rea-agents 3.2.1 → 4.0.0

package/dist/domain/browserScenarioValues.js

@@ -1,14 +1,9 @@
 import { z } from "zod";
-import { browserAllowedOriginsSchema, browserEndpointSchema, browserOriginSchema, } from "./browserObservation.js";
+import { browserEndpointSchema, browserOriginSchema, } from "./browserObservation.js";
 export const scenarioIdentifierSchema = z
     .string()
     .regex(/^[A-Za-z][A-Za-z0-9._-]*$/u);
-const absoluteExecutablePathSchema = z
-    .string()
-    .min(1)
-    .refine((value) => value.startsWith("/") ||
-    /^[A-Za-z]:[\\/]/u.test(value) ||
-    value.startsWith("\\\\"), "Expected an absolute browser executable path");
+const browserExecutablePathSchema = z.string().trim().min(1);
 const browserScenarioBaseUrlSchema = z
     .string()
     .min(1)
@@ -23,12 +18,10 @@ const browserScenarioBaseUrlSchema = z
     }
     if ((url.protocol !== "http:" && url.protocol !== "https:") ||
         url.username !== "" ||
-        url.password !== "" ||
-        url.search !== "" ||
-        url.hash !== "") {
+        url.password !== "") {
         context.addIssue({
             code: "custom",
-            message: "Browser URLs must be HTTP(S), omit credentials, and declare query values separately",
+            message: "Browser URLs must be HTTP(S) and omit credentials",
         });
         return z.NEVER;
     }
@@ -38,7 +31,6 @@ export const browserScenarioValueSchema = z.discriminatedUnion("source", [
     z.strictObject({
         source: z.literal("literal"),
         value: z.string(),
-        classification: z.literal("public"),
     }),
     z.strictObject({
         source: z.literal("secret"),
@@ -49,7 +41,7 @@ const queryEntrySchema = z.strictObject({
     name: z.string().min(1),
     value: browserScenarioValueSchema,
 });
-/** URL whose values remain explicit public literals or declared secret references. */
+/** URL with ordinary inline details and optional structured secret query references. */
 export const browserScenarioUrlSchema = z.strictObject({
     url: browserScenarioBaseUrlSchema,
     query: z.array(queryEntrySchema).default([]),
@@ -57,17 +49,16 @@ export const browserScenarioUrlSchema = z.strictObject({
 export const browserScenarioBrowserSchema = z.discriminatedUnion("mode", [
     z.strictObject({
         mode: z.literal("launch"),
-        executable_path: absoluteExecutablePathSchema,
-        headless: z.literal(true),
-        user_data: z.literal("temporary-owned"),
-        cleanup: z.literal("close-and-delete-profile"),
+        executable_path: browserExecutablePathSchema,
+        headless: z
+            .boolean()
+            .default(true)
+            .describe("Run without a visible browser window; defaults to true and can be disabled when the host supports a display."),
     }),
     z.strictObject({
         mode: z.literal("connect"),
         cdp_endpoint: browserEndpointSchema,
         target_id: z.string().trim().min(1),
-        ownership: z.literal("external"),
-        cleanup: z.literal("disconnect-only"),
     }),
 ]);
 export const browserScenarioEnvironmentSchema = z
@@ -91,7 +82,7 @@ export const browserScenarioEnvironmentSchema = z
         .default("UTC"),
     color_scheme: z.enum(["light", "dark", "no-preference"]).default("light"),
     reduced_motion: z.enum(["reduce", "no-preference"]).default("reduce"),
-    service_workers: z.literal("block").default("block"),
+    service_workers: z.enum(["allow", "block"]).default("block"),
 })
     .default({
     viewport: { width: 1_280, height: 720, device_scale_factor: 1 },
@@ -126,7 +117,6 @@ const locatorSchema = z.discriminatedUnion("kind", [
             "textbox",
         ]),
         name: z.string().min(1),
-        exact: z.literal(true),
     }),
     z.strictObject({
         kind: z.literal("css"),
@@ -225,94 +215,14 @@ export const browserScenarioStorageSchema = z
         .default([]),
 })
     .default({ cookies: [], local_storage: [], session_storage: [] })
-    .describe("Optional initial cookies, local storage, or session storage. Defaults to empty; every supplied value and origin must be explicitly declared and approved.");
-const headerNameSchema = z
-    .string()
-    .min(1)
-    .regex(/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/u)
-    .transform((value) => value.toLowerCase());
-const replayHeaderSchema = z.strictObject({
-    name: headerNameSchema,
-    value: browserScenarioValueSchema,
-});
-const replayResponseSchema = z.discriminatedUnion("kind", [
-    z.strictObject({
-        kind: z.literal("response"),
-        status: z.number().int().min(100).max(599),
-        headers: z.array(replayHeaderSchema).default([]),
-        body: browserScenarioValueSchema.optional(),
-    }),
-    z.strictObject({
-        kind: z.literal("redirect"),
-        status: z.union([
-            z.literal(301),
-            z.literal(302),
-            z.literal(303),
-            z.literal(307),
-            z.literal(308),
-        ]),
-        destination: browserScenarioUrlSchema,
-    }),
-]);
-const replayRouteSchema = z.strictObject({
-    route_id: scenarioIdentifierSchema,
-    method: z.enum(["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]),
-    request: browserScenarioUrlSchema,
-    response: replayResponseSchema,
-});
-export const browserScenarioRequestReplaySchema = z
-    .discriminatedUnion("mode", [
-    z.strictObject({ mode: z.literal("disabled") }),
-    z.strictObject({
-        mode: z.literal("exact"),
-        unmatched: z.enum(["abort", "passthrough-approved-origins"]),
-        routes: z.array(replayRouteSchema).min(1),
-    }),
-])
-    .default({ mode: "disabled" })
-    .describe("Optional exact request replay. Defaults to disabled; replay routes and unmatched-request behavior must be explicitly declared when enabled.");
+    .describe("Optional initial cookies, local storage, or session storage. Defaults to empty; every supplied value and origin must be declared and within the allowed origins.");
 export const browserScenarioSecretSchema = z.strictObject({
     secret_id: scenarioIdentifierSchema,
-    environment_variable: z.string().regex(/^[A-Z_][A-Z0-9_]*$/u),
-    purpose: z.enum(["input", "storage", "request-replay"]),
-    redaction: z.literal("replace-with-secret-reference"),
+    environment_variable: z
+        .string()
+        .min(1)
+        .refine((name) => !name.includes("=") && !name.includes("\0"), "Environment variable names cannot contain '=' or NUL"),
 });
-const REQUIRED_REDACTED_HEADERS = [
-    "authorization",
-    "cookie",
-    "proxy-authorization",
-    "set-cookie",
-];
-const normalizedNames = () => z
-    .array(z
-    .string()
-    .trim()
-    .min(1)
-    .transform((value) => value.toLowerCase()))
-    .transform((values) => [...new Set(values)].sort());
-export const browserScenarioRedactionSchema = z
-    .strictObject({
-    secret_values: z
-        .literal("replace-with-secret-reference")
-        .default("replace-with-secret-reference"),
-    query_parameter_names: normalizedNames().default([]),
-    header_names: normalizedNames().default([...REQUIRED_REDACTED_HEADERS]),
-})
-    .superRefine(({ header_names: names }, context) => {
-    for (const required of REQUIRED_REDACTED_HEADERS)
-        if (!names.includes(required))
-            context.addIssue({
-                code: "custom",
-                path: ["header_names"],
-                message: `Required credential header ${required} must be redacted`,
-            });
-})
-    .default({
-    secret_values: "replace-with-secret-reference",
-    query_parameter_names: [],
-    header_names: [...REQUIRED_REDACTED_HEADERS],
-})
-    .describe("Redaction policy. Secret values and credential headers are always redacted; list query parameter names when a secret is used in a URL.");
 const snapshotKindSchema = z.enum([
     "screenshot",
     "dom",
@@ -340,4 +250,3 @@ export const browserScenarioCaptureSchema = z
 })
     .default({ after_each_step: [], at_end: ["url"], events: [] })
     .describe("Optional retained artifacts and event families. Defaults to only a final sanitized URL; request screenshots, DOM, accessibility, history, storage, and event capture explicitly.");
-export const browserScenarioAllowedOriginsSchema = browserAllowedOriginsSchema;

package/dist/domain/bundleComparison.js

@@ -1,8 +1,9 @@
 import { createHash } from "node:crypto";
 import { z } from "zod";
 import { parseEvidenceBundle, serializeEvidenceBundle, } from "./evidenceBundle.js";
-const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
-const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+import { digestSchema } from "./../domain/digests.js";
+import { prefixedDigestSchema } from "./../domain/digests.js";
+const evidenceIdSchema = prefixedDigestSchema("ev");
 const classificationSchema = z.enum([
     "added",
     "removed",
@@ -83,7 +84,7 @@ export const compareBundles = (leftInput, rightInput, recordPairs = []) => {
         changes,
         limitations: changes.some(({ limitations }) => limitations.length > 0)
             ? [
-                "One-sided membership proves only bundle inclusion or omission, not behavioral absence.",
+                "EvidenceBundle has no inventory completeness marker; one-sided membership remains unknown.",
             ]
             : [],
     });
@@ -121,32 +122,32 @@ const compareRecords = (left, right, pairs) => {
         });
     }
     const common = [...leftIds].filter((id) => rightIds.has(id) && !pairedLeft.has(id) && !pairedRight.has(id));
-    const removed = [...leftIds].filter((id) => !rightIds.has(id) && !pairedLeft.has(id));
-    const added = [...rightIds].filter((id) => !leftIds.has(id) && !pairedRight.has(id));
-    for (const [classification, ids, side] of [
-        ["removed", removed, "left"],
-        ["added", added, "right"],
+    const removed = [...leftIds].filter((id) => !pairedLeft.has(id) && (!rightIds.has(id) || pairedRight.has(id)));
+    const added = [...rightIds].filter((id) => !pairedRight.has(id) && (!leftIds.has(id) || pairedLeft.has(id)));
+    for (const [ids, side] of [
+        [removed, "left"],
+        [added, "right"],
     ])
         for (const id of ids)
             changes.push({
                 entity: "evidence",
                 key: id,
-                classification,
-                conclusion_kind: "observed_change",
+                classification: "unknown",
+                conclusion_kind: "unresolved_branch",
                 left_evidence_ids: side === "left" ? [id] : [],
                 right_evidence_ids: side === "right" ? [id] : [],
                 left_digest: side === "left" ? id.slice(3) : null,
                 right_digest: side === "right" ? id.slice(3) : null,
                 limitations: [
-                    "One-sided membership does not establish behavioral absence.",
+                    "EvidenceBundle has no inventory completeness marker; one-sided membership may reflect incomplete capture.",
                 ],
             });
     return {
         changes,
         summary: {
             records_unchanged: common.length + pairs.length - changed,
-            records_added: added.length,
-            records_removed: removed.length,
+            records_added: 0,
+            records_removed: 0,
             records_changed: changed,
         },
     };
@@ -167,9 +168,7 @@ const compareUnknowns = (left, right) => {
         const leftHistory = leftHistories.get(id);
         const rightHistory = rightHistories.get(id);
         if (leftHistory === undefined || rightHistory === undefined) {
-            const added = leftHistory === undefined;
-            summary[added ? "unknowns_added" : "unknowns_removed"] += 1;
-            changes.push(unknownChange(id, added ? "added" : "removed", leftHistory, rightHistory));
+            changes.push(unknownChange(id, "unknown", leftHistory, rightHistory));
             continue;
         }
         const leftDigests = leftHistory.map(({ revision_digest: digest }) => digest);
@@ -199,7 +198,9 @@ const unknownChange = (id, classification, left, right) => ({
     left_digest: left?.at(-1)?.revision_digest ?? null,
     right_digest: right?.at(-1)?.revision_digest ?? null,
     limitations: left === undefined || right === undefined
-        ? ["A missing unknown history does not establish resolution."]
+        ? [
+            "EvidenceBundle has no inventory completeness marker; one-sided history membership remains unknown.",
+        ]
         : [],
 });
 const histories = (unknowns) => {

package/dist/domain/callPathSchemas.js

@@ -1,12 +1,22 @@
 import { z } from "zod";
+import { emptyArraySchema } from "./emptyArraySchema.js";
 import { evidenceSchema } from "./evidence.js";
-const addressSchema = z.string().regex(/^0x(?:0|[1-9a-f][0-9a-f]*)$/u);
+import { prefixedDigestSchema } from "./../domain/digests.js";
+const addressSchema = z
+    .string()
+    .regex(/^(?:(?:[A-Za-z0-9._~-]|%[0-9A-F]{2})+:)?0x(?:0|[1-9a-f][0-9a-f]*)$/u);
 const inputAddressSchema = z
     .string()
-    .regex(/^0[xX][0-9a-fA-F]+$/u)
-    .transform((address) => `0x${BigInt(address).toString(16)}`);
-const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
-/** Parse a caller-supplied hexadecimal address into canonical form. */
+    .regex(/^(?:(?:[A-Za-z0-9._~-]|%[0-9a-fA-F]{2})+:)?0[xX][0-9a-fA-F]+$/u)
+    .transform((address) => {
+    const separator = address.lastIndexOf(":") + 1;
+    const space = address
+        .slice(0, separator)
+        .replace(/%[0-9a-fA-F]{2}/gu, (escape) => escape.toUpperCase());
+    return `${space}0x${BigInt(address.slice(separator)).toString(16)}`;
+});
+const evidenceIdSchema = prefixedDigestSchema("ev");
+/** Normalize a hexadecimal offset while preserving its optional address space. */
 export const parseCallPathAddress = (input) => inputAddressSchema.parse(input);
 /** Strict input for explicit call-path reconstruction from complete dossiers. */
 export const callPathInputSchema = z.object({
@@ -67,13 +77,13 @@ export const callPathResultSchema = z.union([
         status: z.literal("not_found"),
         shortest_hops: z.null(),
         search_scope: z.object({ exhaustive: z.literal(true) }),
-        paths: z.tuple([]),
+        paths: emptyArraySchema,
     }),
     z.object({
         ...resultContextShape,
         status: z.literal("unknown"),
         shortest_hops: z.null(),
         search_scope: z.object({ exhaustive: z.literal(false) }),
-        paths: z.tuple([]),
+        paths: emptyArraySchema,
     }),
 ]);

package/dist/domain/changedBehavior.js

@@ -3,7 +3,8 @@ import { artifactComparisonResultSchema } from "./artifactComparison.js";
 import { evidenceSchema, parseEvidence } from "./evidence.js";
 import { functionComparisonResultSchema } from "./functionComparison.js";
 import { comparisonStatusSchema, deriveProcessComparisonStatus, PROCESS_COMPARISON_DIMENSIONS, processCaptureComparisonSchema, } from "./processCapture.js";
-const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
+import { prefixedDigestSchema } from "./../domain/digests.js";
+const evidenceIdSchema = prefixedDigestSchema("ev");
 /** Input for aggregating existing comparison Evidence. */
 export const changedBehaviorInputSchema = z.object({
     comparisons: z.array(evidenceSchema).default([]),
@@ -179,9 +180,7 @@ const processFindings = (evidence) => {
         ["interaction", result.interaction, "runtime"],
         ["exit", result.exit, "runtime"],
         ["filesystem", result.filesystem, "resource"],
-        ["protocol", result.protocol, "protocol"],
         ["process", result.process, "runtime"],
-        ["shim", result.shim, "protocol"],
     ];
     return dimensions.flatMap(([dimension, status, scope]) => status === "unchanged"
         ? []

package/dist/domain/comparisonSemantics.js

@@ -0,0 +1,19 @@
+import { createHash } from "node:crypto";
+import canonicalize from "canonicalize";
+/** Whether an inventory can support a claim that an item is absent. */
+export const absenceClaimable = (coverage) => coverage.status === "complete" &&
+    coverage.truncated !== true &&
+    (coverage.omitted_count === undefined || coverage.omitted_count === 0);
+/** SHA-256 of canonical JSON for stable, provider-neutral comparison IDs. */
+export const canonicalDigest = (value, context = "Comparison") => {
+    return createHash("sha256")
+        .update(canonicalJson(value, context))
+        .digest("hex");
+};
+/** Canonical JSON used for deterministic tie breaking and stable digests. */
+export const canonicalJson = (value, context = "Comparison") => {
+    const encoded = canonicalize(value);
+    if (encoded === undefined)
+        throw new TypeError(`${context} could not canonicalize data`);
+    return encoded;
+};

package/dist/domain/completionLedgerGeneration.js

@@ -2,8 +2,9 @@ import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
 import { createEvidenceCompletionLedger, evidenceCompletionRecordSchema, } from "./evidenceCompletionLedger.js";
+import { digestSchema } from "./../domain/digests.js";
+import { prefixedDigestSchema } from "./../domain/digests.js";
 const identifierSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9._-]*$/u);
-const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
 const identitySchema = z.strictObject({
     id: identifierSchema,
     version: z.string().min(1),
@@ -93,7 +94,7 @@ const manifestClaimSchema = reportClaimSchema.omit({
     evidence_ids: true,
 });
 const completionManifestObjectSchema = z.strictObject({
-    manifest_id: z.string().regex(/^ecm_[a-f0-9]{64}$/u),
+    manifest_id: prefixedDigestSchema("ecm"),
     verifier: identitySchema,
     environment: environmentSchema,
     skill_digests: z.array(skillDigestSchema).min(1),

package/dist/domain/conformancePackage.js

@@ -4,7 +4,8 @@ import { z } from "zod";
 import { evidenceEnvelopeSchema } from "./evidence.js";
 import { evidenceBundleSchema } from "./evidenceBundle.js";
 import { err, ok } from "./result.js";
-const conformancePackageIdSchema = z.string().regex(/^cp_[a-f0-9]{64}$/u);
+import { prefixedDigestSchema } from "./../domain/digests.js";
+const conformancePackageIdSchema = prefixedDigestSchema("cp");
 const scenarioIdSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9._-]*$/u);
 const scenarioManifestSchema = z.strictObject({
     scenario_id: scenarioIdSchema,

package/dist/domain/conformanceTrustGate.js

@@ -265,11 +265,9 @@ function sortKeys(value) {
         return value.map(sortKeys);
     if (!isRecord(value))
         return value;
-    const sorted = {};
-    for (const key of Object.keys(value).sort()) {
-        sorted[key] = sortKeys(value[key]);
-    }
-    return sorted;
+    return Object.fromEntries(Object.keys(value)
+        .sort()
+        .map((key) => [key, sortKeys(value[key])]));
 }
 /**
  * Evaluate a trust gate for one scenario by comparing expected

package/dist/domain/customProtocolCapture.js

@@ -73,7 +73,7 @@ export const authFlowEventSchema = z.strictObject({
     token_lifecycle: tokenLifecycleEventSchema.nullable(),
     /** Correlation ID linking challenge-response pairs. */
     correlation_id: z.string().nullable(),
-    /** Whether credentials were detected and redacted. */
+    /** Whether the capture producer marked credentials as redacted. */
     credentials_redacted: z.boolean().default(false),
     /** Whether the authentication succeeded. */
     succeeded: z.boolean().default(false),
@@ -90,7 +90,7 @@ export const customProtocolCaptureSchema = z.strictObject({
     auth_events: z.array(authFlowEventSchema).default([]),
     /** Whether any frame was truncated. */
     has_truncated: z.boolean().default(false),
-    /** Whether credentials were detected. */
+    /** Whether the capture producer detected credential content. */
     credentials_detected: z.boolean().default(false),
 });
 /** Correlate a frame with process identity. */

package/dist/domain/digests.js

@@ -0,0 +1,30 @@
+import { z } from "zod";
+/**
+ * Canonical digest and identifier shapes.
+ *
+ * These were previously a hand-copied regex in ~30 modules: 32 local
+ * `digestSchema` definitions plus a distinct literal for each of roughly
+ * thirty `prefix_hash` identifier families. Nothing kept them in step, so a
+ * change to what counts as a digest had to be found and repeated by hand.
+ *
+ * One owner means the shape is stated once, and a new identifier family
+ * cannot accidentally invent its own spelling of "lowercase sha256".
+ */
+/** Lowercase hex SHA-256, as every digest in the system is emitted. */
+export const SHA256_PATTERN = /^[a-f0-9]{64}$/u;
+/** A bare artifact/content digest. */
+export const digestSchema = z.string().regex(SHA256_PATTERN);
+/**
+ * A namespaced identifier: `<prefix>_<64 lowercase hex>`. Prefixes keep
+ * identifiers from different families apart at a glance and make a
+ * mis-pasted identifier from another family fail validation rather than
+ * resolve to the wrong object.
+ */
+export const prefixedDigestSchema = (prefix) => z
+    .string()
+    .regex(new RegExp(`^${prefix}_[a-f0-9]{64}$`, "u"), `Expected a ${prefix}_ prefixed lowercase sha256 digest`);
+/** True when `value` is a bare digest. */
+export const isDigest = (value) => typeof value === "string" && SHA256_PATTERN.test(value);
+/** True when `value` is a digest carrying `prefix`. */
+export const isPrefixedDigest = (value, prefix) => typeof value === "string" &&
+    prefixedDigestSchema(prefix).safeParse(value).success;

package/dist/domain/dosMz.js

@@ -0,0 +1,83 @@
+import { err, ok } from "./result.js";
+/**
+ * Locate a Windows new-header declaration without interpreting a short DOS
+ * header's load-module or relocation-table bytes at 0x3c as e_lfanew. A
+ * new-header pointer must lie in a sufficiently large header and outside
+ * actual relocation records. Zero-sized legacy stubs remain eligible for
+ * PE signature validation.
+ */
+export const mzWindowsHeaderOffset = (bytes) => {
+    if (bytes.length < 64)
+        return null;
+    const headerBytes = bytes.readUInt16LE(8) * 16;
+    if (headerBytes !== 0 && headerBytes < 64)
+        return null;
+    const relocationCount = bytes.readUInt16LE(6);
+    const tableStart = bytes.readUInt16LE(24);
+    if (headerBytes !== 0 &&
+        relocationCount > 0 &&
+        tableStart < 64 &&
+        tableStart + relocationCount * 4 > 60)
+        return null;
+    const offset = bytes.readUInt32LE(60);
+    return offset === 0 ? null : offset;
+};
+/**
+ * Validate a DOS MZ load module using a bounded header/table and the actual
+ * file length. Appended overlay bytes are retained separately; they are not
+ * silently included in the initialized load module.
+ */
+export const parseDosMzHeader = (bytes, fileSize = bytes.length) => {
+    if (bytes.length < 28 || bytes.toString("ascii", 0, 2) !== "MZ")
+        return err("invalid or truncated DOS MZ header");
+    if (!Number.isSafeInteger(fileSize) || fileSize < bytes.length)
+        return err("invalid DOS MZ file length");
+    if (mzWindowsHeaderOffset(bytes) !== null)
+        return err("MZ declares a Windows new header; it is not a DOS-only image");
+    const lastPageBytes = bytes.readUInt16LE(2);
+    const pages = bytes.readUInt16LE(4);
+    if (pages === 0 || lastPageBytes > 511)
+        return err("invalid DOS MZ page count or final-page size");
+    const imageBytes = (pages - 1) * 512 + (lastPageBytes === 0 ? 512 : lastPageBytes);
+    const headerBytes = bytes.readUInt16LE(8) * 16;
+    if (headerBytes < 28 || headerBytes >= imageBytes)
+        return err("invalid DOS MZ header size or empty load module");
+    if (imageBytes > fileSize)
+        return err("truncated DOS MZ load module");
+    const relocationCount = bytes.readUInt16LE(6);
+    const relocationTableOffset = bytes.readUInt16LE(24);
+    const tableEnd = relocationTableOffset + relocationCount * 4;
+    if (relocationCount > 0 &&
+        (relocationTableOffset < 28 || tableEnd > headerBytes))
+        return err("DOS MZ relocation table lies outside its header");
+    if (relocationCount > 0 && tableEnd > bytes.length)
+        return err("truncated DOS MZ relocation table");
+    const moduleBytes = imageBytes - headerBytes;
+    const relocations = validateRelocations(bytes, relocationTableOffset, relocationCount, moduleBytes);
+    if (!relocations.ok)
+        return relocations;
+    const entryOffset = bytes.readUInt16LE(20);
+    const entrySegment = bytes.readUInt16LE(22);
+    if (entrySegment * 16 + entryOffset >= moduleBytes)
+        return err("DOS MZ entry point lies outside its initialized load module");
+    return ok({
+        headerBytes,
+        imageBytes,
+        moduleBytes,
+        overlayBytes: fileSize - imageBytes,
+        relocationCount,
+        relocationTableOffset,
+        entrySegment,
+        entryOffset,
+    });
+};
+const validateRelocations = (bytes, relocationTableOffset, relocationCount, moduleBytes) => {
+    for (let index = 0; index < relocationCount; index += 1) {
+        const record = relocationTableOffset + index * 4;
+        const offset = bytes.readUInt16LE(record);
+        const segment = bytes.readUInt16LE(record + 2);
+        if (segment * 16 + offset + 2 > moduleBytes)
+            return err(`DOS MZ relocation ${index} points outside its load module`);
+    }
+    return ok(undefined);
+};

package/dist/domain/electronActiveObservation.js

@@ -1,9 +1,11 @@
-import { isAbsolute } from "node:path";
 import { z } from "zod";
+const pathInputSchema = z.string().trim().min(1);
 const absolutePathSchema = z
     .string()
     .min(1)
-    .refine(isAbsolute, "path must be absolute");
+    .refine((value) => value.startsWith("/") ||
+    /^[A-Za-z]:[\\/]/u.test(value) ||
+    value.startsWith("\\\\"), "provider path must be absolute");
 const windowIndexSchema = z.number().int().min(0);
 const deepLinkUrlSchema = z
     .string()
@@ -48,9 +50,9 @@ const actionSchema = z.discriminatedUnion("kind", [
 ]);
 /** Input for one explicit, provider-owned Electron runtime experiment. */
 export const electronActiveObservationInputSchema = z.strictObject({
-    executable_path: absolutePathSchema,
-    application_path: absolutePathSchema,
-    application_root: absolutePathSchema,
+    executable_path: pathInputSchema,
+    application_path: pathInputSchema,
+    application_root: pathInputSchema.optional(),
     args: z.array(z.string()).default([]),
     actions: z.array(actionSchema).default([]),
 });

package/dist/domain/electronObservation.js

@@ -2,6 +2,7 @@ import { z } from "zod";
 import { browserCompletenessSchema } from "./browserCompleteness.js";
 import { browserEndpointSchema } from "./browserObservation.js";
 import { webTextArtifactSchema } from "./webContentArtifact.js";
+import { prefixedDigestSchema } from "./../domain/digests.js";
 const approvedElectronInput = {
     cdp_endpoint: browserEndpointSchema,
 };
@@ -82,7 +83,7 @@ export const electronPageInspectionSchema = z.object({
     scripts: z.object({
         total: z.number().int().min(0),
         items: z.array(z.object({
-            script_key: z.string().regex(/^electron_script_[a-f0-9]{64}$/u),
+            script_key: prefixedDigestSchema("electron_script"),
             frame_id: z.string().nullable().default(null),
             file_path: z.string(),
             cdp_hash: z.string(),
@@ -93,7 +94,7 @@ export const electronPageInspectionSchema = z.object({
         })),
     }),
     resources: z.array(z.object({
-        resource_key: z.string().regex(/^electron_resource_[a-f0-9]{64}$/u),
+        resource_key: prefixedDigestSchema("electron_resource"),
         file_path: z.string(),
         type: z.string(),
         mime_type: z.string(),