "none",
+    },
+    limitations: result.limitations,
+});
+const scenarioProjection = (input) => ({
+    approved: input.approved,
+    schema_version: input.schema_version,
+    executable_path: input.executable_path,
+    application_path: input.application_path,
+    application_root: input.application_root,
+    args: redactArguments(input.args),
+    actions: input.actions.map(({ step_id, kind }) => ({ step_id, kind })),
+    limits: input.limits,
+});
+const parameters = (input) => ({
+    ...scenarioProjection(input),
+    scenario_sha256: digestJson(scenarioProjection(input)),
+});
+const redactArguments = (arguments_) => {
+    let redactNext = false;
+    return arguments_.map((argument) => {
+        if (redactNext) {
+            redactNext = false;
+            return "<redacted>";
+        }
+        if (sensitiveFlag.test(argument)) {
+            redactNext = true;
+            return argument;
+        }
+        return redactArgument(argument);
+    });
+};
+const sensitiveFlag = /^--?(?:password|token|secret|api[-_]?key|authorization|cookie)$/iu;
+const redactArgument = (argument) => {
+    if (/^--?(?:password|token|secret|api[-_]?key|authorization|cookie)=/iu.test(argument))
+        return `${argument.slice(0, argument.indexOf("=") + 1)}<redacted>`;
+    return argument.length > 256
+        ? `${argument.slice(0, 256)}<redacted>`
+        : argument;
+};

package/dist/application/ElectronActiveObservationPort.js

@@ -0,0 +1 @@
+export {};

package/dist/application/ElectronActiveObservationService.js

@@ -0,0 +1,81 @@
+import { realpath } from "node:fs/promises";
+import { digestJson } from "./JavaScriptReplayPlanning.js";
+import { AnalysisCapabilityUnavailableError, AnalysisInputError, AnalysisProtocolError, PermissionRequiredError, } from "../domain/errors.js";
+import { isPathContained } from "../domain/permissionPolicy.js";
+import { err } from "../domain/result.js";
+import { createElectronActiveEvidence } from "./ElectronActiveEvidence.js";
+const OPERATION = "capture_electron_scenario";
+const PROVIDER_ID = "rea-playwright-electron-active";
+const canonicalizeInput = async (input) => {
+    try {
+        const [executablePath, applicationPath, applicationRoot] = await Promise.all([
+            realpath(input.executable_path),
+            realpath(input.application_path),
+            realpath(input.application_root),
+        ]);
+        if (!isPathContained(applicationRoot, applicationPath))
+            return err(new AnalysisInputError(OPERATION, undefined, [
+                {
+                    path: ["application_path"],
+                    reason: "invalid_value",
+                    message: "application_path must remain beneath application_root after symlink resolution",
+                },
+            ]));
+        return {
+            ok: true,
+            value: {
+                ...input,
+                executable_path: executablePath,
+                application_path: applicationPath,
+                application_root: applicationRoot,
+            },
+        };
+    }
+    catch (cause) {
+        return err(new AnalysisInputError(OPERATION, { cause }, [
+            {
+                path: ["application_path"],
+                reason: "invalid_format",
+                message: "Electron executable, application, and root must resolve to existing paths",
+            },
+        ]));
+    }
+};
+const authorize = async (authority, input) => {
+    const canonical = await canonicalizeInput(input);
+    if (!canonical.ok)
+        return canonical;
+    if (authority === undefined)
+        return err(new AnalysisCapabilityUnavailableError(PROVIDER_ID, OPERATION, "active Electron observation permission policy is not configured"));
+    const authorized = await authority.authorize({
+        capability: "electron_automate",
+        roots: [canonical.value.application_root],
+        executables: [canonical.value.executable_path],
+        environment_names: [],
+        network: "external",
+        mount: false,
+        operation_identity: `${OPERATION}:${digestJson(canonical.value)}`,
+    }, "write");
+    if (!authorized.ok)
+        return err(authorized.error instanceof PermissionRequiredError
+            ? authorized.error
+            : new AnalysisProtocolError(authorized.error.message, {
+                cause: authorized.error,
+            }));
+    return canonical;
+};
+/** Authorize and execute one bounded, provider-owned Electron experiment. */
+export const captureElectronScenario = async (provider, authority, input, options = {}) => {
+    const authorized = await authorize(authority, input);
+    if (!authorized.ok)
+        return authorized;
+    if (provider === undefined)
+        return err(new AnalysisCapabilityUnavailableError(PROVIDER_ID, OPERATION, "active Electron observation provider is not configured"));
+    const captured = await provider.capture(authorized.value, options);
+    return captured.ok
+        ? {
+            ok: true,
+            value: createElectronActiveEvidence(authorized.value, captured.value, provider.identity()),
+        }
+        : captured;
+};

package/dist/application/EnhancedTools.js

@@ -102,32 +102,34 @@ export class EnhancedTools {
         }
     }
     #executeTracing(name, input, signal) {
-        const parsed = enhancedInputSchemas[name].safeParse(input);
+        if (name === "trace_call_path") {
+            const parsed = enhancedInputSchemas.trace_call_path.safeParse(input);
+            if (!parsed.success)
+                return invalidEnhancedInput(name, parsed.error);
+            return this.executeValidated({ name, input: parsed.data }, signal);
+        }
+        if (name === "trace_feature") {
+            const parsed = enhancedInputSchemas.trace_feature.safeParse(input);
+            if (!parsed.success)
+                return invalidEnhancedInput(name, parsed.error);
+            return this.executeValidated({ name, input: parsed.data }, signal);
+        }
+        const parsed = enhancedInputSchemas.find_code_for_string.safeParse(input);
         if (!parsed.success)
             return invalidEnhancedInput(name, parsed.error);
-        if (name === "trace_call_path")
-            return this.executeValidated({
-                name,
-                input: enhancedInputSchemas.trace_call_path.parse(parsed.data),
-            }, signal);
-        return this.executeValidated({
-            name,
-            input: enhancedInputSchemas[name].parse(parsed.data),
-        }, signal);
+        return this.executeValidated({ name, input: parsed.data }, signal);
     }
     #executeFunctionAnalysis(name, input, signal) {
-        const parsed = enhancedInputSchemas[name].safeParse(input);
+        if (name === "analyze_function") {
+            const parsed = enhancedInputSchemas.analyze_function.safeParse(input);
+            if (!parsed.success)
+                return invalidEnhancedInput(name, parsed.error);
+            return this.executeValidated({ name, input: parsed.data }, signal);
+        }
+        const parsed = enhancedInputSchemas.inspect_native_api.safeParse(input);
         if (!parsed.success)
             return invalidEnhancedInput(name, parsed.error);
-        if (name === "analyze_function")
-            return this.executeValidated({
-                name,
-                input: enhancedInputSchemas.analyze_function.parse(parsed.data),
-            }, signal);
-        return this.executeValidated({
-            name,
-            input: enhancedInputSchemas.inspect_native_api.parse(parsed.data),
-        }, signal);
+        return this.executeValidated({ name, input: parsed.data }, signal);
     }
     async #analyzeFunction(input, signal) {
         const result = await this.#call("analyze_function", input, signal);

package/dist/application/EvidenceBundleCommands.js

@@ -12,7 +12,11 @@ export const importEvidenceBundleCommand = async (path, policy) => {
     const ledger = createLedger();
     const imported = ledger.import(loaded.value);
     return imported.ok
-        ? ok({ imported: imported.value, total: ledger.export().records.length })
+        ? ok({
+            imported: imported.value.recordsAdded,
+            unknowns_added: imported.value.unknownsAdded,
+            total: ledger.export().records.length,
+        })
         : imported;
 };
 /** Validate a source bundle and atomically export canonical bytes. */

package/dist/application/EvidenceLedger.js

@@ -63,6 +63,7 @@ export class EvidenceLedger {
             pending.set(evidence.evidence_id, evidence);
         }
         const pendingUnknowns = new Map(this.#unknownRevisions);
+        let unknownsAdded = 0;
         for (const unknown of bundle.unknowns) {
             const key = unknownRevisionKey(unknown);
             const existing = pendingUnknowns.get(key);
@@ -70,6 +71,8 @@ export class EvidenceLedger {
                 existing.revision_digest !== unknown.revision_digest)
                 return err(new EvidenceIntegrityError("Conflicting unknown revision"));
             pendingUnknowns.set(key, unknown);
+            if (existing === undefined)
+                unknownsAdded += 1;
         }
         const checked = this.#validateCandidate(pending, pendingUnknowns);
         if (!checked.ok) {
@@ -81,7 +84,11 @@ export class EvidenceLedger {
         }
         const added = pending.size - this.#records.size;
         this.#commit(pending, pendingUnknowns, checked.value);
-        return ok(added);
+        return ok({
+            recordsAdded: added,
+            unknownsAdded,
+            changed: added > 0 || unknownsAdded > 0,
+        });
     }
     /** Export records in deterministic, semantically irrelevant ID order. */
     export() {

package/dist/application/JavaScriptReplayPermission.js

@@ -12,5 +12,5 @@ export const replayPermissionRequest = (input, policy) => ({
     environment_names: [],
     network: "none",
     mount: true,
-    operation_identity: `run_controlled_replay:${input.plan_digest ?? "plan"}`,
+    operation_identity: `run_controlled_replay:${input.mode === "plan" ? "plan" : input.plan_digest}`,
 });

package/dist/application/JavaScriptReplayService.js

@@ -19,10 +19,10 @@ export const runControlledReplay = async (dependencies, rawInput, options = {})
 };
 /** Plan or execute replay input already parsed by a trusted adapter. */
 export const runControlledReplayValidated = async (dependencies, input, options = {}) => {
-    const authorized = await authorizeReplay(dependencies, input, options.signal);
+    const authorized = await authorizeReplay(dependencies, dependencies.policy(), input, options.signal);
     if (!authorized.ok)
         return authorized;
-    const prepared = await prepareValidatedReplay(dependencies, input, options.signal);
+    const prepared = await prepareValidatedReplay(dependencies, authorized.value, input, options.signal);
     if (!prepared.ok)
         return prepared;
     if (isAborted(options.signal))
@@ -35,11 +35,17 @@ export const runControlledReplayValidated = async (dependencies, input, options
             evidence: null,
         }));
     if (input.plan_digest !== prepared.value.publicPlan.plan_digest)
-        return err(new ReplayPlanStaleError(input.plan_digest ?? "", prepared.value.publicPlan.plan_digest));
+        return err(new ReplayPlanStaleError(input.plan_digest, prepared.value.publicPlan.plan_digest));
     const exportContext = await authorizeReproducerExport(dependencies.authority, input, prepared.value);
     if (!exportContext.ok)
         return exportContext;
-    const executed = await executeValidatedReplay(dependencies, prepared.value, exportContext.value, options);
+    const executed = await executeValidatedReplay({
+        runner: dependencies.runner,
+        policy: authorized.value,
+        prepared: prepared.value,
+        exportContext: exportContext.value,
+        options,
+    });
     if (!executed.ok)
         return executed;
     try {
@@ -51,14 +57,14 @@ export const runControlledReplayValidated = async (dependencies, input, options
             : "Controlled replay could not establish or clean up its sandbox", { cause }));
     }
 };
-const authorizeReplay = async (dependencies, input, signal) => {
-    if (!dependencies.policy.enabled)
+const authorizeReplay = async (dependencies, policy, input, signal) => {
+    if (policy.status === "disabled")
         return err(new AnalysisCapabilityUnavailableError("rea-javascript-replay", OPERATION, "controlled replay is disabled; configure exact roots and executables before enabling it"));
     if (dependencies.authority === undefined)
         return err(new AnalysisCapabilityUnavailableError("rea-javascript-replay", OPERATION, "JavaScript replay permission policy is not configured"));
     if (isAborted(signal))
         return err(new AnalysisCancelledError(OPERATION));
-    const request = replayPermissionRequest(input, dependencies.policy);
+    const request = replayPermissionRequest(input, policy);
     const authorized = input.mode === "plan"
         ? await dependencies.authority.explain(request, "read")
         : await dependencies.authority.authorize(request, "read");
@@ -68,13 +74,13 @@ const authorizeReplay = async (dependencies, input, signal) => {
             : new AnalysisProtocolError(authorized.error.message, {
                 cause: authorized.error,
             }));
-    return ok(true);
+    return ok(policy);
 };
-const prepareValidatedReplay = async (dependencies, input, signal) => {
+const prepareValidatedReplay = async (dependencies, policy, input, signal) => {
     if (isAborted(signal))
         return err(new AnalysisCancelledError(OPERATION));
     try {
-        return ok(await prepareReplayPlan(input, dependencies.policy, dependencies.host));
+        return ok(await prepareReplayPlan(input, policy, dependencies.host));
     }
     catch (cause) {
         return err(new AnalysisCapabilityUnavailableError("rea-javascript-replay", OPERATION, cause instanceof Error ? cause.message : "replay planning failed"));
@@ -83,8 +89,6 @@ const prepareValidatedReplay = async (dependencies, input, signal) => {
 const authorizeReproducerExport = async (authority, input, prepared) => {
     if (input.reproducer_export === undefined)
         return ok(undefined);
-    if (input.reproducer_export.approved !== true)
-        return err(new AnalysisInputError(`${OPERATION}:reproducer_export`));
     if (authority === undefined)
         return err(new AnalysisCapabilityUnavailableError("rea-javascript-replay", OPERATION, "JavaScript replay permission policy is not configured"));
     const exportAuthorized = await authority.authorize({
@@ -112,7 +116,8 @@ const authorizeReproducerExport = async (authority, input, prepared) => {
         includeSources: input.reproducer_export.include_sources === true,
     });
 };
-const executeValidatedReplay = async (dependencies, prepared, exportContext, options) => {
+const executeValidatedReplay = async (context) => {
+    const { runner, policy, prepared, exportContext, options } = context;
     await options.progress?.report({
         phase: OPERATION,
         completed: 0,
@@ -122,7 +127,7 @@ const executeValidatedReplay = async (dependencies, prepared, exportContext, opt
     if (isAborted(options.signal))
         return err(new AnalysisCancelledError(OPERATION));
     try {
-        let executed = replayExecutionResultSchema.parse(await dependencies.runner.execute(prepared, dependencies.policy, options.signal));
+        let executed = replayExecutionResultSchema.parse(await runner.execute(prepared, policy, options.signal));
         await options.progress?.report({
             phase: OPERATION,
             completed: 1,
@@ -289,4 +294,7 @@ const createReplayEvidence = (prepared, executed, side, outcomes) => {
         })),
     });
 };
-const asJson = (value) => jsonValueSchema.parse(JSON.parse(JSON.stringify(controlledReplayOutputSchema.parse(value))));
+const asJson = (value) => {
+    const serialized = JSON.parse(JSON.stringify(controlledReplayOutputSchema.parse(value)));
+    return jsonValueSchema.parse(serialized);
+};