rea-agents 3.2.1 → 4.0.0

package/dist/application/JavaScriptArtifactPathResolution.js

@@ -13,7 +13,7 @@ const EXTENSIONS = [
 const NODE_BUILTINS = new Set(builtinModules.map((name) => name.replace(/^node:/u, "")));
 /** Resolve one declaration under its exact syntax/metadata context. */
 export const resolveArtifactPathByContext = (input) => resolvePackagePath(input, new Set());
-const resolvePackagePath = (input, packageChain) => {
+const resolvePackagePath = (input, packageChain, mode = "full") => {
     const rejected = rejectDeclaration(input);
     if (rejected !== null)
         return rejected;
@@ -23,7 +23,12 @@ const resolvePackagePath = (input, packageChain) => {
     const confined = confineCandidate(input, candidate);
     if (typeof confined !== "string")
         return confined;
-    const resolved = resolveCandidate(input, confined, packageChain);
+    const resolved = mode === "files-and-index"
+        ? (resolveFileCandidates(input, [
+            ...fileCandidates(confined),
+            ...indexCandidates(confined),
+        ]) ?? notFoundCandidate())
+        : resolveCandidate(input, confined, packageChain);
     return outcome(input, resolved);
 };
 const rejectDeclaration = (input) => {
@@ -36,15 +41,20 @@ const rejectDeclaration = (input) => {
         return unresolvedOutcome(input, "rejected", [
             "NUL and backslash path syntax are not admitted for canonical artifact paths.",
         ]);
-    if (/%(?:2e|2f|5c)/iu.test(declared))
+    if (!admitsCanonicalPathSyntax(declared))
         return unresolvedOutcome(input, "rejected", [
             "Encoded dot or separator bytes are rejected before artifact path resolution.",
         ]);
     return null;
 };
+/** Path syntax admitted for a canonical artifact path. */
+const admitsCanonicalPathSyntax = (value) => !value.includes("\0") &&
+    !value.includes("\\") &&
+    !/%(?:2e|2f|5c)/iu.test(value);
 const contextualCandidate = (input) => {
     const { context } = input;
-    const declared = context === "module-specifier" || context === "html-reference"
+    const declared = context === "html-reference" ||
+        (context === "module-specifier" && input.moduleKind !== "require")
         ? stripQueryAndFragment(input.declaredPath)
         : input.declaredPath;
     if (context === "html-reference")
@@ -103,7 +113,11 @@ const barePackageName = (specifier) => {
             : null;
     return segments[0] === "" ? null : (segments[0] ?? null);
 };
-const hasContainerCandidate = (files, candidate, containerSha256) => [...directCandidates(candidate), posix.join(candidate, "package.json")].some((path) => {
+const hasContainerCandidate = (files, candidate, containerSha256) => [
+    ...fileCandidates(candidate),
+    ...indexCandidates(candidate),
+    posix.join(candidate, "package.json"),
+].some((path) => {
     const file = files.get(path);
     return (file !== undefined &&
         (containerSha256 === undefined ||
@@ -111,25 +125,49 @@ const hasContainerCandidate = (files, candidate, containerSha256) => [...directC
 });
 const htmlCandidate = (input) => {
     const declared = stripQueryAndFragment(input.declaredPath);
-    if (hasScheme(declared))
+    if (hasScheme(declared) || declared.startsWith("//"))
         return unresolvedOutcome(input, "external", [
             "External HTML references are not mapped to local artifact assets.",
         ]);
+    const rawBase = input.htmlBaseHref;
+    const base = rawBase === undefined || rawBase === null
+        ? rawBase
+        : stripQueryAndFragment(rawBase);
+    if (base !== undefined &&
+        base !== null &&
+        (hasScheme(base) || base.startsWith("//")))
+        return unresolvedOutcome(input, "external", [
+            "The document base href is external, so its script reference is not a local artifact path.",
+        ]);
     if (declared.startsWith("/"))
         return declared.slice(1);
-    const base = input.htmlBaseHref;
     if (base === undefined || base === null || base === "")
         return posix.join(posix.dirname(input.sourcePath), declared);
-    if (hasScheme(base))
-        return unresolvedOutcome(input, "external", [
-            "The document base href is external, so its script reference is not a local artifact path.",
+    // A local base href is a second untrusted path input; apply the same
+    // admission rules a declared path gets so it cannot smuggle traversal or
+    // separator syntax past canonicalization.
+    if (!admitsCanonicalPathSyntax(base))
+        return unresolvedOutcome(input, "rejected", [
+            "The document base href uses NUL, backslash, or encoded dot and separator bytes that are not admitted for canonical artifact paths.",
         ]);
     const basePath = base.startsWith("/")
         ? base.slice(1)
         : posix.join(posix.dirname(input.sourcePath), base);
-    const baseDirectory = base.endsWith("/") ? basePath : posix.dirname(basePath);
-    return posix.join(baseDirectory, declared);
+    return posix.join(htmlBaseDirectory(base, basePath), declared);
 };
+/**
+ * The directory a relative HTML reference resolves against. A base path
+ * ending in "/" or in a "." or ".." segment is already a directory, because a
+ * relative reference resolves against the base URL's directory and those
+ * segments are dropped rather than stepped through.
+ */
+const htmlBaseDirectory = (base, basePath) => base.endsWith("/") ||
+    base.endsWith("/.") ||
+    base.endsWith("/..") ||
+    base === "." ||
+    base === ".."
+    ? basePath
+    : posix.dirname(basePath);
 const confineCandidate = (input, candidate) => {
     const normalized = posix.normalize(candidate);
     if (normalized === ".." ||
@@ -141,20 +179,17 @@ const confineCandidate = (input, candidate) => {
     return normalized === "." ? "" : normalized;
 };
 const resolveCandidate = (input, candidate, packageChain) => {
+    const direct = resolveFileCandidates(input, fileCandidates(candidate));
+    if (direct !== null)
+        return direct;
     const source = input.files.get(input.sourcePath);
-    for (const path of directCandidates(candidate)) {
-        const target = input.files.get(path);
-        if (target !== undefined &&
-            (source === undefined ||
-                target.container_sha256 === source.container_sha256))
-            return { resolvedPath: path, status: "resolved", limitations: [] };
-    }
     const packagePath = posix.join(candidate, "package.json");
     const packageFile = input.files.get(packagePath);
     if (packageFile === undefined ||
         (source !== undefined &&
             packageFile.container_sha256 !== source.container_sha256))
-        return notFoundCandidate();
+        return (resolveFileCandidates(input, indexCandidates(candidate)) ??
+            notFoundCandidate());
     if (!packageFile.text.included)
         return {
             resolvedPath: null,
@@ -163,63 +198,103 @@ const resolveCandidate = (input, candidate, packageChain) => {
                 `Directory package metadata ${packagePath} was inventoried but its text is unavailable: ${packageFile.text.reason}.`,
             ],
         };
-    if (packageChain.has(packagePath))
+    const main = packageEntry(packageFile.text.value, input.moduleKind, input.context === "module-specifier" &&
+        !input.declaredPath.startsWith(".") &&
+        !input.declaredPath.startsWith("/") &&
+        !hasScheme(input.declaredPath));
+    if (main.status === "invalid")
         return {
             resolvedPath: null,
             status: "unavailable",
             limitations: [
-                `Directory package entrypoint cycle includes ${packagePath}.`,
+                `Directory package metadata ${packagePath} is not valid package JSON.`,
             ],
         };
-    const main = packageEntry(packageFile.text.value, input.moduleKind);
-    if (main.status === "invalid")
+    if (main.status === "unmatched")
+        return {
+            resolvedPath: null,
+            status: "external",
+            limitations: [
+                `Directory package metadata ${packagePath} declares no exports target for the active conditions; it declares ${main.declared.join(", ")}.`,
+            ],
+        };
+    if (packageChain.has(packagePath)) {
         return {
             resolvedPath: null,
             status: "unavailable",
             limitations: [
-                `Directory package metadata ${packagePath} is not valid package JSON.`,
+                `Directory package entrypoint cycle includes ${packagePath}.`,
             ],
         };
+    }
     if (main.status === "missing")
-        return notFoundCandidate();
-    const nested = resolvePackagePath({
+        return (resolveFileCandidates(input, indexCandidates(candidate)) ??
+            notFoundCandidate());
+    const entryInput = {
         declaredPath: main.value,
         sourcePath: packagePath,
         context: "package-entrypoint",
         files: input.files,
-    }, new Set([...packageChain, packagePath]));
-    return nested.resolution_status === "resolved"
-        ? {
-            resolvedPath: nested.resolved_path,
-            status: nested.resolution_status,
-            limitations: nested.limitations,
-        }
-        : {
-            resolvedPath: null,
-            status: nested.resolution_status,
-            limitations: nested.limitations,
-        };
+    };
+    const chain = new Set([...packageChain, packagePath]);
+    if (main.source === "legacy") {
+        const entry = resolvePackagePath(entryInput, chain, "files-and-index");
+        if (entry.resolution_status !== "not-found")
+            return candidateOutcome(entry);
+        const index = resolveFileCandidates(input, indexCandidates(candidate));
+        if (index !== null)
+            return index;
+    }
+    // Preserve recursive artifact package lookup only after legacy file/index fallbacks.
+    return candidateOutcome(resolvePackagePath(entryInput, chain));
+};
+const candidateOutcome = (nested) => nested.resolution_status === "resolved"
+    ? {
+        resolvedPath: nested.resolved_path,
+        status: nested.resolution_status,
+        limitations: nested.limitations,
+    }
+    : {
+        resolvedPath: null,
+        status: nested.resolution_status,
+        limitations: nested.limitations,
+    };
+const resolveFileCandidates = (input, candidates) => {
+    const source = input.files.get(input.sourcePath);
+    for (const path of candidates) {
+        const target = input.files.get(path);
+        if (target !== undefined &&
+            (source === undefined ||
+                target.container_sha256 === source.container_sha256))
+            return { resolvedPath: path, status: "resolved", limitations: [] };
+    }
+    return null;
 };
-const directCandidates = (candidate) => [
+const fileCandidates = (candidate) => [
     candidate,
     ...EXTENSIONS.map((extension) => `${candidate}${extension}`),
-    ...EXTENSIONS.map((extension) => posix.join(candidate, `index${extension}`)),
 ];
-const packageEntry = (text, moduleKind) => {
+const indexCandidates = (candidate) => EXTENSIONS.map((extension) => posix.join(candidate, `index${extension}`));
+const packageEntry = (text, moduleKind, useExports) => {
     try {
         const value = JSON.parse(text);
         if (typeof value !== "object" || value === null)
             return { status: "invalid" };
         const rawExports = Reflect.get(value, "exports");
-        if (rawExports !== undefined)
-            return packageExport(rawExports, moduleKind);
+        if (useExports && rawExports !== undefined && rawExports !== null) {
+            const exported = packageExport(rawExports, moduleKind);
+            return exported.status === "value"
+                ? { ...exported, source: "exports" }
+                : exported;
+        }
         const preferred = moduleKind === "import"
             ? [Reflect.get(value, "module"), Reflect.get(value, "main")]
             : [Reflect.get(value, "main"), Reflect.get(value, "module")];
         const entry = preferred.find((candidate) => candidate !== undefined);
         if (entry === undefined)
             return { status: "missing" };
-        return packagePathValue(entry);
+        const legacy = packagePathValue(entry);
+        return legacy.status === "value" ? { ...legacy, source: "legacy" } : legacy;
     }
     catch {
         return { status: "invalid" };
@@ -235,9 +310,66 @@ const packageExport = (value, moduleKind) => {
         return packagePathValue(root);
     if (typeof root !== "object" || root === null || Array.isArray(root))
         return { status: "invalid" };
-    const condition = Reflect.get(root, moduleKind ?? "default") ?? Reflect.get(root, "default");
-    return packagePathValue(condition);
+    const flattened = exportTargets(root, packageExportConditions(moduleKind));
+    if (flattened.kind === "invalid")
+        return { status: "invalid" };
+    const first = flattened.kind === "unmatched" ? undefined : flattened.values[0];
+    return first === undefined
+        ? { status: "unmatched", declared: Object.keys(root) }
+        : { status: "value", value: first };
+};
+/**
+ * Resolve a target in Node's declared order. Explicit null blocks an active
+ * condition, whereas an unmatched nested object permits the next condition.
+ * An array skips unmatched and invalid entries, stops at its first string, and
+ * preserves the final invalid-versus-null refusal if no string is selected.
+ */
+const exportTargets = (value, conditions) => {
+    if (typeof value === "string")
+        return value.startsWith("./")
+            ? { kind: "targets", values: [value] }
+            : { kind: "invalid" };
+    if (value === null)
+        return { kind: "targets", values: [] };
+    if (Array.isArray(value)) {
+        let invalid = false;
+        for (const entry of value) {
+            const nested = exportTargets(entry, conditions);
+            if (nested.kind === "invalid") {
+                invalid = true;
+                continue;
+            }
+            if (nested.kind === "unmatched")
+                continue;
+            invalid = false;
+            if (nested.values.length > 0)
+                return nested;
+        }
+        return invalid ? { kind: "invalid" } : { kind: "targets", values: [] };
+    }
+    if (typeof value !== "object")
+        return { kind: "invalid" };
+    for (const [condition, target] of Object.entries(value)) {
+        if (!conditions.has(condition))
+            continue;
+        const nested = exportTargets(target, conditions);
+        if (nested.kind !== "unmatched")
+            return nested;
+    }
+    return { kind: "unmatched" };
 };
+/**
+ * Node selects an exports target by walking the declared keys in order and
+ * taking the first whose condition is active for the calling resolver.
+ * "default" is always active, and "node" plus "node-addons" are active for the
+ * built-in resolver that owns installed-package imports and requires.
+ */
+const packageExportConditions = (moduleKind) => new Set([
+    "node",
+    "node-addons",
+    ...(moduleKind === undefined ? [] : [moduleKind]),
+    "default",
+]);
 const packagePathValue = (value) => typeof value === "string" && value.length > 0
     ? { status: "value", value }
     : { status: "invalid" };

package/dist/application/JavaScriptRuntimeObservationEvidence.js

@@ -13,11 +13,14 @@ export const createJavaScriptRuntimeObservationEvidence = (operation, input, res
     authority: "external-service",
     environment: {
         id: `${result.runtime.product}@${result.runtime.protocol_version}`,
-        platform: process.platform,
-        architecture: process.arch,
+        platform: "unknown",
+        architecture: "unknown",
         isolation: "none",
     },
-    limitations: result.limitations,
+    limitations: [
+        ...result.limitations,
+        "Runtime host platform and architecture were not observed.",
+    ],
 });
 const parameters = (input) => ({
     inspector_endpoint: input.inspector_endpoint,

package/dist/application/JavaScriptRuntimeObservationService.js

@@ -1,10 +1,9 @@
-import { projectPermissionFailure } from "./PermissionFailure.js";
 import { createJavaScriptRuntimeObservationEvidence } from "./JavaScriptRuntimeObservationEvidence.js";
 import { AnalysisCapabilityUnavailableError, } from "../domain/errors.js";
 import { err, ok } from "../domain/result.js";
-/** Authorize and list attachable Node/Electron Inspector targets. */
-export const listJavaScriptRuntimeTargets = async (provider, authority, input, options = {}) => {
-    const ready = await prepare(provider, authority, input, "list_javascript_runtime_targets");
+/** List targets exposed by the explicitly selected loopback Inspector. */
+export const listJavaScriptRuntimeTargets = async (provider, input, options = {}) => {
+    const ready = requireProvider(provider, "list_javascript_runtime_targets");
     if (!ready.ok)
         return ready;
     const result = await ready.value.listTargets(input, options);
@@ -12,9 +11,9 @@ export const listJavaScriptRuntimeTargets = async (provider, authority, input, o
         ? ok(createJavaScriptRuntimeObservationEvidence("list_javascript_runtime_targets", input, result.value, ready.value.identity()))
         : result;
 };
-/** Authorize one bounded attach-only Inspector observation. */
-export const observeJavaScriptRuntime = async (provider, authority, input, options = {}) => {
-    const ready = await prepare(provider, authority, input, "observe_javascript_runtime");
+/** Observe one attach-only Inspector target selected by the request. */
+export const observeJavaScriptRuntime = async (provider, input, options = {}) => {
+    const ready = requireProvider(provider, "observe_javascript_runtime");
     if (!ready.ok)
         return ready;
     const result = await ready.value.observe(input, options);
@@ -22,21 +21,6 @@ export const observeJavaScriptRuntime = async (provider, authority, input, optio
         ? ok(createJavaScriptRuntimeObservationEvidence("observe_javascript_runtime", input, result.value, ready.value.identity()))
         : result;
 };
-const prepare = async (provider, authority, input, operation) => {
-    if (authority === undefined)
-        return err(new AnalysisCapabilityUnavailableError("rea-v8-inspector", operation, "V8 Inspector observation permission policy is not configured"));
-    const authorized = await authority.authorize({
-        capability: "v8_inspector_observe",
-        roots: [],
-        executables: [],
-        environment_names: [],
-        network: "loopback",
-        mount: false,
-        operation_identity: `${operation}:${"target_id" in input ? input.target_id : input.inspector_endpoint}`,
-    }, "read");
-    if (!authorized.ok)
-        return err(projectPermissionFailure(authorized.error));
-    return provider === undefined
-        ? err(new AnalysisCapabilityUnavailableError("rea-v8-inspector", operation, "V8 Inspector observation provider is not configured"))
-        : ok(provider);
-};
+const requireProvider = (provider, operation) => provider === undefined
+    ? err(new AnalysisCapabilityUnavailableError("rea-v8-inspector", operation, "V8 Inspector observation provider is not configured"))
+    : ok(provider);

package/dist/application/JavaScriptRuntimeReconciliationService.js

@@ -1,3 +1,4 @@
+import { resolve } from "node:path";
 import { z } from "zod";
 import { AnalysisInputError, AnalysisProtocolError, } from "../domain/errors.js";
 import { projectInputIssues } from "../domain/inputIssueProjection.js";
@@ -14,14 +15,54 @@ export const reconcileJavaScriptRuntimeEvidence = (rawInput) => {
     return reconcileJavaScriptRuntimeEvidenceValidated(parsed.data);
 };
 /** Reconcile input already parsed by a trusted adapter boundary. */
-export const reconcileJavaScriptRuntimeEvidenceValidated = (input) => {
+export const reconcileJavaScriptRuntimeEvidenceValidated = (parsedInput) => {
     try {
+        const input = reconcileJavaScriptRuntimeInputSchema.parse(normalizeRuntimeMappingRoots(parsedInput));
         const result = reconcileJavaScriptRuntime(input);
         return ok(createJavaScriptRuntimeReconciliationEvidence(input, result));
     }
     catch (cause) {
-        return err(cause instanceof z.ZodError || cause instanceof TypeError
-            ? new AnalysisInputError(OPERATION)
-            : new AnalysisProtocolError("JavaScript runtime reconciliation produced an invalid result", { cause }));
+        if (cause instanceof z.ZodError)
+            return err(new AnalysisInputError(OPERATION, undefined, projectInputIssues(cause.issues, parsedInput)));
+        if (cause instanceof TypeError &&
+            SAFE_RECONCILIATION_INPUT_CONSTRAINTS.has(cause.message))
+            return err(new AnalysisInputError(OPERATION, undefined, [
+                { path: [], reason: "invalid_value", message: cause.message },
+            ]));
+        return err(new AnalysisProtocolError("JavaScript runtime reconciliation produced an invalid result", { cause }));
     }
 };
+const normalizeRuntimeMappingRoots = (input) => ({
+    ...input,
+    static_layers: input.static_layers.map((layer) => ({
+        ...layer,
+        runtime_mappings: layer.runtime_mappings.map((mapping) => mapping.kind === "file-root"
+            ? {
+                ...mapping,
+                root: isPortableAbsolutePath(mapping.root)
+                    ? mapping.root
+                    : resolve(mapping.root),
+            }
+            : mapping),
+    })),
+});
+const isPortableAbsolutePath = (path) => path.startsWith("/") ||
+    /^[a-z]:[\\/]/iu.test(path) ||
+    /^(?:\\\\|\/\/)[^\\/]+[\\/][^\\/]+(?:[\\/]|$)/u.test(path);
+const SAFE_RECONCILIATION_INPUT_CONSTRAINTS = new Set([
+    "Evidence semantic identifier does not match its record",
+    "JavaScript application Evidence subject disagrees with its result",
+    "Runtime reconciliation requires inspect_web_page, inspect_electron_page, observe_javascript_runtime, or capture_electron_scenario Evidence",
+    "Runtime Evidence target or declared role disagrees with its result",
+    "Runtime Evidence contains an invalid builtin location",
+    "Runtime Evidence target disagrees with its captured result",
+    "Browser Evidence target is outside its recorded origin scope",
+    "Runtime Evidence contains source without source-capture selection",
+    "Active Electron Evidence application path disagrees with its configured root",
+    ...[
+        "inspect_web_page",
+        "inspect_electron_page",
+        "observe_javascript_runtime",
+        "capture_electron_scenario",
+    ].map((operation) => `Evidence does not match the supported ${operation} contract`),
+]);

package/dist/application/JavaScriptSemanticGraphAsyncProjection.js

@@ -121,6 +121,17 @@ const projectTimerSchedule = (context, operation, timerNodes) => {
         relation: "schedules-timer",
         resolution: "resolved",
     });
+    for (const projected of operation.projectedResultBindings)
+        addSemanticGraphRelation(context.state, {
+            source: timerNodes.get(operation.timerId),
+            target: context.bindingNodes.get(projected.bindingId),
+            relation: "destructures",
+            resolution: projected.resolution === "complete" ? "resolved" : "candidate",
+            properties: {
+                projection_path: [...projected.projectionPath],
+                projection_resolution: projected.resolution,
+            },
+        });
 };
 const projectTimerCancellation = (context, operation, timerNodes) => {
     const callSite = semanticCallSiteAt(context, operation.location);

package/dist/application/JavaScriptSemanticGraphChildProcessProjection.js

@@ -42,6 +42,17 @@ const projectSpawn = (context, spawn, child) => {
         relation: "spawns",
         resolution: spawn.resolution === "complete" ? "resolved" : "candidate",
     });
+    for (const projected of spawn.projectedResultBindings)
+        addSemanticGraphRelation(context.state, {
+            source: child,
+            target: context.bindingNodes.get(projected.bindingId),
+            relation: "destructures",
+            resolution: projected.resolution === "complete" ? "resolved" : "candidate",
+            properties: {
+                projection_path: [...projected.projectionPath],
+                projection_resolution: projected.resolution,
+            },
+        });
     if (spawn.argvCount !== null)
         addSemanticGraphRelation(context.state, {
             source: callSite,

package/dist/application/JavaScriptSemanticGraphDataProjection.js

@@ -117,6 +117,17 @@ const projectRequestConstruction = (context, operation, request) => {
         relation: "constructs-request",
         resolution: operation.resolution === "complete" ? "resolved" : "candidate",
     });
+    for (const projected of operation.projectedResultBindings)
+        addSemanticGraphRelation(context.state, {
+            source: request,
+            target: context.bindingNodes.get(projected.bindingId),
+            relation: "destructures",
+            resolution: projected.resolution === "complete" ? "resolved" : "candidate",
+            properties: {
+                projection_path: [...projected.projectionPath],
+                projection_resolution: projected.resolution,
+            },
+        });
     for (const field of operation.fields)
         addSemanticGraphRelation(context.state, {
             source: field.sourceBindingId === null

package/dist/application/JavaScriptSemanticGraphFlowProjection.js

@@ -158,18 +158,27 @@ export const projectSemanticClosureCaptures = (context) => {
             evidence: inferredSemanticEvidenceAt(context.file, capture.referenceLocation),
         });
 };
-/** Retain bounded unresolved dynamic-call and dynamic-property frontiers. */
+/** Retain bounded unresolved dynamic-call, dynamic-property and dynamic-scope frontiers. */
 export const projectSemanticFrontiers = (context) => {
     for (const frontier of context.ir.frontiers) {
+        // Dynamic environments leave identifier reads and writes unresolved.
+        const family = frontier.kind === "dynamic-call"
+            ? "call-flow"
+            : frontier.kind === "dynamic-scope"
+                ? "data-flow"
+                : "object-flow";
+        const relationKinds = frontier.kind === "dynamic-call"
+            ? ["calls"]
+            : frontier.kind === "dynamic-scope"
+                ? ["reads", "writes"]
+                : ["reads-property", "writes-property"];
         const unknown = createJavaScriptSemanticGraphUnknown({
             node_id: frontier.callableId === null
                 ? context.moduleNode.node_id
                 : (context.callableNodes.get(frontier.callableId)?.node_id ??
                     context.moduleNode.node_id),
-            family: frontier.kind === "dynamic-call" ? "call-flow" : "object-flow",
-            relation_kinds: frontier.kind === "dynamic-call"
-                ? ["calls"]
-                : ["reads-property", "writes-property"],
+            family,
+            relation_kinds: [...relationKinds],
             reason: frontier.kind,
             detail: frontier.reason,
             candidate_node_ids: [],

package/dist/application/JsonFiles.js

@@ -13,7 +13,7 @@ export const readJsonFile = async (path) => {
         const encoded = await readFile(canonicalPath);
         let decoded;
         try {
-            decoded = JSON.parse(encoded.toString("utf8"));
+            decoded = JSON.parse(new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(encoded));
         }
         catch (cause) {
             return err(new EvidenceFileError("read", "invalid-json", { cause }));

package/dist/application/LazyAnalysisProvider.js

@@ -1,3 +1,7 @@
+import { AnalysisCancelledError, AnalysisError, ProviderAdapterError, } from "../domain/errors.js";
+import { err } from "../domain/result.js";
+import { ABORTED, waitForAbortable } from "./AbortablePromise.js";
+const isAborted = (signal) => signal?.aborted === true;
 /**
  * Preserve synchronous provider discovery while loading implementation modules
  * only when a target-bound client first executes.
@@ -25,7 +29,7 @@ export class LazyAnalysisProvider {
         return new LazyAnalysisClient(async () => {
             const provider = await this.#load();
             return provider.createClient(target, profile, context);
-        });
+        }, this.#providerIdentity.id);
     }
     async #load() {
         this.#provider ??= this.#loadProvider().catch((cause) => {
@@ -37,15 +41,30 @@ export class LazyAnalysisProvider {
 }
 class LazyAnalysisClient {
     #loadClient;
+    #providerId;
     #client;
     #loading;
     #closed = false;
-    constructor(loadClient) {
+    constructor(loadClient, providerId) {
         this.#loadClient = loadClient;
+        this.#providerId = providerId;
     }
     execute = async (operation, parameters, options) => {
-        const client = await this.#load();
-        return client.execute(operation, parameters, options);
+        try {
+            if (isAborted(options?.signal))
+                return err(new AnalysisCancelledError(operation));
+            const loaded = await waitForAbortable(this.#load(operation), options?.signal);
+            if (loaded === ABORTED)
+                return err(new AnalysisCancelledError(operation));
+            return await loaded.execute(operation, parameters, options);
+        }
+        catch (cause) {
+            if (cause instanceof AnalysisError)
+                return err(cause);
+            return err(new ProviderAdapterError(this.#providerId, operation, {
+                cause,
+            }));
+        }
     };
     runtimeLineageSnapshots() {
         return this.#client?.runtimeLineageSnapshots?.() ?? [];
@@ -60,9 +79,11 @@ class LazyAnalysisClient {
         const client = await this.#loading;
         await client.close();
     }
-    async #load() {
+    async #load(operation) {
         if (this.#closed)
-            throw new Error("Lazy analysis client is closed");
+            throw new ProviderAdapterError(this.#providerId, operation, {
+                diagnostics: { reason: "client_closed" },
+            });
         this.#loading ??= this.#loadClient()
             .then((client) => {
             this.#client = client;