rea-agents 3.0.0 → 3.2.0

package/dist/application/JavaScriptReturnShapeProjection.js

@@ -1,9 +1,6 @@
 import { jsonObjectSchema, jsonValueSchema } from "../domain/jsonValue.js";
+import { partialApplicationCoverage, truncatedApplicationCoverage, } from "../domain/javascriptApplicationEvidenceSchemas.js";
 import { flattenSemanticReturnValue } from "../domain/javascriptSemanticReturns.js";
-import { partialReconstructionCoverage } from "./JavaScriptArtifactGraphEvidence.js";
-const MAX_PROJECTED_RETURN_SHAPES = 32;
-const MAX_PROJECTED_RETURN_FIELDS = 64;
-const MAX_PROJECTED_PROPERTY_COVERAGE = 64;
 /** Project one exact export/callable link into shallow bounded graph values. */
 export const projectJavaScriptExportReturnShapes = (input) => {
     if (input.link.callableId === null || input.link.exportedName === null)
@@ -19,26 +16,13 @@ export const projectJavaScriptExportReturnShapes = (input) => {
     const complete = input.baseCoverage.status === "complete" &&
         callable.returnCoverage.status === "complete" &&
         projectionOmitted === 0;
+    const limits = input.baseCoverage.limits;
+    const omitted = semanticOmitted === null ? null : semanticOmitted + projectionOmitted;
     const coverage = complete
         ? input.baseCoverage
-        : partialReconstructionCoverage([
-            ...input.baseCoverage.limits,
-            {
-                name: "return-shape-sites",
-                value: MAX_PROJECTED_RETURN_SHAPES,
-                unit: "items",
-            },
-            {
-                name: "return-shape-fields",
-                value: MAX_PROJECTED_RETURN_FIELDS,
-                unit: "items",
-            },
-            {
-                name: "return-shape-property-coverage",
-                value: MAX_PROJECTED_PROPERTY_COVERAGE,
-                unit: "items",
-            },
-        ], semanticOmitted === null ? null : semanticOmitted + projectionOmitted, callable.returnCoverage.status === "truncated" || projectionOmitted > 0);
+        : projectionOmitted > 0
+            ? truncatedApplicationCoverage(limits, omitted)
+            : partialApplicationCoverage(limits, omitted);
     const limitations = [
         ...input.ir.limitations,
         "Return shapes are inferred from inert syntax and do not prove runtime behavior.",
@@ -47,9 +31,6 @@ export const projectJavaScriptExportReturnShapes = (input) => {
                 "No direct return value was retained; runtime return behavior remains unknown.",
             ]
             : []),
-        ...(projectionOmitted > 0
-            ? ["Return-shape graph projection reached explicit retention limits."]
-            : []),
     ];
     return {
         properties: jsonObjectSchema.parse({
@@ -76,25 +57,14 @@ export const projectJavaScriptExportReturnShapes = (input) => {
     };
 };
 const projectReturnSites = (callable) => {
-    let retainedFields = 0;
-    let retainedCoverage = 0;
-    let omittedFields = 0;
-    let omittedCoverage = 0;
-    const retainedSites = callable.returnSites.slice(0, MAX_PROJECTED_RETURN_SHAPES);
+    const retainedSites = callable.returnSites;
     const shapes = retainedSites.map((site) => {
         const flattened = flattenSemanticReturnValue(site.value);
-        const remainingFields = Math.max(0, MAX_PROJECTED_RETURN_FIELDS - retainedFields);
-        const fields = flattened.fields.slice(0, remainingFields).map((field) => ({
+        const fields = flattened.fields.map((field) => ({
             ...field,
             value: jsonValueSchema.parse(field.value),
         }));
-        retainedFields += fields.length;
-        omittedFields += flattened.fields.length - fields.length;
-        const remainingCoverage = Math.max(0, MAX_PROJECTED_PROPERTY_COVERAGE - retainedCoverage);
-        const propertyCoverage = flattened.propertyCoverage.slice(0, remainingCoverage);
-        retainedCoverage += propertyCoverage.length;
-        omittedCoverage +=
-            flattened.propertyCoverage.length - propertyCoverage.length;
+        const propertyCoverage = flattened.propertyCoverage;
         return {
             source_range: site.location,
             value_status: site.value.status,
@@ -104,8 +74,8 @@ const projectReturnSites = (callable) => {
     });
     return {
         shapes,
-        omittedSites: callable.returnSites.length - retainedSites.length,
-        omittedFields,
-        omittedCoverage,
+        omittedSites: 0,
+        omittedFields: 0,
+        omittedCoverage: 0,
     };
 };

package/dist/application/JavaScriptRuntimeObservationEvidence.js

@@ -1,10 +1,10 @@
 import { createEvidence, } from "../domain/evidence.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
-/** Create deterministic Evidence v2 for one passive Inspector operation. */
+/** Create deterministic Evidence for one passive Inspector operation. */
 export const createJavaScriptRuntimeObservationEvidence = (operation, input, result, provider) => createEvidence(undefined, provider, {
     predicateType: operation === "list_javascript_runtime_targets"
-        ? "rea.javascript-runtime-target-list/v1"
-        : "rea.javascript-runtime-observation/v1",
+        ? "rea.javascript-runtime-target-list"
+        : "rea.javascript-runtime-observation",
     operation,
     parameters: parameters(input),
     result: jsonValueSchema.parse(result),
@@ -21,14 +21,13 @@ export const createJavaScriptRuntimeObservationEvidence = (operation, input, res
 });
 const parameters = (input) => ({
     inspector_endpoint: input.inspector_endpoint,
-    allowed_file_roots: input.allowed_file_roots,
-    allowed_origins: input.allowed_origins,
     ...("target_id" in input
         ? {
             target_id: input.target_id,
-            runtime_kind: input.runtime_kind,
+            ...(input.runtime_kind === undefined
+                ? {}
+                : { runtime_kind: input.runtime_kind }),
             observation_ms: input.observation_ms,
-            limits: input.limits,
         }
-        : { offset: input.offset, limit: input.limit }),
+        : {}),
 });

package/dist/application/JavaScriptRuntimeObservationService.js

@@ -1,5 +1,6 @@
+import { projectPermissionFailure } from "./PermissionFailure.js";
 import { createJavaScriptRuntimeObservationEvidence } from "./JavaScriptRuntimeObservationEvidence.js";
-import { AnalysisCapabilityUnavailableError, AnalysisProtocolError, PermissionRequiredError, } from "../domain/errors.js";
+import { AnalysisCapabilityUnavailableError, } from "../domain/errors.js";
 import { err, ok } from "../domain/result.js";
 /** Authorize and list attachable Node/Electron Inspector targets. */
 export const listJavaScriptRuntimeTargets = async (provider, authority, input, options = {}) => {
@@ -26,20 +27,15 @@ const prepare = async (provider, authority, input, operation) => {
         return err(new AnalysisCapabilityUnavailableError("rea-v8-inspector", operation, "V8 Inspector observation permission policy is not configured"));
     const authorized = await authority.authorize({
         capability: "v8_inspector_observe",
-        roots: input.allowed_file_roots,
+        roots: [],
         executables: [],
         environment_names: [],
-        origins: [input.inspector_endpoint, ...input.allowed_origins],
         network: "loopback",
         mount: false,
         operation_identity: `${operation}:${"target_id" in input ? input.target_id : input.inspector_endpoint}`,
     }, "read");
     if (!authorized.ok)
-        return err(authorized.error instanceof PermissionRequiredError
-            ? authorized.error
-            : new AnalysisProtocolError(authorized.error.message, {
-                cause: authorized.error,
-            }));
+        return err(projectPermissionFailure(authorized.error));
     return provider === undefined
         ? err(new AnalysisCapabilityUnavailableError("rea-v8-inspector", operation, "V8 Inspector observation provider is not configured"))
         : ok(provider);

package/dist/application/JavaScriptRuntimeReconciliationEvidence.js

@@ -1,9 +1,9 @@
 import { createEvidence, } from "../domain/evidence.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { JAVASCRIPT_RUNTIME_RECONCILIATION_PROVIDER } from "./InvestigationProviders.js";
-/** Create derived Evidence v2 for one exact set of static/runtime inputs. */
+/** Create derived Evidence for one exact set of static/runtime inputs. */
 export const createJavaScriptRuntimeReconciliationEvidence = (input, result) => createEvidence(undefined, JAVASCRIPT_RUNTIME_RECONCILIATION_PROVIDER, {
-    predicateType: "rea.javascript-runtime-reconciliation/v1",
+    predicateType: "rea.javascript-runtime-reconciliation",
     operation: "reconcile_javascript_runtime",
     parameters: parameters(input),
     result: jsonValueSchema.parse(result),
@@ -21,5 +21,4 @@ const parameters = (input) => ({
         runtime_mappings: layer.runtime_mappings,
     })),
     runtime_evidence_ids: input.runtime_observations.map(({ evidence_id: id }) => id),
-    limits: input.limits,
 });

package/dist/application/JavaScriptSemanticGraphBuilder.js

@@ -9,10 +9,10 @@ import { projectSemanticObjects } from "./JavaScriptSemanticGraphObjectProjectio
 import { projectSemanticValues } from "./JavaScriptSemanticGraphValueProjection.js";
 import { inferredSemanticEvidenceAt } from "./JavaScriptSemanticGraphEvidence.js";
 import { projectSemanticFunctionFingerprints } from "./JavaScriptSemanticGraphFingerprintProjection.js";
-import { projectSemanticClosureCaptures, projectSemanticFrontiers, projectSemanticPromises, projectSemanticReturnValues, semanticRecoveryLimits, } from "./JavaScriptSemanticGraphFlowProjection.js";
+import { projectSemanticClosureCaptures, projectSemanticFrontiers, projectSemanticPromises, projectSemanticReturnValues, } from "./JavaScriptSemanticGraphFlowProjection.js";
 import { owningSemanticCallableNode, semanticFamilyStatus, semanticNodesWithinRange, } from "./JavaScriptSemanticGraphProjection.js";
-import { addSemanticFallbackRoot as addFallbackRoot, addSemanticGraphNode as addNode, addSemanticGraphRelation as addRelation, constructSemanticGraphNode as semanticNode, createSemanticGraphProjectionState as emptyState, MAX_APPLICATION_NODE_IDS_PER_SEMANTIC_NODE, MAX_SEMANTIC_GRAPH_NODES, MAX_SEMANTIC_GRAPH_RELATIONS, MAX_SEMANTIC_GRAPH_UNKNOWNS, } from "./JavaScriptSemanticGraphConstruction.js";
-/** Project bounded per-file semantic IR into an artifact-bound companion graph. */
+import { addSemanticFallbackRoot as addFallbackRoot, addSemanticGraphNode as addNode, addSemanticGraphRelation as addRelation, constructSemanticGraphNode as semanticNode, createSemanticGraphProjectionState as emptyState, } from "./JavaScriptSemanticGraphConstruction.js";
+/** Project per-file semantic IR into an artifact-bound companion graph. */
 export const buildJavaScriptSemanticGraph = ({ rootArtifactSha256, applicationGraph, analysis, }) => {
     const state = emptyState(applicationGraph);
     const fingerprints = [];
@@ -23,12 +23,9 @@ export const buildJavaScriptSemanticGraph = ({ rootArtifactSha256, applicationGr
     }
     if (state.roots.size === 0)
         addFallbackRoot(rootArtifactSha256, state);
-    const semanticTruncated = analysis.files.some(({ semantic }) => semantic?.ir.coverage.status === "truncated");
-    const truncated = state.limitsReached.size > 0 || semanticTruncated;
     const unknowns = [...state.unknowns.values()];
     return createJavaScriptSemanticGraph({
         schema: "JavaScriptSemanticRelationGraph",
-        schema_version: 1,
         root_artifact_sha256: rootArtifactSha256,
         application_graph_id: applicationGraph.graph_id,
         root_node_ids: [...state.roots],
@@ -37,38 +34,16 @@ export const buildJavaScriptSemanticGraph = ({ rootArtifactSha256, applicationGr
         fingerprints,
         unknowns,
         coverage: {
-            status: truncated ? "partial" : "unknown",
-            truncated,
-            omitted_nodes: truncated ? null : 0,
-            omitted_relations: truncated ? null : 0,
-            limits: [
-                {
-                    name: "max_nodes",
-                    value: MAX_SEMANTIC_GRAPH_NODES,
-                    unit: "items",
-                },
-                {
-                    name: "max_relations",
-                    value: MAX_SEMANTIC_GRAPH_RELATIONS,
-                    unit: "items",
-                },
-                {
-                    name: "max_unknowns",
-                    value: MAX_SEMANTIC_GRAPH_UNKNOWNS,
-                    unit: "items",
-                },
-                {
-                    name: "max_application_node_ids_per_semantic_node",
-                    value: MAX_APPLICATION_NODE_IDS_PER_SEMANTIC_NODE,
-                    unit: "items",
-                },
-                ...semanticRecoveryLimits(analysis),
-            ],
+            status: "unknown",
+            truncated: false,
+            omitted_nodes: 0,
+            omitted_relations: 0,
+            limits: [],
             families: JAVASCRIPT_SEMANTIC_RELATION_FAMILIES.map((family) => ({
                 family,
-                status: semanticFamilyStatus(family, analysis, truncated),
+                status: semanticFamilyStatus(family, analysis),
                 retained_relations: [...state.relations.values()].filter((relation) => JAVASCRIPT_SEMANTIC_RELATION_FAMILY[relation.relation] === family).length,
-                omitted_relations: truncated ? null : 0,
+                omitted_relations: 0,
                 unknown_ids: unknowns
                     .filter((unknown) => unknown.family === family)
                     .map(({ unknown_id: identifier }) => identifier),
@@ -78,7 +53,7 @@ export const buildJavaScriptSemanticGraph = ({ rootArtifactSha256, applicationGr
             "The semantic graph contains static syntax observations and conservative relationship candidates; it does not claim runtime execution.",
             "Local data flow does not claim control-flow-sensitive reaching definitions or arbitrary dynamic property resolution.",
             "Promise ownership covers explicit unshadowed Promise construction, static factories, aggregation, chaining, and await syntax only.",
-            "Function fingerprints are bounded static candidates; equal digests can remain ambiguous and do not prove behavioral equivalence.",
+            "Function fingerprints are static candidates; equal digests can remain ambiguous and do not prove behavioral equivalence.",
             "Event extraction covers EventEmitter-style literal registrations, removals, and dispatch candidates; dynamic names remain unknown.",
             "Timer extraction covers global or node:timers scheduling and exact local-handle cancellation.",
             "Child-process extraction covers asynchronous node:child_process creation, literal argv/env/stdio options, exit/error listeners, and kill signals.",
@@ -86,11 +61,6 @@ export const buildJavaScriptSemanticGraph = ({ rootArtifactSha256, applicationGr
             "Request extraction covers fetch, WebSocket, node:http/node:https construction, direct option fields, and exact local response consumers.",
             "Boundary extraction covers unshadowed JSON/global coercions plus parse and validation method candidates.",
             "Resource extraction covers built-in filesystem/network acquisition and exact local close/destroy/end handles.",
-            ...(truncated
-                ? [
-                    "Semantic graph projection reached one or more explicit hard limits.",
-                ]
-                : []),
         ],
     });
 };

package/dist/application/JavaScriptSemanticGraphConstruction.js

@@ -1,13 +1,5 @@
 import { createJavaScriptSemanticGraphNode, createJavaScriptSemanticGraphRelation, } from "../domain/javascriptSemanticGraph.js";
 import { inferredSemanticEvidence, observedSemanticEvidence, unavailableSemanticRootEvidence, } from "./JavaScriptSemanticGraphEvidence.js";
-/** Hard semantic graph node bound enforced during artifact projection. */
-export const MAX_SEMANTIC_GRAPH_NODES = 100_000;
-/** Hard semantic graph relation bound enforced during artifact projection. */
-export const MAX_SEMANTIC_GRAPH_RELATIONS = 200_000;
-/** Hard unresolved-frontier bound enforced across all analyzed files. */
-export const MAX_SEMANTIC_GRAPH_UNKNOWNS = 100_000;
-/** Maximum structural nodes linked to one exact semantic location. */
-export const MAX_APPLICATION_NODE_IDS_PER_SEMANTIC_NODE = 64;
 /** Create empty projection state with structural application-node mappings. */
 export const createSemanticGraphProjectionState = (applicationGraph) => {
     const index = indexApplicationNodes(applicationGraph.nodes);
@@ -16,7 +8,6 @@ export const createSemanticGraphProjectionState = (applicationGraph) => {
         relations: new Map(),
         unknowns: new Map(),
         roots: new Set(),
-        limitsReached: new Set(index.truncated ? ["max_application_node_ids_per_semantic_node"] : []),
         applicationNodeIdsByLocation: index.identifiers,
     };
 };
@@ -35,19 +26,15 @@ export const constructSemanticGraphNode = (file, input, state) => createJavaScri
     properties: input.properties ?? {},
     evidence: observedSemanticEvidence(file, input.location),
 });
-/** Retain one canonical node unless the hard graph bound was reached. */
+/** Retain one canonical semantic node. */
 export const addSemanticGraphNode = (state, node) => {
     const existing = state.nodes.get(node.node_id);
     if (existing !== undefined)
         return existing;
-    if (state.nodes.size >= MAX_SEMANTIC_GRAPH_NODES) {
-        state.limitsReached.add("max_nodes");
-        return null;
-    }
     state.nodes.set(node.node_id, node);
     return node;
 };
-/** Retain one non-self semantic relationship unless its hard bound was reached. */
+/** Retain one non-self semantic relationship. */
 export const addSemanticGraphRelation = (state, input) => {
     if (input.source === undefined ||
         input.source === null ||
@@ -65,20 +52,12 @@ export const addSemanticGraphRelation = (state, input) => {
     });
     if (state.relations.has(value.relation_id))
         return;
-    if (state.relations.size >= MAX_SEMANTIC_GRAPH_RELATIONS) {
-        state.limitsReached.add("max_relations");
-        return;
-    }
     state.relations.set(value.relation_id, value);
 };
-/** Retain one unresolved frontier unless the global graph bound was reached. */
+/** Retain one unresolved frontier. */
 export const addSemanticGraphUnknown = (state, unknown) => {
     if (state.unknowns.has(unknown.unknown_id))
         return;
-    if (state.unknowns.size >= MAX_SEMANTIC_GRAPH_UNKNOWNS) {
-        state.limitsReached.add("max_unknowns");
-        return;
-    }
     state.unknowns.set(unknown.unknown_id, unknown);
 };
 /** Add a truthful root when no source file could produce semantic IR. */
@@ -118,14 +97,11 @@ const indexApplicationNodes = (nodes) => {
             }
         }
     }
-    let truncated = false;
     const indexed = new Map([...identifiers].map(([key, values]) => {
         const sorted = [...values].sort();
-        if (sorted.length > MAX_APPLICATION_NODE_IDS_PER_SEMANTIC_NODE)
-            truncated = true;
-        return [key, sorted.slice(0, MAX_APPLICATION_NODE_IDS_PER_SEMANTIC_NODE)];
+        return [key, sorted];
     }));
-    return { identifiers: indexed, truncated };
+    return { identifiers: indexed };
 };
 const matchingApplicationNodeIds = (file, input, state) => [
     ...(state.applicationNodeIdsByLocation.get(applicationLocationKey(file.sha256, file.path, input.location)) ?? []),

package/dist/application/JavaScriptSemanticGraphEvidence.js

@@ -1,4 +1,4 @@
-const INFERENCE_LIMITATION = "This relationship is a bounded static candidate; it does not prove runtime execution or causal flow.";
+const INFERENCE_LIMITATION = "This relationship is a conservative static candidate; it does not prove runtime execution or causal flow.";
 /** Exact artifact-backed syntax evidence for one semantic graph node. */
 export const observedSemanticEvidence = (file, location) => ({
     authority: "ast-static-analysis",

package/dist/application/JavaScriptSemanticGraphFingerprintProjection.js

@@ -8,7 +8,7 @@ export const projectSemanticFunctionFingerprints = (file, ir, callableNodes) =>
     return [
         createJavaScriptSemanticFingerprint({
             function_node_id: callable.node_id,
-            algorithm: "rea.javascript-semantic-function/v1",
+            algorithm: "rea.javascript-semantic-function",
             status: fingerprint.status,
             components: {
                 parameter_arity: fingerprint.components.parameterArity,

package/dist/application/JavaScriptSemanticGraphFlowProjection.js

@@ -178,16 +178,3 @@ export const projectSemanticFrontiers = (context) => {
         addSemanticGraphUnknown(context.state, unknown);
     }
 };
-/** Publish exact semantic analyzer limits reached by any admitted source file. */
-export const semanticRecoveryLimits = (analysis) => {
-    const limits = new Map();
-    for (const { semantic } of analysis.files) {
-        if (semantic === null)
-            continue;
-        for (const name of semantic.ir.coverage.limitsReached)
-            limits.set(`semantic.${name}`, semantic.limits[name]);
-    }
-    return [...limits]
-        .sort(([left], [right]) => left.localeCompare(right))
-        .map(([name, value]) => ({ name, value, unit: "items" }));
-};

package/dist/application/JavaScriptSemanticGraphProjection.js

@@ -14,7 +14,7 @@ export const owningSemanticCallableNode = (location, ir, nodes) => {
 export const semanticNodesWithinRange = (nodes, range) => nodes.filter((node) => node.identity.source_range !== null &&
     contains(range, node.identity.source_range));
 /** Report extractor support without treating missing families as absence. */
-export const semanticFamilyStatus = (family, analysis, truncated) => {
+export const semanticFamilyStatus = (family, analysis) => {
     if (![
         "call-flow",
         "boundary",
@@ -30,8 +30,6 @@ export const semanticFamilyStatus = (family, analysis, truncated) => {
         "timer",
     ].includes(family))
         return "unsupported";
-    if (truncated)
-        return "unknown";
     return analysis.truncated_scopes === 0 ? "partial" : "unknown";
 };
 const contains = (outer, inner) => pointCompare(outer.start, inner.start) <= 0 &&

package/dist/application/JavaScriptSemanticTraceService.js

@@ -2,7 +2,6 @@ import { z } from "zod";
 import { AnalysisInputError, AnalysisProtocolError, } from "../domain/errors.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { queryJavaScriptSemanticGraph } from "../domain/javascriptSemanticQuery.js";
-import { JavaScriptSemanticQueryCursorError } from "../domain/javascriptSemanticQueryIdentity.js";
 import { javaScriptSemanticTraceResultSchema, traceJavaScriptSemanticsInputSchema, } from "../domain/javascriptSemanticTraceSchemas.js";
 import { err, ok } from "../domain/result.js";
 import { parseApplicationGraphEvidence } from "./JavaScriptApplicationEvidenceGraph.js";
@@ -17,7 +16,7 @@ export const traceJavaScriptSemanticsEvidenceValidated = (input) => {
                 {
                     path: ["application"],
                     reason: "invalid_value",
-                    expected: "analyze_javascript_application v2 Evidence; reanalyze the artifact with the current REA version",
+                    expected: "inline Evidence from analyze_javascript_application with a semantic graph",
                 },
             ]));
         const query = queryJavaScriptSemanticGraph(source.semanticGraph, input.query);
@@ -32,14 +31,6 @@ export const traceJavaScriptSemanticsEvidenceValidated = (input) => {
         }, result));
     }
     catch (cause) {
-        if (cause instanceof JavaScriptSemanticQueryCursorError)
-            return err(new AnalysisInputError(OPERATION, undefined, [
-                {
-                    path: ["query", "cursor"],
-                    reason: "invalid_value",
-                    expected: "a cursor returned by the same graph, query, and limits",
-                },
-            ]));
         return err(new AnalysisProtocolError("JavaScript semantic trace failed", { cause }));
     }
 };

package/dist/application/JsonFiles.js

@@ -0,0 +1,79 @@
+import { link, lstat, mkdtemp, readFile, realpath, rm } from "node:fs/promises";
+import { basename, dirname, resolve } from "node:path";
+import writeFileAtomic from "write-file-atomic";
+import { EvidenceFileError } from "../domain/errors.js";
+import { err, ok } from "../domain/result.js";
+/** Read JSON data from a regular file at the caller-supplied path. */
+export const readJsonFile = async (path) => {
+    try {
+        const canonicalPath = await realpath(resolve(path));
+        const stats = await lstat(canonicalPath);
+        if (!stats.isFile())
+            return err(new EvidenceFileError("read", "not-file"));
+        const encoded = await readFile(canonicalPath);
+        let decoded;
+        try {
+            decoded = JSON.parse(encoded.toString("utf8"));
+        }
+        catch (cause) {
+            return err(new EvidenceFileError("read", "invalid-json", { cause }));
+        }
+        return ok(decoded);
+    }
+    catch (cause) {
+        return err(new EvidenceFileError("read", "io", { cause }));
+    }
+};
+/** Atomically write text to the caller-supplied path. */
+export const writeTextFile = async (encoded, path, overwrite) => {
+    const bytes = Buffer.byteLength(encoded, "utf8");
+    try {
+        const requestedPath = resolve(path);
+        const canonicalParent = await realpath(dirname(requestedPath));
+        const destination = resolve(canonicalParent, basename(requestedPath));
+        const existing = await lstat(destination).catch((cause) => {
+            if (fileErrorCode(cause) === "ENOENT")
+                return undefined;
+            throw cause;
+        });
+        if (existing !== undefined) {
+            if (!overwrite)
+                return err(new EvidenceFileError("write", "exists"));
+            if (!existing.isFile() || existing.isSymbolicLink())
+                return err(new EvidenceFileError("write", "not-file"));
+        }
+        if (overwrite)
+            await writeFileAtomic(destination, encoded, {
+                encoding: "utf8",
+                mode: 0o600,
+                fsync: true,
+            });
+        else
+            await publishNewFile(destination, encoded);
+        return ok({ path: requestedPath, bytes });
+    }
+    catch (cause) {
+        if (!overwrite && fileErrorCode(cause) === "EEXIST")
+            return err(new EvidenceFileError("write", "exists", { cause }));
+        return err(new EvidenceFileError("write", "io", { cause }));
+    }
+};
+const publishNewFile = async (destination, encoded) => {
+    const stagingDirectory = await mkdtemp(resolve(dirname(destination), ".rea-write-"));
+    try {
+        const staged = resolve(stagingDirectory, "content");
+        await writeFileAtomic(staged, encoded, {
+            encoding: "utf8",
+            mode: 0o600,
+            fsync: true,
+        });
+        // A hard link publishes complete bytes atomically and cannot replace an existing name.
+        await link(staged, destination);
+    }
+    finally {
+        await rm(stagingDirectory, { recursive: true, force: true });
+    }
+};
+const fileErrorCode = (cause) => typeof cause === "object" && cause !== null && "code" in cause
+    ? cause.code
+    : undefined;

package/dist/application/LinuxHopper.js

@@ -5,6 +5,7 @@ import { access, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { promisify } from "node:util";
+import { execFileOutput } from "../process/ExecFileOutput.js";
 const execFileAsync = promisify(execFile);
 const DOWNLOAD_PREFIX = "https://www.hopperapp.com:443/downloader/public/";
 const MAX_PACKAGE_BYTES = 100_000_000;
@@ -55,15 +56,17 @@ export const parseLinuxDistribution = (text) => {
     const id = (fields.get("ID") ?? "unknown").toLowerCase();
     const versionId = fields.get("VERSION_ID");
     const packageFamily = packageFamilyFor(id, fields.get("ID_LIKE"));
-    const supported = id === "arch" ||
-        (id === "ubuntu" && versionAtLeast(versionId, 24)) ||
-        (id === "fedora" && versionAtLeast(versionId, 41));
-    return {
+    const supported = packageFamily !== undefined &&
+        (id === "arch" ||
+            (id === "ubuntu" && versionAtLeast(versionId, 24)) ||
+            (id === "fedora" && versionAtLeast(versionId, 41)));
+    const identity = {
         id,
         ...(versionId === undefined ? {} : { versionId }),
-        packageFamily,
-        supported,
     };
+    return supported
+        ? { ...identity, packageFamily, supported: true }
+        : { ...identity, packageFamily, supported: false };
 };
 /** Read and classify the current Linux distribution. */
 export const readLinuxDistribution = async () => {
@@ -79,8 +82,7 @@ export const installLinuxHopper = async (host = systemLinuxHopperInstallHost(),
     if (options.signal?.aborted === true)
         return { status: "failed", reason: "cancelled" };
     const distribution = await host.distribution();
-    if (distribution?.supported !== true ||
-        distribution.packageFamily === undefined)
+    if (distribution?.supported !== true)
         return { status: "failed", reason: "unsupported_host" };
     let temporary;
     try {
@@ -134,7 +136,7 @@ const systemLinuxHopperInstallHost = () => ({
     async launcherStatus(path) {
         try {
             await access(path);
-            const linked = await execFileAsync("ldd", [path]);
+            const linked = await execFileOutput("ldd", [path]);
             if (!linuxSharedLibrariesAvailable(`${linked.stdout}\n${linked.stderr}`))
                 return "runtime_dependencies";
             return (await linuxHopperBinarySupported(path))