rea-agents 3.2.1 → 4.0.0

package/dist/domain/javascriptStaticAnalysisCalls.js

@@ -1,7 +1,7 @@
 import * as t from "@babel/types";
 import { sanitizeEndpointCandidate } from "./browserObservation.js";
 import { addFindingOnce, addLocatedFinding, moduleAtOffset, } from "./javascriptStaticAnalysisFindings.js";
-import { STATIC_ROUTE_CALL_NAMES, argumentValue, calleeName, endpointArgument as endpointArgumentHelper, prefixedArgument, propertyName, range, rangeForOffsets, sourceSlice, staticPath, staticPathResolutionContext, storageKind, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
+import { STATIC_ROUTE_CALL_NAMES, argumentValue, calleeName, endpointArgument as endpointArgumentHelper, prefixedArgument, semanticStaticPropertyName, range, rangeForOffsets, sourceSlice, staticPath, staticPathResolutionContext, storageKind, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
 /** Inspect one call or new expression for references, endpoints, storage, and roles. */
 export const inspectCall = (source, node, context) => {
     const { accumulator } = context;
@@ -113,7 +113,7 @@ const inspectEndpointCall = (node, name, first, context) => {
         });
 };
 export const inspectRouteProperty = (node, context) => {
-    const key = propertyName(node.key);
+    const key = semanticStaticPropertyName(node.key, node.computed);
     if ((key === "path" || key === "route") && t.isStringLiteral(node.value))
         addEndpoint(context, {
             node,
@@ -123,7 +123,7 @@ export const inspectRouteProperty = (node, context) => {
         });
 };
 export const inspectRoleProperty = (node, context) => {
-    if (propertyName(node.key) !== "preload")
+    if (semanticStaticPropertyName(node.key, node.computed) !== "preload")
         return;
     const path = staticPath(node.value);
     if (path === undefined)
@@ -192,9 +192,12 @@ const addEndpoint = (context, input) => addLocatedFinding(context, {
     },
 });
 export const addSourceMapDirectives = (source, accumulator) => {
-    for (const match of source.matchAll(/\/\/[#@]\s*sourceMappingURL\s*=\s*([^\s]+)/gu)) {
+    // Minifiers emit either `//# sourceMappingURL=` or the block form
+    // `/*# sourceMappingURL=app.js.map */`. Matching only the line form silently
+    // dropped the block form, so a real footer produced no mapping at all.
+    for (const match of source.matchAll(/(?:\/\/|\/\*)[#@]\s*sourceMappingURL\s*=\s*([^\s*]+)/gu)) {
         const declared = match[1];
-        if (declared === undefined)
+        if (declared === undefined || declared.length === 0)
             continue;
         const start = match.index;
         const location = rangeForOffsets(source, start, start + match[0].length);

package/dist/domain/javascriptStaticAnalysisHelpers.js

@@ -1,8 +1,8 @@
 import { createHash } from "node:crypto";
 import { posix } from "node:path";
 import * as t from "@babel/types";
-import { propertyName } from "./javascriptAstValues.js";
-export { propertyName } from "./javascriptAstValues.js";
+import { semanticStaticPropertyName } from "./javascriptAstValues.js";
+export { propertyName, semanticStaticPropertyName, } from "./javascriptAstValues.js";
 /** Explicit result for source text that Babel cannot parse. */
 export const failedJavaScriptStaticAnalysis = () => ({
     parse_status: "failed",
@@ -35,7 +35,8 @@ export const chunkRuntime = (call) => {
     if (!t.isMemberExpression(call.callee) &&
         !t.isOptionalMemberExpression(call.callee))
         return undefined;
-    if (propertyName(call.callee.property) !== "push")
+    if (semanticStaticPropertyName(call.callee.property, call.callee.computed) !==
+        "push")
         return undefined;
     return findChunkRuntime(call.callee.object);
 };
@@ -43,7 +44,7 @@ const findChunkRuntime = (node) => {
     if (t.isIdentifier(node) && /(?:webpack|rspack)Chunk/iu.test(node.name))
         return node.name;
     if (t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) {
-        const property = propertyName(node.property);
+        const property = semanticStaticPropertyName(node.property, node.computed);
         if (/(?:webpack|rspack)Chunk/iu.test(property))
             return property;
         return t.isNode(node.object) ? findChunkRuntime(node.object) : undefined;
@@ -72,7 +73,7 @@ export const modulePropertyName = (property) => t.isObjectMethod(property) || t.
         !t.isStringLiteral(property.key) &&
         !t.isNumericLiteral(property.key)
         ? `[computed@${String(property.start ?? -1)}]`
-        : propertyName(property.key) ||
+        : semanticStaticPropertyName(property.key, property.computed) ||
             `[unknown@${String(property.start ?? -1)}]`
     : `[unknown@${String(property.start ?? -1)}]`;
 /** Read the factory-local bundler require parameter when declared. */
@@ -186,7 +187,7 @@ const isFileIdentity = (node) => {
         t.isMetaProperty(node.object) &&
         node.object.meta.name === "import" &&
         node.object.property.name === "meta" &&
-        propertyName(node.property) === "url")
+        semanticStaticPropertyName(node.property, node.computed) === "url")
         return true;
     if (!t.isCallExpression(node))
         return false;
@@ -229,11 +230,19 @@ const calleeNameAt = (node) => {
         return "import";
     if (t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) {
         const object = t.isNode(node.object) ? calleeNameAt(node.object) : "";
-        const property = propertyName(node.property);
+        // A dynamic key commits no name: `target[method]()` must not be reported as
+        // `target.method`, which would fabricate a runtime call shape.
+        const property = memberPropertyName(node);
         return object === "" ? property : `${object}.${property}`;
     }
     return "";
 };
+/** Read a member property only when its syntax commits an exact name. */
+const memberPropertyName = (node) => node.computed &&
+    !t.isStringLiteral(node.property) &&
+    !t.isNumericLiteral(node.property)
+    ? `[computed@${String(node.property.start ?? -1)}]`
+    : semanticStaticPropertyName(node.property, node.computed);
 /** Return a string literal value without evaluating an expression. */
 export const stringValue = (node) => (t.isStringLiteral(node) ? node.value : undefined);
 /** Return a string or numeric argument literal. */

package/dist/domain/keyedArchive.js

@@ -0,0 +1,181 @@
+import { z } from "zod";
+import { jsonValueSchema } from "./jsonValue.js";
+/** Select one archive within the active bundle and optionally one named root. */
+export const keyedArchiveInputSchema = z.strictObject({
+    path: z.string().min(1).default("."),
+    root: z.string().optional(),
+    offset: z.number().int().min(0).default(0),
+    limit: z.number().int().min(1).max(20_000).default(20_000),
+});
+const linkSchema = z.strictObject({
+    source: z.number().int().nonnegative().nullable(),
+    path: z.array(z.union([z.string(), z.number().int().nonnegative()])),
+    target: z.number().int().nonnegative().nullable(),
+    status: z.enum(["resolved", "nil", "unresolved", "malformed"]),
+    raw: jsonValueSchema,
+});
+/** Archive object identity is its original $objects index, never a recursive copy. */
+export const keyedArchiveResultSchema = z.strictObject({
+    target_sha256: z.string(),
+    archive_path: z.string(),
+    archive_sha256: z.string(),
+    archive_format: z.enum(["binary-plist", "xml-plist"]),
+    roots: z.record(z.string(), jsonValueSchema),
+    objects: z.array(z.strictObject({
+        id: z.number().int().nonnegative(),
+        kind: z.enum([
+            "nil",
+            "scalar",
+            "array",
+            "dictionary",
+            "class-descriptor",
+            "archived-object",
+        ]),
+        class_id: z.number().int().nonnegative().nullable(),
+        class_name: z.string().nullable(),
+        status: z.enum(["observed", "unknown-class", "unresolved-class", "nil"]),
+        value: jsonValueSchema,
+    })),
+    references: z.array(linkSchema),
+    total_objects: z.number().int().nonnegative(),
+    total_references: z.number().int().nonnegative(),
+    offset: z.number().int().nonnegative(),
+    next_offset: z.number().int().nonnegative().nullable(),
+    truncated: z.boolean(),
+    limitations: z.array(z.string()),
+});
+const record = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value
+    : undefined;
+const uid = (value) => {
+    const object = record(value);
+    if (object === undefined || Object.keys(object).length !== 1)
+        return undefined;
+    return Object.hasOwn(object, "UID") ? object.UID : object["CF$UID"];
+};
+/** Interpret serialized Foundation references without instantiating archive classes. */
+export const projectKeyedArchive = (value, selection) => {
+    const archive = record(jsonValueSchema.parse(value));
+    if (archive?.$archiver !== "NSKeyedArchiver" ||
+        !Array.isArray(archive.$objects))
+        throw new TypeError("Expected NSKeyedArchiver with an $objects array");
+    const table = archive.$objects;
+    if (table.length > 200_000)
+        throw new RangeError("Archive exceeds 200000 object-table entries");
+    const top = record(archive.$top);
+    if (top === undefined || Object.keys(top).length === 0)
+        throw new TypeError("Keyed archive has no $top roots");
+    if (selection.root !== undefined && !Object.hasOwn(top, selection.root))
+        throw new TypeError(`Archive root does not exist: ${selection.root}`);
+    const roots = selection.root === undefined
+        ? top
+        : { [selection.root]: top[selection.root] ?? null };
+    const references = [];
+    const scan = (source, initial) => {
+        const pending = [
+            { value: initial, path: [] },
+        ];
+        let visited = 0;
+        while (pending.length > 0) {
+            const item = pending.pop();
+            if (item === undefined)
+                break;
+            if (++visited > 200_000 || item.path.length > 128)
+                throw new RangeError("Archive exceeds 200000 values per object or 128 nesting levels");
+            const target = uid(item.value);
+            if (target !== undefined) {
+                const valid = typeof target === "number" &&
+                    Number.isSafeInteger(target) &&
+                    target >= 0;
+                const index = valid ? target : null;
+                references.push({
+                    source,
+                    path: item.path,
+                    target: index,
+                    raw: item.value,
+                    status: index === null
+                        ? "malformed"
+                        : index >= table.length
+                            ? "unresolved"
+                            : index === 0 && table[0] === "$null"
+                                ? "nil"
+                                : "resolved",
+                });
+            }
+            else if (Array.isArray(item.value)) {
+                for (let index = item.value.length - 1; index >= 0; index--) {
+                    const child = item.value[index];
+                    if (child !== undefined)
+                        pending.push({ value: child, path: [...item.path, index] });
+                }
+            }
+            else {
+                const fields = record(item.value);
+                if (fields !== undefined)
+                    for (const key of Object.keys(fields).sort().reverse()) {
+                        const child = fields[key];
+                        if (child !== undefined)
+                            pending.push({ value: child, path: [...item.path, key] });
+                    }
+            }
+            if (references.length > 200_000)
+                throw new RangeError("Archive exceeds 200000 reference edges");
+        }
+    };
+    scan(null, roots);
+    const objects = table.map((value, id) => {
+        scan(id, value);
+        const fields = record(value);
+        const classUid = uid(fields?.$class);
+        const classId = typeof classUid === "number" &&
+            Number.isSafeInteger(classUid) &&
+            classUid >= 0
+            ? classUid
+            : null;
+        const descriptor = classId === null ? undefined : record(table[classId]);
+        const className = typeof descriptor?.$classname === "string" ? descriptor.$classname : null;
+        const isNil = id === 0 && value === "$null";
+        return {
+            id,
+            kind: isNil
+                ? "nil"
+                : Array.isArray(value)
+                    ? "array"
+                    : fields === undefined
+                        ? "scalar"
+                        : typeof fields.$classname === "string"
+                            ? "class-descriptor"
+                            : Object.hasOwn(fields, "$class")
+                                ? "archived-object"
+                                : "dictionary",
+            class_id: classId,
+            class_name: className,
+            status: isNil
+                ? "nil"
+                : fields !== undefined && Object.hasOwn(fields, "$class")
+                    ? className === null
+                        ? "unresolved-class"
+                        : "unknown-class"
+                    : "observed",
+            value,
+        };
+    });
+    const end = Math.min(objects.length, selection.offset + selection.limit);
+    const page = objects.slice(selection.offset, end);
+    const ids = new Set(page.map(({ id }) => id));
+    return {
+        roots,
+        objects: page,
+        references: references.filter(({ source }) => source === null || ids.has(source)),
+        total_objects: objects.length,
+        total_references: references.length,
+        offset: selection.offset,
+        next_offset: end < objects.length ? end : null,
+        truncated: page.length !== objects.length,
+        limitations: [
+            "Archive classes are never instantiated. Class names and serialized fields are observed; class-specific semantics are unknown.",
+            "Conditional references serialized as UID 0 cannot be distinguished from ordinary nil references. Missing fields remain absent in the raw serialized value.",
+            "Root selection selects the named $top entry; object pagination retains original indices and does not recursively expand references.",
+        ],
+    };
+};

package/dist/domain/managedApplicationGraph.js

@@ -6,8 +6,9 @@ import { createJavaScriptApplicationGraph, javascriptApplicationGraphSchema, } f
 import { managedArtifactInspectionSchema, managedMemberInspectionSchema, managedNativeBoundaryInspectionSchema, } from "./managedArtifact.js";
 import { assessManagedGraphOmissions, managedGraphEvidenceCoverage, managedGraphResultCoverage, } from "./managedApplicationGraphCoverage.js";
 import { addArtifactNode, addArtifactIdentityNodes, addBoundaryNodes, addMemberNodes, } from "./managedApplicationGraphNodes.js";
-const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
-const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
+import { digestSchema } from "./../domain/digests.js";
+import { prefixedDigestSchema } from "./../domain/digests.js";
+const evidenceIdSchema = prefixedDigestSchema("ev");
 const textSchema = z.string().min(1);
 /** Authenticated managed Evidence records projected into the application graph. */
 export const projectManagedApplicationGraphInputSchema = z
@@ -27,7 +28,7 @@ export const projectManagedApplicationGraphInputSchema = z
 });
 /** Managed-code projection result containing a validated application graph. */
 export const managedApplicationGraphResultSchema = z.strictObject({
-    projection_id: z.string().regex(/^magp_[a-f0-9]{64}$/u),
+    projection_id: prefixedDigestSchema("magp"),
     root_artifact_sha256: digestSchema,
     source_evidence: z.strictObject({
         managed_artifact_evidence_id: evidenceIdSchema.nullable(),

package/dist/domain/managedArtifact.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+import { digestSchema } from "./../domain/digests.js";
 const tokenSchema = z.string().regex(/^0x[0-9a-f]{8}$/u);
 const offsetSchema = z.number().int().min(0);
 /** A 16-byte CLI metadata GUID without RFC 4122 version/variant restrictions. */
@@ -266,6 +266,7 @@ const managedParseIssueSchema = z.object({
         "invalid-heap-index",
         "invalid-string",
         "invalid-blob",
+        "unsupported-signature",
         "invalid-guid",
         "invalid-resource",
     ]),

package/dist/domain/managedMemberComparison.js

@@ -1,11 +1,13 @@
 import { z } from "zod";
+import { emptyArraySchema } from "./emptyArraySchema.js";
 import { evidenceSchema } from "./evidence.js";
 import { cliMetadataGuidSchema, } from "./managedArtifact.js";
 import { buildComparisonCoverage, buildComparisonMatching, buildComparisonSummary, comparisonLimitations, sideManifest, } from "./managedMemberComparisonCoverage.js";
 import { buildFieldItems, buildMethodItems, } from "./managedMemberComparisonItems.js";
 import { keyMembers, sha256 } from "./managedMemberComparisonMatch.js";
-const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
-const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
+import { digestSchema } from "./../domain/digests.js";
+import { prefixedDigestSchema } from "./../domain/digests.js";
+const evidenceIdSchema = prefixedDigestSchema("ev");
 const tokenSchema = z.string().regex(/^0x[0-9a-f]{8}$/u);
 const boundedTextSchema = z.string().min(1);
 /** Two authenticated managed member observations. */
@@ -24,6 +26,7 @@ export const compareManagedMembersInputSchema = z
 });
 const concreteMatchBasisSchema = z.enum([
     "exact-il-signature",
+    "exact-signature",
     "structural-method-shape",
     "field-signature",
 ]);
@@ -32,15 +35,15 @@ const matchedComparisonSchema = z.strictObject({
     status: z.literal("matched"),
     basis: concreteMatchBasisSchema,
     confidence: z.enum(["exact", "high"]),
-    candidate_left_tokens: z.tuple([]),
-    candidate_right_tokens: z.tuple([]),
+    candidate_left_tokens: emptyArraySchema,
+    candidate_right_tokens: emptyArraySchema,
 });
 const unmatchedComparisonSchema = z.strictObject({
     status: z.literal("unmatched"),
     basis: z.literal("none"),
     confidence: z.literal("unknown"),
-    candidate_left_tokens: z.tuple([]),
-    candidate_right_tokens: z.tuple([]),
+    candidate_left_tokens: emptyArraySchema,
+    candidate_right_tokens: emptyArraySchema,
 });
 const ambiguousComparisonSchema = z.strictObject({
     status: z.literal("ambiguous"),
@@ -59,7 +62,7 @@ const memberIdentitySchema = z.strictObject({
 const comparisonItemSchema = (base, identity) => z.union([
     z.strictObject({
         ...base,
-        status: z.enum(["unchanged", "changed"]),
+        status: z.enum(["unchanged", "changed", "unknown"]),
         left: identity,
         right: identity,
         match: matchedComparisonSchema,
@@ -92,7 +95,7 @@ const comparisonItemContextShape = {
 };
 const methodComparisonItemSchema = comparisonItemSchema({
     ...comparisonItemContextShape,
-    item_id: z.string().regex(/^mmc_method_[a-f0-9]{64}$/u),
+    item_id: prefixedDigestSchema("mmc_method"),
     dimensions: z.array(z.enum([
         "signature",
         "cil",
@@ -101,19 +104,20 @@ const methodComparisonItemSchema = comparisonItemSchema({
         "field-shape",
         "exception-shape",
         "availability",
+        "body-coverage",
     ])),
 }, memberIdentitySchema);
 const fieldComparisonItemSchema = comparisonItemSchema({
     ...comparisonItemContextShape,
-    item_id: z.string().regex(/^mmc_field_[a-f0-9]{64}$/u),
+    item_id: prefixedDigestSchema("mmc_field"),
 }, memberIdentitySchema.omit({ normalized_il_sha256: true }));
 /** Obfuscation-resistant, execution-free managed member comparison. */
 export const managedMemberComparisonResultSchema = z.strictObject({
-    comparison_id: z.string().regex(/^mmc_[a-f0-9]{64}$/u),
+    comparison_id: prefixedDigestSchema("mmc"),
     algorithm: z.strictObject({
         name: z.literal("rea-managed-member-comparison"),
         token_identity: z.literal("build-local"),
-        name_matching: z.literal("not-used"),
+        name_matching: z.literal("exact-signature-fallback"),
     }),
     left: z.strictObject({
         evidence_id: evidenceIdSchema,
@@ -142,6 +146,7 @@ export const managedMemberComparisonResultSchema = z.strictObject({
     }),
     matching: z.strictObject({
         exact_il_signature: z.number().int().min(0),
+        exact_signature: z.number().int().min(0),
         structural_method_shape: z.number().int().min(0),
         field_signature: z.number().int().min(0),
         ambiguous: z.number().int().min(0),
@@ -157,7 +162,7 @@ export const managedMemberComparisonResultSchema = z.strictObject({
     evidence_links: z.array(evidenceIdSchema).length(2),
     limitations: z.array(boundedTextSchema),
 });
-/** Compare two parsed managed member observations without name-based matching. */
+/** Compare managed members with constrained exact and structural identities. */
 export const compareManagedMembers = (left, right) => {
     const leftCoverage = {
         sourceComplete: left.result.coverage.state === "complete",
@@ -192,7 +197,7 @@ export const compareManagedMembers = (left, right) => {
         algorithm: {
             name: "rea-managed-member-comparison",
             token_identity: "build-local",
-            name_matching: "not-used",
+            name_matching: "exact-signature-fallback",
         },
         left: sideManifest(left),
         right: sideManifest(right),

package/dist/domain/managedMemberComparisonCoverage.js

@@ -33,6 +33,7 @@ export const buildComparisonSummary = (items) => ({
 });
 export const buildComparisonMatching = (methodItems, fieldItems) => ({
     exact_il_signature: methodItems.filter(({ match }) => match.basis === "exact-il-signature").length,
+    exact_signature: methodItems.filter(({ match }) => match.basis === "exact-signature").length,
     structural_method_shape: methodItems.filter(({ match }) => match.basis === "structural-method-shape").length,
     field_signature: fieldItems.filter(({ match }) => match.basis === "field-signature").length,
     ambiguous: methodItems.filter(({ match }) => match.status === "ambiguous").length +
@@ -42,7 +43,7 @@ export const buildComparisonMatching = (methodItems, fieldItems) => ({
 export const comparisonLimitations = (left, right) => {
     const limitations = [
         "Metadata tokens are build-local coordinates; matched pairs are remaps, not persistent identities.",
-        "Names are reported as observations but are not used as a matching basis.",
+        "Methods pair by exact CIL/signature, then declared type, name, and signature, then structural shape; names alone are never a matching basis.",
     ];
     if (left.coverage.state !== "complete" || right.coverage.state !== "complete")
         limitations.push("At least one managed member observation is partial.");

package/dist/domain/managedMemberComparisonItems.js

@@ -1,9 +1,19 @@
 import canonicalize from "canonicalize";
 import { sha256, } from "./managedMemberComparisonMatch.js";
-const changedMethodDimensions = (left, right) => {
+const methodDimensions = (left, right) => {
     const dimensions = [];
     if (left.signature.raw_sha256 !== right.signature.raw_sha256)
         dimensions.push("signature");
+    const leftBodyComplete = left.body.status === "present" && left.body.truncated_instructions === 0;
+    const rightBodyComplete = right.body.status === "present" && right.body.truncated_instructions === 0;
+    const bothAbsent = left.body.status === "absent" && right.body.status === "absent";
+    if ((left.body.status === "absent" && rightBodyComplete) ||
+        (right.body.status === "absent" && leftBodyComplete))
+        dimensions.push("availability");
+    if (bothAbsent)
+        return { dimensions, bodyUnknown: false };
+    if (!leftBodyComplete || !rightBodyComplete)
+        return { dimensions, bodyUnknown: true };
     if (left.body.normalized_il_sha256 !== right.body.normalized_il_sha256)
         dimensions.push("cil");
     if (canonicalize(left.body.opcode_counts) !==
@@ -16,9 +26,7 @@ const changedMethodDimensions = (left, right) => {
     if (canonicalize(left.body.exception_regions) !==
         canonicalize(right.body.exception_regions))
         dimensions.push("exception-shape");
-    if (left.body.status !== right.body.status)
-        dimensions.push("availability");
-    return dimensions;
+    return { dimensions, bodyUnknown: false };
 };
 const callShape = (anchors) => JSON.stringify(anchors
     .filter(({ operand_kind }) => operand_kind === "method")
@@ -115,14 +123,22 @@ const fieldOnlyItem = (member, context) => {
 export const buildMethodItems = (matches, context) => {
     const items = [];
     for (const pair of matches.pairs) {
-        const dimensions = changedMethodDimensions(pair.left.item, pair.right.item);
+        const { dimensions: observedDimensions, bodyUnknown } = methodDimensions(pair.left.item, pair.right.item);
+        const dimensions = bodyUnknown
+            ? [...observedDimensions, "body-coverage"]
+            : observedDimensions;
+        const observedChange = observedDimensions.length > 0;
         items.push({
             item_id: `mmc_method_${sha256({
                 left: pair.left.item.token,
                 right: pair.right.item.token,
                 basis: pair.basis,
             })}`,
-            status: dimensions.length === 0 ? "unchanged" : "changed",
+            status: observedChange
+                ? "changed"
+                : bodyUnknown
+                    ? "unknown"
+                    : "unchanged",
             left: methodIdentity(pair.left.item),
             right: methodIdentity(pair.right.item),
             match: {
@@ -134,7 +150,11 @@ export const buildMethodItems = (matches, context) => {
             },
             dimensions,
             evidence_links: [context.leftEvidenceId, context.rightEvidenceId],
-            limitations: [],
+            limitations: bodyUnknown
+                ? [
+                    "Method body facets are unknown because at least one side has unavailable or partial body data.",
+                ]
+                : [],
         });
     }
     for (const ambiguous of matches.ambiguous) {

package/dist/domain/managedMemberComparisonMatch.js

@@ -19,7 +19,15 @@ const keyMethod = (item) => ({
             item.body.normalized_il_sha256,
         ])
         : null,
-    structuralKey: item.body.status === "present"
+    signatureKey: item.signature.parse_status === "decoded"
+        ? stableKey([
+            "method-signature",
+            item.declaring_type,
+            item.name,
+            item.signature.raw_sha256,
+        ])
+        : null,
+    structuralKey: item.signature.parse_status === "decoded" && item.body.status === "present"
         ? stableKey([
             "method-structural",
             item.signature.kind,
@@ -53,6 +61,7 @@ const keyField = (item) => ({
     exactKey: item.signature.parse_status === "decoded"
         ? stableKey(["field-exact", item.signature.raw_sha256])
         : null,
+    signatureKey: null,
     structuralKey: stableKey([
         "field-structural",
         item.signature.kind,
@@ -65,7 +74,16 @@ const matchMethods = (left, right) => matchByKeys({
     left,
     right,
     exactBasis: "exact-il-signature",
-    fallbackBases: ["structural-method-shape"],
+    fallbackBases: [
+        {
+            basis: "exact-signature",
+            key: ({ signatureKey }) => signatureKey,
+        },
+        {
+            basis: "structural-method-shape",
+            key: ({ structuralKey }) => structuralKey,
+        },
+    ],
 });
 const matchFields = (left, right) => matchByKeys({
     left,
@@ -80,10 +98,7 @@ const matchByKeys = ({ left, right, exactBasis, fallbackBases, }) => {
     const ambiguous = [];
     const rounds = [
         { basis: exactBasis, key: ({ exactKey }) => exactKey },
-        ...fallbackBases.map((basis) => ({
-            basis,
-            key: ({ structuralKey }) => structuralKey,
-        })),
+        ...fallbackBases,
     ];
     for (const round of rounds) {
         const leftGroups = groupBy(left.filter((item) => !usedLeft.has(item)), round.key);
@@ -104,6 +119,7 @@ const matchByKeys = ({ left, right, exactBasis, fallbackBases, }) => {
                     right: rightItem,
                     basis: round.basis,
                     confidence: round.basis === "exact-il-signature" ||
+                        round.basis === "exact-signature" ||
                         round.basis === "field-signature"
                         ? "exact"
                         : "high",

package/dist/domain/managedNativeVerificationMatch.js

@@ -65,7 +65,7 @@ export const collectNativeSymbols = (observations) => {
     }
     return { symbols, accepted, unsupported };
 };
-const normalizeSymbol = (value) => value.replace(/^_+/u, "").replace(/@\d+$/u, "").toLowerCase();
+const normalizeSymbol = (value) => value.replace(/^_+/u, "");
 const sameSymbolName = (left, right) => normalizeSymbol(left) === normalizeSymbol(right);
 const normalizeModule = (value) => basename(value)
     .toLowerCase()
@@ -111,7 +111,7 @@ const matchPinvoke = (managed, symbols, supportedNativeEvidence) => {
             },
         };
     const candidates = [first, ...remaining];
-    const exact = candidates.find((symbol) => sameSymbolName(managed.import_name, symbol.name) &&
+    const exact = candidates.find((symbol) => managed.import_name === symbol.name &&
         moduleCompatible(managed.import_scope_name, symbol));
     const decorated = candidates.find((symbol) => moduleCompatible(managed.import_scope_name, symbol));
     const selected = exact ?? decorated ?? first;

package/dist/domain/managedNativeVerificationSchemas.js

@@ -1,8 +1,10 @@
 import { z } from "zod";
+import { emptyArraySchema } from "./emptyArraySchema.js";
 import { evidenceSchema } from "./evidence.js";
 import { cliMetadataGuidSchema } from "./managedArtifact.js";
-const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
-const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
+import { digestSchema } from "./../domain/digests.js";
+import { prefixedDigestSchema } from "./../domain/digests.js";
+const evidenceIdSchema = prefixedDigestSchema("ev");
 const tokenSchema = z.string().regex(/^0x[0-9a-f]{8}$/u);
 const textSchema = z.string().min(1);
 const nativeSymbolSchema = z.strictObject({
@@ -15,7 +17,7 @@ const nativeSymbolSchema = z.strictObject({
     source: z.enum(["macho-export", "function-dossier"]),
 });
 const pinvokeVerificationContextShape = {
-    item_id: z.string().regex(/^mnv_pinvoke_[a-f0-9]{64}$/u),
+    item_id: prefixedDigestSchema("mnv_pinvoke"),
     managed: z.strictObject({
         token: tokenSchema,
         member_token: tokenSchema.nullable(),
@@ -64,7 +66,7 @@ export const pinvokeVerificationSchema = z.discriminatedUnion("status", [
         basis: z.enum(["no-native-candidate", "unsupported-native-evidence"]),
         confidence: z.literal("unknown"),
         matched_native: z.null(),
-        candidates: z.tuple([]),
+        candidates: emptyArraySchema,
     }),
     z.strictObject({
         ...pinvokeVerificationContextShape,
@@ -107,7 +109,7 @@ const verificationCoverageSchema = z.strictObject({
 /** Provider-neutral managed/native verification result. */
 export const managedNativeVerificationResultSchema = z
     .strictObject({
-    verification_id: z.string().regex(/^mnv_[a-f0-9]{64}$/u),
+    verification_id: prefixedDigestSchema("mnv"),
     algorithm: z.strictObject({
         name: z.literal("rea-managed-native-verification"),
         token_identity: z.literal("build-local"),