rea-agents 3.0.0 → 3.2.0

package/dist/application/JavaScriptArtifactPathResolution.js

@@ -10,11 +10,10 @@ const EXTENSIONS = [
     ".html",
     ".node",
 ];
-const MAX_PACKAGE_DEPTH = 4;
 const NODE_BUILTINS = new Set(builtinModules.map((name) => name.replace(/^node:/u, "")));
 /** Resolve one declaration under its exact syntax/metadata context. */
-export const resolveArtifactPathByContext = (input) => resolveAtDepth(input, 0);
-const resolveAtDepth = (input, packageDepth) => {
+export const resolveArtifactPathByContext = (input) => resolvePackagePath(input, new Set());
+const resolvePackagePath = (input, packageChain) => {
     const rejected = rejectDeclaration(input);
     if (rejected !== null)
         return rejected;
@@ -24,23 +23,21 @@ const resolveAtDepth = (input, packageDepth) => {
     const confined = confineCandidate(input, candidate);
     if (typeof confined !== "string")
         return confined;
-    const resolved = resolveCandidate(input, confined, packageDepth);
-    return outcome(input, resolved.status, resolved.resolvedPath, resolved.limitations);
+    const resolved = resolveCandidate(input, confined, packageChain);
+    return outcome(input, resolved);
 };
 const rejectDeclaration = (input) => {
     const declared = input.declaredPath;
     if (declared.length === 0)
-        return outcome(input, "rejected", null, ["The declared path is empty."]);
-    if (declared.length > 4_096)
-        return outcome(input, "rejected", null, [
-            "The declared path exceeds the 4096-character resolution bound.",
+        return unresolvedOutcome(input, "rejected", [
+            "The declared path is empty.",
         ]);
     if (declared.includes("\0") || declared.includes("\\"))
-        return outcome(input, "rejected", null, [
+        return unresolvedOutcome(input, "rejected", [
             "NUL and backslash path syntax are not admitted for canonical artifact paths.",
         ]);
     if (/%(?:2e|2f|5c)/iu.test(declared))
-        return outcome(input, "rejected", null, [
+        return unresolvedOutcome(input, "rejected", [
             "Encoded dot or separator bytes are rejected before artifact path resolution.",
         ]);
     return null;
@@ -57,14 +54,14 @@ const contextualCandidate = (input) => {
         if (fileUrl !== undefined)
             return fileUrl;
         if (hasScheme(declared))
-            return outcome(input, "external", null, [
+            return unresolvedOutcome(input, "external", [
                 "URL and Node builtin schemes are outside static artifact module resolution.",
             ]);
         if (!declared.startsWith(".") && !declared.startsWith("/"))
             return bareModuleCandidate(input, declared);
     }
     else if (hasScheme(declared))
-        return outcome(input, "external", null, [
+        return unresolvedOutcome(input, "external", [
             "URL schemes are outside this local artifact path context.",
         ]);
     const relative = declared.startsWith("/") ? declared.slice(1) : declared;
@@ -77,11 +74,11 @@ const bareModuleCandidate = (input, declared) => {
     if (packageName === null ||
         NODE_BUILTINS.has(packageName) ||
         declared.startsWith("#"))
-        return outcome(input, "external", null, [
+        return unresolvedOutcome(input, "external", [
             "The bare specifier is a Node builtin, package import map, or invalid package name.",
         ]);
     if (declared !== packageName)
-        return outcome(input, "external", null, [
+        return unresolvedOutcome(input, "external", [
             "Bare package subpaths remain unresolved unless an exact package-exports subpath model is available.",
         ]);
     const source = input.files.get(input.sourcePath);
@@ -94,7 +91,7 @@ const bareModuleCandidate = (input, declared) => {
             break;
         directory = posix.dirname(directory);
     }
-    return outcome(input, "external", null, [
+    return unresolvedOutcome(input, "external", [
         "No matching bare package was inventoried in an enclosing node_modules directory.",
     ]);
 };
@@ -115,7 +112,7 @@ const hasContainerCandidate = (files, candidate, containerSha256) => [...directC
 const htmlCandidate = (input) => {
     const declared = stripQueryAndFragment(input.declaredPath);
     if (hasScheme(declared))
-        return outcome(input, "external", null, [
+        return unresolvedOutcome(input, "external", [
             "External HTML references are not mapped to local artifact assets.",
         ]);
     if (declared.startsWith("/"))
@@ -124,7 +121,7 @@ const htmlCandidate = (input) => {
     if (base === undefined || base === null || base === "")
         return posix.join(posix.dirname(input.sourcePath), declared);
     if (hasScheme(base))
-        return outcome(input, "external", null, [
+        return unresolvedOutcome(input, "external", [
             "The document base href is external, so its script reference is not a local artifact path.",
         ]);
     const basePath = base.startsWith("/")
@@ -138,12 +135,12 @@ const confineCandidate = (input, candidate) => {
     if (normalized === ".." ||
         normalized.startsWith("../") ||
         normalized.startsWith("/"))
-        return outcome(input, "rejected", null, [
+        return unresolvedOutcome(input, "rejected", [
             "The resolved candidate escapes the canonical artifact root.",
         ]);
     return normalized === "." ? "" : normalized;
 };
-const resolveCandidate = (input, candidate, packageDepth) => {
+const resolveCandidate = (input, candidate, packageChain) => {
     const source = input.files.get(input.sourcePath);
     for (const path of directCandidates(candidate)) {
         const target = input.files.get(path);
@@ -152,14 +149,6 @@ const resolveCandidate = (input, candidate, packageDepth) => {
                 target.container_sha256 === source.container_sha256))
             return { resolvedPath: path, status: "resolved", limitations: [] };
     }
-    if (packageDepth >= MAX_PACKAGE_DEPTH)
-        return {
-            resolvedPath: null,
-            status: "unavailable",
-            limitations: [
-                `Directory package resolution exceeded its ${String(MAX_PACKAGE_DEPTH)}-package recursion bound.`,
-            ],
-        };
     const packagePath = posix.join(candidate, "package.json");
     const packageFile = input.files.get(packagePath);
     if (packageFile === undefined ||
@@ -174,28 +163,42 @@ const resolveCandidate = (input, candidate, packageDepth) => {
                 `Directory package metadata ${packagePath} was inventoried but its text is unavailable: ${packageFile.text.reason}.`,
             ],
         };
+    if (packageChain.has(packagePath))
+        return {
+            resolvedPath: null,
+            status: "unavailable",
+            limitations: [
+                `Directory package entrypoint cycle includes ${packagePath}.`,
+            ],
+        };
     const main = packageEntry(packageFile.text.value, input.moduleKind);
     if (main.status === "invalid")
         return {
             resolvedPath: null,
             status: "unavailable",
             limitations: [
-                `Directory package metadata ${packagePath} is not valid bounded package JSON.`,
+                `Directory package metadata ${packagePath} is not valid package JSON.`,
             ],
         };
     if (main.status === "missing")
         return notFoundCandidate();
-    const nested = resolveAtDepth({
+    const nested = resolvePackagePath({
         declaredPath: main.value,
         sourcePath: packagePath,
         context: "package-entrypoint",
         files: input.files,
-    }, packageDepth + 1);
-    return {
-        resolvedPath: nested.resolved_path,
-        status: nested.resolution_status,
-        limitations: nested.limitations,
-    };
+    }, new Set([...packageChain, packagePath]));
+    return nested.resolution_status === "resolved"
+        ? {
+            resolvedPath: nested.resolved_path,
+            status: nested.resolution_status,
+            limitations: nested.limitations,
+        }
+        : {
+            resolvedPath: null,
+            status: nested.resolution_status,
+            limitations: nested.limitations,
+        };
 };
 const directCandidates = (candidate) => [
     candidate,
@@ -216,7 +219,7 @@ const packageEntry = (text, moduleKind) => {
         const entry = preferred.find((candidate) => candidate !== undefined);
         if (entry === undefined)
             return { status: "missing" };
-        return boundedPackagePath(entry);
+        return packagePathValue(entry);
     }
     catch {
         return { status: "invalid" };
@@ -224,25 +227,25 @@ const packageEntry = (text, moduleKind) => {
 };
 const packageExport = (value, moduleKind) => {
     if (typeof value === "string")
-        return boundedPackagePath(value);
+        return packagePathValue(value);
     if (typeof value !== "object" || value === null || Array.isArray(value))
         return { status: "invalid" };
     const root = Reflect.get(value, ".") ?? value;
     if (typeof root === "string")
-        return boundedPackagePath(root);
+        return packagePathValue(root);
     if (typeof root !== "object" || root === null || Array.isArray(root))
         return { status: "invalid" };
     const condition = Reflect.get(root, moduleKind ?? "default") ?? Reflect.get(root, "default");
-    return boundedPackagePath(condition);
+    return packagePathValue(condition);
 };
-const boundedPackagePath = (value) => typeof value === "string" && value.length > 0 && value.length <= 4_096
+const packagePathValue = (value) => typeof value === "string" && value.length > 0
     ? { status: "value", value }
     : { status: "invalid" };
 const notFoundCandidate = () => ({
     resolvedPath: null,
     status: "not-found",
     limitations: [
-        "No bounded extension, directory package, or index candidate exists in the inventoried artifact container.",
+        "No extension, directory package, or index candidate exists in the inventoried artifact container.",
     ],
 });
 const hasScheme = (value) => /^[A-Za-z][A-Za-z+.-]*:/u.test(value);
@@ -260,10 +263,19 @@ const fileUrlPath = (value) => {
     }
 };
 const stripQueryAndFragment = (value) => value.split("#", 1)[0]?.split("?", 1)[0] ?? "";
-const outcome = (input, status, resolvedPath, limitations) => ({
-    declared_path: input.declaredPath,
-    resolution_context: input.context,
-    resolved_path: resolvedPath,
-    resolution_status: status,
-    limitations,
-});
+const outcome = (input, resolution) => resolution.status === "resolved"
+    ? {
+        declared_path: input.declaredPath,
+        resolution_context: input.context,
+        resolved_path: resolution.resolvedPath,
+        resolution_status: resolution.status,
+        limitations: resolution.limitations,
+    }
+    : {
+        declared_path: input.declaredPath,
+        resolution_context: input.context,
+        resolved_path: null,
+        resolution_status: resolution.status,
+        limitations: resolution.limitations,
+    };
+const unresolvedOutcome = (input, status, limitations) => outcome(input, { resolvedPath: null, status, limitations });

package/dist/application/JavaScriptArtifactReconstruction.js

@@ -1,12 +1,11 @@
 import { lstat, realpath } from "node:fs/promises";
-import { performance } from "node:perf_hooks";
 import { AsarArtifactReader } from "../artifacts/AsarArtifactReader.js";
 import { ArtifactReaderFailure, } from "../artifacts/ArtifactReader.js";
 import { DirectoryArtifactReader } from "../artifacts/DirectoryArtifactReader.js";
 import { analyzeJavaScriptArtifactFiles } from "./JavaScriptArtifactAnalysis.js";
 import { readJavaScriptArtifactFiles } from "./JavaScriptArtifactFiles.js";
 import { buildJavaScriptArtifactGraph } from "./JavaScriptArtifactGraphBuilder.js";
-import { artifactLimitsForReconstruction, javascriptArtifactReconstructionInputSchema, } from "./JavaScriptArtifactReconstructionInput.js";
+import { javascriptArtifactReconstructionInputSchema, } from "./JavaScriptArtifactReconstructionInput.js";
 import { scanCanonicalArtifactInventory } from "./ArtifactInventory.js";
 import { summarizeElectronBoundaries } from "./ElectronBoundaryAnalysis.js";
 import { buildJavaScriptSemanticGraph } from "./JavaScriptSemanticGraphBuilder.js";
@@ -16,15 +15,15 @@ export const reconstructJavaScriptArtifact = async (rawInput, signal) => {
     abortIfNeeded(signal);
     const path = await realpath(input.input_path);
     const format = await resolveFormat(path, input);
-    const snapshot = await scanCanonicalArtifactInventory(path, artifactLimitsForReconstruction(input), { signal });
+    const snapshot = await scanCanonicalArtifactInventory(path, { signal });
     if (snapshot.manifest.root_format !== format)
         throw new ArtifactReaderFailure("format", `Artifact inventory classified ${path} as ${snapshot.manifest.root_format}, not ${format}`);
     const reader = createReader(path, format);
     try {
-        const files = await readJavaScriptArtifactFiles(reader, snapshot, input, signal);
-        const analysis = analyzeJavaScriptArtifactFiles(files, input, () => performance.now());
+        const files = await readJavaScriptArtifactFiles(reader, snapshot, signal);
+        const analysis = analyzeJavaScriptArtifactFiles(files);
         abortIfNeeded(signal);
-        const graph = buildJavaScriptArtifactGraph(snapshot, files, analysis, input);
+        const graph = buildJavaScriptArtifactGraph(snapshot, files, analysis);
         const semanticGraph = buildJavaScriptSemanticGraph({
             rootArtifactSha256: snapshot.manifest.root_sha256,
             applicationGraph: graph,
@@ -42,11 +41,7 @@ export const reconstructJavaScriptArtifact = async (rawInput, signal) => {
             statistics: {
                 relevant_files: files.files.length,
                 nested_asar_containers: files.containers.length,
-                text_files_selected: files.text_files_selected,
                 text_bytes_read: files.text_bytes_read,
-                omitted_text_files: files.omitted_text_files,
-                limit_omitted_text_files: files.limit_omitted_text_files,
-                policy_filtered_text_files: files.policy_filtered_text_files,
                 invalid_utf8_files: files.invalid_utf8_files,
                 parsed_javascript_files: analysis.files.filter(({ javascript }) => javascript !== null).length,
                 visited_ast_nodes: analysis.visited_ast_nodes,

package/dist/application/JavaScriptArtifactReconstructionInput.js

@@ -1,18 +1,6 @@
 import { z } from "zod";
-import { JAVASCRIPT_APPLICATION_ANALYSIS_DEFAULT_LIMITS, javascriptApplicationAnalysisLimitsSchema, } from "../domain/javascriptApplicationAnalysis.js";
-/** Local ASAR/directory reconstruction request with explicit source-map authority. */
+/** Local ASAR/directory reconstruction request. */
 export const javascriptArtifactReconstructionInputSchema = z.strictObject({
-    input_path: z.string().min(1).max(16_384),
+    input_path: z.string().min(1),
     format: z.enum(["auto", "asar", "directory"]).default("auto"),
-    source_map_read_approved: z.boolean().default(false),
-    limits: javascriptApplicationAnalysisLimitsSchema.default(JAVASCRIPT_APPLICATION_ANALYSIS_DEFAULT_LIMITS),
-});
-/** Project reconstruction limits into the shared artifact traversal policy. */
-export const artifactLimitsForReconstruction = (input) => ({
-    maxEntries: input.limits.max_entries,
-    maxTotalBytes: input.limits.max_total_artifact_bytes,
-    maxEntryBytes: input.limits.max_artifact_entry_bytes,
-    maxCompressionRatio: input.limits.max_compression_ratio,
-    maxDepth: input.limits.max_depth,
-    maxPathBytes: input.limits.max_path_bytes,
 });

package/dist/application/JavaScriptJsonModules.js

@@ -26,13 +26,13 @@ export const analyzeJavaScriptJsonModule = (file) => {
     const keys = typeof value === "object" && value !== null && !Array.isArray(value)
         ? Object.keys(value).sort(compareCodePoints)
         : [];
-    const retained = keys.slice(0, 128);
+    const retained = keys;
     return {
         path: file.path,
         sha256: file.sha256,
         status: "included",
         top_level_keys: retained,
-        omitted_top_level_keys: keys.length - retained.length,
+        omitted_top_level_keys: 0,
         limitation: null,
     };
 };

package/dist/application/JavaScriptModuleRelationships.js

@@ -1,7 +1,8 @@
 import { posix } from "node:path";
+import { completeApplicationCoverage, partialApplicationCoverage, } from "../domain/javascriptApplicationEvidenceSchemas.js";
 import { addAstContainsEdge, artifactLocalIdentity, } from "./JavaScriptArtifactGraphContext.js";
-import { astObservationEvidence, completeReconstructionCoverage, partialReconstructionCoverage, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
-import { resolveArtifactPathByContext } from "./JavaScriptArtifactPathResolution.js";
+import { astObservationEvidence, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
+import { resolveArtifactPathByContext, } from "./JavaScriptArtifactPathResolution.js";
 import { projectJavaScriptExportReturnShapes } from "./JavaScriptReturnShapeProjection.js";
 /** Create one path-scoped source-module identity for every analyzed source file. */
 export const addJavaScriptSourceModules = (context) => {
@@ -14,7 +15,7 @@ export const addJavaScriptSourceModules = (context) => {
         const exports = semantic.ir.moduleLinks
             .flatMap(({ exportedName }) => exportedName === null ? [] : [exportedName])
             .sort(compareCodePoints);
-        const retainedExports = [...new Set(exports)].slice(0, 128);
+        const retainedExports = [...new Set(exports)];
         const source = context.accumulator.addNode({
             kind: "javascript-module",
             identity: artifactLocalIdentity(file.sha256, "source-module", `${file.container_sha256}:${file.path}`),
@@ -30,7 +31,7 @@ export const addJavaScriptSourceModules = (context) => {
                         import_relationships: semantic.ir.moduleLinks.filter(({ kind }) => kind === "import" || kind === "require").length,
                         export_relationships: exports.length,
                         export_names: retainedExports,
-                        omitted_export_names: Math.max(0, exports.length - retainedExports.length),
+                        omitted_export_names: 0,
                     },
                     evidence: astObservationEvidence({
                         sha256: file.sha256,
@@ -161,25 +162,25 @@ const resolveModuleTarget = (input, specifier) => {
             ? "require"
             : "import",
     });
-    const path = resolution.resolved_path;
-    const file = path === null ? undefined : input.context.filesByPath.get(path);
-    const node = path === null
-        ? undefined
-        : (input.context.sourceModuleNodes.get(path) ??
-            input.context.fileNodes.get(path));
-    if (path !== null && file !== undefined && node !== undefined)
+    if (resolution.resolution_status !== "resolved")
         return {
-            node,
-            path,
-            file,
-            status: "resolved",
+            node: unresolvedModuleNode(input, specifier, resolution.resolution_status),
+            path: null,
+            file: null,
+            status: resolution.resolution_status,
             limitations: resolution.limitations,
         };
+    const path = resolution.resolved_path;
+    const file = input.context.filesByPath.get(path);
+    const node = input.context.sourceModuleNodes.get(path) ??
+        input.context.fileNodes.get(path);
+    if (file === undefined || node === undefined)
+        throw new TypeError(`Resolved artifact path ${path} is absent from its graph context.`);
     return {
-        node: unresolvedModuleNode(input, specifier, resolution.resolution_status),
-        path: null,
-        file: null,
-        status: resolution.resolution_status,
+        node,
+        path,
+        file,
+        status: "resolved",
         limitations: resolution.limitations,
     };
 };
@@ -243,14 +244,9 @@ const relationshipEvidence = (input, operation, limitations, confidence = "high"
     limitations: [...input.semantic.ir.limitations, ...limitations],
 });
 const semanticCoverage = (semantic) => {
-    const limits = Object.entries(semantic.limits).map(([name, value]) => ({
-        name: `semantic-${camelToKebab(name)}`,
-        value,
-        unit: "items",
-    }));
     if (semantic.ir.coverage.status === "complete")
-        return completeReconstructionCoverage(limits);
-    return partialReconstructionCoverage(limits, semantic.ir.coverage.omittedCount, semantic.ir.coverage.status === "truncated");
+        return completeApplicationCoverage();
+    return partialApplicationCoverage([], semantic.ir.coverage.omittedCount);
 };
 const moduleFormat = (path, ir) => {
     const extension = posix.extname(path).toLowerCase();
@@ -282,5 +278,4 @@ const jsonStatus = (file) => {
 const isExportLink = (link) => link.kind === "export" ||
     link.kind === "re-export" ||
     link.kind === "commonjs-export";
-const camelToKebab = (value) => value.replaceAll(/([a-z])([A-Z])/gu, "$1-$2").toLowerCase();
 const compareCodePoints = (left, right) => left < right ? -1 : left > right ? 1 : 0;

package/dist/application/JavaScriptReplayPermission.js

@@ -12,5 +12,5 @@ export const replayPermissionRequest = (input, policy) => ({
     environment_names: [],
     network: "none",
     mount: true,
-    operation_identity: `run_controlled_replay:${input.plan_digest ?? "plan"}`,
+    operation_identity: `run_controlled_replay:${input.mode === "plan" ? "plan" : input.plan_digest}`,
 });

package/dist/application/JavaScriptReplayPlanning.js

@@ -11,8 +11,14 @@ const REPLAY_POLICY_DOCUMENT = Object.freeze({
     resource_manager: "systemd-user-cgroup-v2",
     nested_user_namespaces: false,
 });
+const assertReplayManifestWithinProtocolLimit = (input) => {
+    if (new TextEncoder().encode(JSON.stringify(input)).byteLength >
+        input.limits.protocol_bytes)
+        throw new RangeError("Replay plan input exceeds its protocol byte limit");
+};
 /** Read, normalize, and content-address every input to one replay experiment. */
 export const prepareReplayPlan = async (input, policy, host) => {
+    assertReplayManifestWithinProtocolLimit(input);
     const cases = replayCases(input).map((item) => ({
         ...item,
         sha256: digestJson(item.arguments),
@@ -34,7 +40,6 @@ export const prepareReplayPlan = async (input, policy, host) => {
             : prepareSide(input.right, input.limits.module_bytes, host),
     ]);
     const withoutDigest = {
-        schema_version: 1,
         policy_version: REPLAY_POLICY_VERSION,
         policy_sha256: digestJson(REPLAY_POLICY_DOCUMENT),
         network: "none",
@@ -70,14 +75,13 @@ export const prepareReplayPlan = async (input, policy, host) => {
             "Perform no host filesystem writes and expose no host or external network",
             ...(input.reproducer_export === undefined
                 ? []
-                : ["Write one separately approved reproducer after sandbox cleanup"]),
+                : ["Write one reproducer after sandbox cleanup"]),
         ],
         reproducer_export: input.reproducer_export === undefined
             ? null
             : {
                 path: input.reproducer_export.path,
                 include_sources: input.reproducer_export.include_sources,
-                authority: "evidence_write",
             },
     };
     const publicPlan = {
@@ -105,6 +109,8 @@ const prepareSide = async (side, maximumBytes, host) => {
         if (remaining <= 0)
             throw new RangeError("Replay module bytes exceed the aggregate limit");
         const source = await host.readSource(module.path, remaining);
+        if (source.bytes.byteLength > remaining)
+            throw new RangeError("Replay module bytes exceed the aggregate limit");
         totalBytes += source.bytes.byteLength;
         loaded.push({ module, source });
     }

package/dist/application/JavaScriptReplayService.js

@@ -1,7 +1,8 @@
+import { projectPermissionFailure } from "./PermissionFailure.js";
 import { z } from "zod";
 import writeFileAtomic from "write-file-atomic";
 import { controlledReplayInputSchema, replayExecutionResultSchema, controlledReplayOutputSchema, replayEvidenceSchema, } from "../domain/javascriptReplay.js";
-import { AnalysisCapabilityUnavailableError, AnalysisCancelledError, AnalysisInputError, AnalysisProtocolError, PermissionRequiredError, ReplayPlanStaleError, } from "../domain/errors.js";
+import { AnalysisCapabilityUnavailableError, AnalysisCancelledError, AnalysisInputError, AnalysisProtocolError, ReplayPlanStaleError, } from "../domain/errors.js";
 import { createEvidence } from "../domain/evidence.js";
 import { projectInputIssues } from "../domain/inputIssueProjection.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
@@ -19,10 +20,10 @@ export const runControlledReplay = async (dependencies, rawInput, options = {})
 };
 /** Plan or execute replay input already parsed by a trusted adapter. */
 export const runControlledReplayValidated = async (dependencies, input, options = {}) => {
-    const authorized = await authorizeReplay(dependencies, input, options.signal);
+    const authorized = await authorizeReplay(dependencies, dependencies.policy(), input, options.signal);
     if (!authorized.ok)
         return authorized;
-    const prepared = await prepareValidatedReplay(dependencies, input, options.signal);
+    const prepared = await prepareValidatedReplay(dependencies, authorized.value, input, options.signal);
     if (!prepared.ok)
         return prepared;
     if (isAborted(options.signal))
@@ -35,11 +36,17 @@ export const runControlledReplayValidated = async (dependencies, input, options
             evidence: null,
         }));
     if (input.plan_digest !== prepared.value.publicPlan.plan_digest)
-        return err(new ReplayPlanStaleError(input.plan_digest ?? "", prepared.value.publicPlan.plan_digest));
-    const exportContext = await authorizeReproducerExport(dependencies.authority, input, prepared.value);
+        return err(new ReplayPlanStaleError(input.plan_digest, prepared.value.publicPlan.plan_digest));
+    const exportContext = await authorizeReproducerExport(input);
     if (!exportContext.ok)
         return exportContext;
-    const executed = await executeValidatedReplay(dependencies, prepared.value, exportContext.value, options);
+    const executed = await executeValidatedReplay({
+        runner: dependencies.runner,
+        policy: authorized.value,
+        prepared: prepared.value,
+        exportContext: exportContext.value,
+        options,
+    });
     if (!executed.ok)
         return executed;
     try {
@@ -51,68 +58,41 @@ export const runControlledReplayValidated = async (dependencies, input, options
             : "Controlled replay could not establish or clean up its sandbox", { cause }));
     }
 };
-const authorizeReplay = async (dependencies, input, signal) => {
-    if (!dependencies.policy.enabled)
+const authorizeReplay = async (dependencies, policy, input, signal) => {
+    if (policy.status === "disabled")
         return err(new AnalysisCapabilityUnavailableError("rea-javascript-replay", OPERATION, "controlled replay is disabled; configure exact roots and executables before enabling it"));
     if (dependencies.authority === undefined)
         return err(new AnalysisCapabilityUnavailableError("rea-javascript-replay", OPERATION, "JavaScript replay permission policy is not configured"));
     if (isAborted(signal))
         return err(new AnalysisCancelledError(OPERATION));
-    const request = replayPermissionRequest(input, dependencies.policy);
+    const request = replayPermissionRequest(input, policy);
     const authorized = input.mode === "plan"
         ? await dependencies.authority.explain(request, "read")
         : await dependencies.authority.authorize(request, "read");
     if (!authorized.ok)
-        return err(authorized.error instanceof PermissionRequiredError
-            ? authorized.error
-            : new AnalysisProtocolError(authorized.error.message, {
-                cause: authorized.error,
-            }));
-    return ok(true);
+        return err(projectPermissionFailure(authorized.error));
+    return ok(policy);
 };
-const prepareValidatedReplay = async (dependencies, input, signal) => {
+const prepareValidatedReplay = async (dependencies, policy, input, signal) => {
     if (isAborted(signal))
         return err(new AnalysisCancelledError(OPERATION));
     try {
-        return ok(await prepareReplayPlan(input, dependencies.policy, dependencies.host));
+        return ok(await prepareReplayPlan(input, policy, dependencies.host));
     }
     catch (cause) {
         return err(new AnalysisCapabilityUnavailableError("rea-javascript-replay", OPERATION, cause instanceof Error ? cause.message : "replay planning failed"));
     }
 };
-const authorizeReproducerExport = async (authority, input, prepared) => {
+const authorizeReproducerExport = (input) => {
     if (input.reproducer_export === undefined)
         return ok(undefined);
-    if (input.reproducer_export.approved !== true)
-        return err(new AnalysisInputError(`${OPERATION}:reproducer_export`));
-    if (authority === undefined)
-        return err(new AnalysisCapabilityUnavailableError("rea-javascript-replay", OPERATION, "JavaScript replay permission policy is not configured"));
-    const exportAuthorized = await authority.authorize({
-        capability: "evidence_write",
-        roots: [input.reproducer_export.path],
-        executables: [],
-        environment_names: [],
-        network: "none",
-        mount: false,
-        operation_identity: `${OPERATION}:reproducer:${prepared.publicPlan.plan_digest}`,
-    }, "write");
-    if (!exportAuthorized.ok)
-        return err(exportAuthorized.error instanceof PermissionRequiredError
-            ? exportAuthorized.error
-            : new AnalysisProtocolError(exportAuthorized.error.message, {
-                cause: exportAuthorized.error,
-            }));
-    const canonicalExportPath = exportAuthorized.value.request.roots[0];
-    if (canonicalExportPath !== input.reproducer_export.path)
-        return err(new AnalysisInputError(`${OPERATION}:reproducer_export:path`, {
-            cause: new TypeError(`Use the canonical reproducer path: ${canonicalExportPath ?? "unavailable"}`),
-        }));
     return ok({
-        path: canonicalExportPath,
+        path: input.reproducer_export.path,
         includeSources: input.reproducer_export.include_sources === true,
     });
 };
-const executeValidatedReplay = async (dependencies, prepared, exportContext, options) => {
+const executeValidatedReplay = async (context) => {
+    const { runner, policy, prepared, exportContext, options } = context;
     await options.progress?.report({
         phase: OPERATION,
         completed: 0,
@@ -122,7 +102,7 @@ const executeValidatedReplay = async (dependencies, prepared, exportContext, opt
     if (isAborted(options.signal))
         return err(new AnalysisCancelledError(OPERATION));
     try {
-        let executed = replayExecutionResultSchema.parse(await dependencies.runner.execute(prepared, dependencies.policy, options.signal));
+        let executed = replayExecutionResultSchema.parse(await runner.execute(prepared, policy, options.signal));
         await options.progress?.report({
             phase: OPERATION,
             completed: 1,
@@ -146,7 +126,6 @@ const applyReproducerExport = async (executed, exportContext, prepared) => {
     if (exportContext === undefined || executed.cleanup.state !== "complete")
         return executed;
     const manifest = {
-        schema_version: 1,
         plan: prepared.publicPlan,
         result: executed,
         sources: exportContext.includeSources
@@ -289,4 +268,7 @@ const createReplayEvidence = (prepared, executed, side, outcomes) => {
         })),
     });
 };
-const asJson = (value) => jsonValueSchema.parse(JSON.parse(JSON.stringify(controlledReplayOutputSchema.parse(value))));
+const asJson = (value) => {
+    const serialized = JSON.parse(JSON.stringify(controlledReplayOutputSchema.parse(value)));
+    return jsonValueSchema.parse(serialized);
+};