rea-agents 3.2.1 → 4.0.1

package/dist/domain/referenceSourceClassification.js

@@ -264,75 +264,6 @@ const DOCUMENTATION_DIRECTORY_NAMES = new Set([
     "wiki",
     "man",
 ]);
-const SECRET_BASENAMES = new Set([
-    "id_rsa",
-    "id_ed25519",
-    "pgpass",
-    ".netrc",
-    ".npmrc",
-    ".pypirc",
-    ".envrc",
-    ".env.local",
-    ".env.production",
-    ".env.development",
-    ".env.test",
-    ".env.staging",
-    ".env.example",
-    "auth.json",
-    "auth.yaml",
-    "auth.yml",
-    "token.json",
-    "tokens.json",
-    "credentials.json",
-    "secrets.json",
-    "google-services.json",
-    "service-account.json",
-    ".htpasswd",
-]);
-const SECRET_BASENAME_PREFIXES = [
-    ".env",
-    ".env.",
-    "private",
-    "secret",
-    "secrets",
-    "credential",
-    "credentials",
-    "token",
-    "tokens",
-    "password",
-    "passwords",
-    "auth",
-    "apikey",
-    "api-key",
-    "api_key",
-    "service-account",
-    "kubeconfig",
-];
-const SECRET_BASENAME_SUFFIXES = [
-    ".pem",
-    ".key",
-    ".p12",
-    ".gpg",
-    ".pgp",
-    ".keystore",
-];
-const SECRET_PATH_SEGMENTS = new Set([
-    ".ssh",
-    ".aws",
-    ".gnupg",
-    ".pki",
-    ".docker",
-    ".secrets",
-    "secrets",
-    "secret",
-    "private",
-    "credentials",
-    "tokens",
-    "passwords",
-    "passphrase",
-    "kubernetes",
-    "k8s",
-]);
 const filenameIsTest = (filename) => {
     const lower = filename.toLowerCase();
     if (lower.includes(".test.") || lower.includes(".spec."))
@@ -378,47 +309,6 @@ const isPathUnderAny = (path, names) => {
     }
     return false;
 };
-const secretPrefixMatches = (filename) => {
-    const lower = filename.toLowerCase();
-    for (const prefix of SECRET_BASENAME_PREFIXES) {
-        const prefixLower = prefix.toLowerCase();
-        if (!lower.startsWith(prefixLower))
-            continue;
-        const nextIndex = prefixLower.length;
-        if (nextIndex < lower.length) {
-            const next = lower[nextIndex];
-            if (next !== "." && next !== "_" && next !== "-")
-                continue;
-        }
-        const extension = basenameParts(filename).ext.toLowerCase();
-        if (CODE_EXTENSIONS.has(extension))
-            continue;
-        return true;
-    }
-    return false;
-};
-/** Return true when a path or any parent segment matches common secret patterns. */
-export const isSecretLikePath = (path) => {
-    const parts = path.split("/").filter((segment) => segment !== "");
-    for (const segment of parts) {
-        const lower = segment.toLowerCase();
-        if (SECRET_PATH_SEGMENTS.has(lower))
-            return true;
-    }
-    const filename = parts[parts.length - 1];
-    if (filename === undefined)
-        return false;
-    const lower = filename.toLowerCase();
-    if (SECRET_BASENAMES.has(lower))
-        return true;
-    if (secretPrefixMatches(filename))
-        return true;
-    for (const suffix of SECRET_BASENAME_SUFFIXES) {
-        if (lower.endsWith(suffix.toLowerCase()))
-            return true;
-    }
-    return false;
-};
 /** Detect a source language from a POSIX path. */
 export const detectReferenceSourceLanguage = (path) => {
     const filename = posix.basename(path);

package/dist/domain/referenceSourceGraph.js

@@ -3,7 +3,8 @@ import { posix } from "node:path";
 import canonicalize from "canonicalize";
 import { z } from "zod";
 import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
-const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+import { digestSchema } from "./../domain/digests.js";
+import { prefixedDigestSchema } from "./../domain/digests.js";
 const boundedTextSchema = z.string().min(1);
 const relativePathSchema = z
     .string()
@@ -67,9 +68,13 @@ const symlinkTargetSchema = z
     .string()
     .min(1)
     .refine((target) => target === "<outside-root>" ||
+    isPortableAbsoluteSymlinkTarget(target) ||
     (!target.startsWith("/") &&
         !target.includes("\\") &&
         posix.normalize(target) === target), "Expected a normalized POSIX symlink target");
+const isPortableAbsoluteSymlinkTarget = (target) => target.startsWith("/") ||
+    /^[A-Za-z]:[\\/]/u.test(target) ||
+    /^\\\\[^\\/]+[\\/][^\\/]+/u.test(target);
 const sourceSymlinkSchema = z.strictObject({
     ...entryBaseShape,
     kind: z.literal("symlink"),
@@ -170,7 +175,7 @@ const historicalSourceGraphInputSchema = z.strictObject({
 const historicalSourceManifestBaseSchema = z.strictObject({
     schema: z.literal("HistoricalSourceManifest"),
     authority: z.literal("historical-reference"),
-    manifest_id: z.string().regex(/^hsm_[a-f0-9]{64}$/u),
+    manifest_id: prefixedDigestSchema("hsm"),
     graph_sha256: digestSchema,
     root_sha256: digestSchema,
     inventory_state: z.enum(["complete", "partial", "unknown"]),
@@ -235,11 +240,16 @@ const checkSymlinks = (graph, paths, context) => {
     for (const [index, entry] of graph.entries.entries()) {
         if (entry.kind !== "symlink")
             continue;
-        if ((entry.target_state === "external") !==
-            (entry.target === "<outside-root>"))
+        const absolute = isPortableAbsoluteSymlinkTarget(entry.target);
+        if ((entry.target_state === "external" &&
+            entry.target !== "<outside-root>" &&
+            !absolute) ||
+            (entry.target_state === "internal" &&
+                (entry.target === "<outside-root>" || absolute)) ||
+            (entry.target_state === "missing" && entry.target === "<outside-root>"))
             context.addIssue({
                 code: "custom",
-                message: "External symlink targets must use the sanitized <outside-root> sentinel",
+                message: "Symlink target path does not match its target state",
                 path: ["entries", index, "target"],
             });
         if (entry.target_state !== "internal")

package/dist/domain/residualUnknown.js

@@ -1,8 +1,9 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
-const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
-const unknownIdSchema = z.string().regex(/^unk_[a-f0-9]{64}$/u);
+import { prefixedDigestSchema } from "./../domain/digests.js";
+const evidenceIdSchema = prefixedDigestSchema("ev");
+const unknownIdSchema = prefixedDigestSchema("unk");
 const text = z.string().trim().min(1);
 const environmentRequirementSchema = z.object({
     id: z.string().min(1).nullable(),

package/dist/domain/runtimeIdentification.js

@@ -3,8 +3,9 @@ import canonicalize from "canonicalize";
 import { z } from "zod";
 import { parseArtifactInventoryEvidence } from "./artifactInventoryEvidence.js";
 import { evidenceSchema } from "./evidence.js";
-const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
-const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
+import { digestSchema } from "./../domain/digests.js";
+import { prefixedDigestSchema } from "./../domain/digests.js";
+const evidenceIdSchema = prefixedDigestSchema("ev");
 const runtimeFamilySchema = z.enum([
     "android",
     "apple",
@@ -15,7 +16,7 @@ const runtimeFamilySchema = z.enum([
 ]);
 const observationSchema = z.strictObject({
     path: z.string().min(1),
-    artifact_id: z.string().regex(/^art_[a-f0-9]{64}$/u),
+    artifact_id: prefixedDigestSchema("art"),
     sha256: digestSchema,
     format: z.string().min(1),
 });
@@ -49,7 +50,7 @@ const runtimeIdentificationInputSchema = z.strictObject({
 });
 /** Provider-neutral runtime identification with explicit tooling availability. */
 export const runtimeIdentificationResultSchema = z.strictObject({
-    identification_id: z.string().regex(/^rid_[a-f0-9]{64}$/u),
+    identification_id: prefixedDigestSchema("rid"),
     root_sha256: digestSchema,
     root_format: z.string().min(1),
     source_evidence_ids: z.array(evidenceIdSchema).min(1),
@@ -193,7 +194,7 @@ const familiesFor = (format, path) => {
         families.add("javascript");
     if (format === "jvm-class" || /(?:^|\/)[^/]+\.class$/iu.test(path))
         families.add("jvm");
-    if (["elf", "mach-o", "mach-o-universal", "pe"].includes(format))
+    if (["elf", "mach-o", "mach-o-universal", "pe", "dos-mz"].includes(format))
         families.add("native");
     if (format === "webassembly" || /(?:^|\/)[^/]+\.wasm$/iu.test(path))
         families.add("webassembly");

package/dist/domain/sourceMapContents.js

@@ -0,0 +1,5 @@
+/** Validate optional source-map content against its source inventory. */
+export const hasValidSourceMapContents = (sourceCount, contents) => contents === undefined ||
+    (Array.isArray(contents) &&
+        contents.length === sourceCount &&
+        contents.every((content) => content === null || typeof content === "string"));

package/dist/domain/sourceToBundleComparison.js

@@ -1,5 +1,4 @@
-import { createHash } from "node:crypto";
-import canonicalize from "canonicalize";
+import { absenceClaimable, canonicalDigest } from "./comparisonSemantics.js";
 import { SOURCE_TO_BUNDLE_SIGNAL_WEIGHTS, sourceToBundleComparisonResultSchema, } from "./sourceToBundleComparisonSchemas.js";
 import { buildSourceToBundleCandidateIndex, candidateIdsForSource, historicalSourceFiles, scoreSourceToBundleCandidate, sourceBearingNodes, } from "./sourceToBundleSignals.js";
 /** Compare historical source files to static source-bearing application nodes. */
@@ -47,8 +46,7 @@ const projectComparison = (input) => {
         currentNodes,
         index,
         absenceComplete: input.reference.inventory_state === "complete" &&
-            input.application.graph.coverage.status === "complete" &&
-            !input.application.graph.coverage.truncated,
+            absenceClaimable(input.application.graph.coverage),
         factors: {
             input,
         },
@@ -249,11 +247,6 @@ const comparisonLimitations = (factors) => uniqueSorted([
 const hasSignal = (candidate, kind) => candidate.signals.some((signal) => signal.kind === kind);
 const compareCandidates = (left, right) => right.score - left.score ||
     compareText(left.current_node_id, right.current_node_id);
-const digestCanonical = (value) => {
-    const encoded = canonicalize(value);
-    if (encoded === undefined)
-        throw new TypeError("Source-to-bundle comparison could not canonicalize");
-    return createHash("sha256").update(encoded).digest("hex");
-};
+const digestCanonical = (value) => canonicalDigest(value, "Source-to-bundle comparison");
 const uniqueSorted = (values) => [...new Set(values)].sort(compareText);
 const compareText = (left, right) => left < right ? -1 : left > right ? 1 : 0;

package/dist/domain/sourceToBundleComparisonSchemas.js

@@ -2,9 +2,10 @@ import { z } from "zod";
 import { evidenceSchema } from "./evidence.js";
 import { JAVASCRIPT_APPLICATION_NODE_KINDS } from "./javascriptApplicationGraphSchemas.js";
 import { historicalSourceGraphSchema } from "./referenceSourceGraph.js";
-const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
-const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
-const nodeIdSchema = z.string().regex(/^jag_node_[a-f0-9]{64}$/u);
+import { digestSchema } from "./../domain/digests.js";
+import { prefixedDigestSchema } from "./../domain/digests.js";
+const evidenceIdSchema = prefixedDigestSchema("ev");
+const nodeIdSchema = prefixedDigestSchema("jag_node");
 const textSchema = z.string().min(1);
 export const SOURCE_TO_BUNDLE_SIGNAL_WEIGHTS = [
     ["exact-source-digest", 100],
@@ -41,7 +42,7 @@ const sourceToBundleCandidateSchema = z.strictObject({
     signals: z.array(sourceToBundleSignalSchema).min(1),
 });
 const sourceToBundleItemSchema = z.strictObject({
-    mapping_id: z.string().regex(/^stbc_item_[a-f0-9]{64}$/u),
+    mapping_id: prefixedDigestSchema("stbc_item"),
     source_path: textSchema,
     source_sha256: digestSchema.nullable(),
     source_language: textSchema.nullable(),
@@ -61,14 +62,14 @@ const sourceToBundleItemSchema = z.strictObject({
 });
 /** Deterministic, evidence-bearing historical-source to shipped-bundle comparison. */
 export const sourceToBundleComparisonResultSchema = z.strictObject({
-    comparison_id: z.string().regex(/^stbc_[a-f0-9]{64}$/u),
+    comparison_id: prefixedDigestSchema("stbc"),
     reference: z.strictObject({
         root_sha256: digestSchema,
         inventory_state: z.enum(["complete", "partial", "unknown"]),
     }),
     application: z.strictObject({
         evidence_id: evidenceIdSchema,
-        graph_id: z.string().regex(/^jag_[a-f0-9]{64}$/u),
+        graph_id: prefixedDigestSchema("jag"),
         root_artifact_sha256: digestSchema,
     }),
     scoring: z.strictObject({

package/dist/domain/sourceToBundleSignals.js

@@ -1,5 +1,6 @@
 import { posix } from "node:path";
 import { SOURCE_TO_BUNDLE_SIGNAL_WEIGHTS, } from "./sourceToBundleComparisonSchemas.js";
+import { isDigest } from "./digests.js";
 const RELEVANT_NODE_KINDS = new Set([
     "javascript-asset",
     "javascript-module",
@@ -170,9 +171,15 @@ const addPath = (paths, kind, raw) => {
     if (value !== null)
         paths.push({ kind, value });
 };
+/** Matches a `scheme://...` URL prefix; bare filesystem paths keep `?`/`#`. */
+const SCHEME_URL = /^[a-z][a-z0-9+.-]*:\/\//iu;
+/** Matches a `scheme://...` URL prefix with any run of slashes, for stripping. */
+const SCHEME_URL_PREFIX = /^[a-z][a-z0-9+.-]*:\/\/+/iu;
 const normalizeCurrentPath = (raw) => {
-    const withoutQuery = raw.split(/[?#]/u, 1)[0] ?? "";
-    const withoutScheme = withoutQuery.replace(/^[a-z][a-z0-9+.-]*:\/\/+/iu, "");
+    const withoutQuery = SCHEME_URL.test(raw)
+        ? (raw.split(/[?#]/u, 1)[0] ?? "")
+        : raw;
+    const withoutScheme = withoutQuery.replace(SCHEME_URL_PREFIX, "");
     const parts = withoutScheme
         .replaceAll("\\", "/")
         .split("/")
@@ -193,5 +200,4 @@ const addIndexValue = (index, key, nodeId) => {
     values.add(nodeId);
     index.set(key, values);
 };
-const isDigest = (value) => /^[a-f0-9]{64}$/u.test(value);
 const compareText = (left, right) => left < right ? -1 : left > right ? 1 : 0;

package/dist/domain/staticRuntimeCorrelation.js

@@ -5,7 +5,9 @@ import { artifactComparisonResultSchema } from "./artifactComparison.js";
 import { evidenceSchema, parseEvidence } from "./evidence.js";
 import { functionComparisonResultSchema } from "./functionComparison.js";
 import { comparisonStatusSchema, processCaptureComparisonSchema, } from "./processCapture.js";
-const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
+import { PROCESS_COMPARISON_DIMENSIONS } from "./processComparison.js";
+import { prefixedDigestSchema } from "./../domain/digests.js";
+const evidenceIdSchema = prefixedDigestSchema("ev");
 const functionDimensionSchema = z.enum([
     "identity",
     "pseudocode",
@@ -16,15 +18,7 @@ const functionDimensionSchema = z.enum([
     "strings_names",
     "cfg",
 ]);
-const runtimeDimensionSchema = z.enum([
-    "terminal",
-    "interaction",
-    "exit",
-    "filesystem",
-    "protocol",
-    "process",
-    "shim",
-]);
+const runtimeDimensionSchema = z.enum(PROCESS_COMPARISON_DIMENSIONS);
 const expectedPatternSchema = z.enum([
     "cochanged",
     "static_only",
@@ -81,7 +75,7 @@ export const staticRuntimeCorrelationInputSchema = z
 })
     .strict();
 const correlationItemSchema = z.object({
-    correlation_id: z.string().regex(/^cor_[a-f0-9]{64}$/u),
+    correlation_id: prefixedDigestSchema("cor"),
     static: z.object({
         comparison_evidence_id: evidenceIdSchema,
         selector: staticSelectorSchema,

package/dist/domain/webBundleAnalysis.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { emptyArraySchema } from "./emptyArraySchema.js";
 import { inspectWebPageWithSourceInputSchema } from "./browserObservation.js";
 import { webTextArtifactSchema } from "./webContentArtifact.js";
 /** Capture-and-analyze input with optional source-map fetching. */
@@ -57,14 +58,20 @@ const sourceMapSchema = z.union([
         status: z.literal("included"),
         limitation: z.null(),
     }),
+    z.object({
+        ...sourceMapContextShape,
+        ...parsedSourceMapShape,
+        status: z.literal("partial"),
+        limitation: z.string(),
+    }),
     z.object({
         ...sourceMapContextShape,
         ...parsedSourceMapShape,
         status: z.enum(["fetch_failed", "invalid", "policy_filtered"]),
         artifact: z.null(),
-        original_sources: z.tuple([]),
-        original_module_edges: z.tuple([]),
-        mappings: z.tuple([]),
+        original_sources: emptyArraySchema,
+        original_module_edges: emptyArraySchema,
+        mappings: emptyArraySchema,
         limitation: z.string(),
     }),
 ]);
@@ -90,14 +97,15 @@ export const webSourceMapsSchema = z
             message: "Source-map coverage counts are inconsistent",
         });
     const statuses = sourceMaps.items.map(({ status }) => status);
-    const included = statuses.filter((status) => status === "included").length;
+    const retained = statuses.filter((status) => status === "included" || status === "partial").length;
     const allowedStatuses = sourceMaps.items.length === 0
         ? ["not_requested", "unavailable"]
-        : included === sourceMaps.items.length
-            ? ["included"]
-            : included > 0
-                ? ["partial"]
-                : ["unavailable"];
+        : retained === 0
+            ? ["unavailable"]
+            : retained === sourceMaps.items.length &&
+                !statuses.includes("partial")
+                ? ["included"]
+                : ["partial"];
     if (!allowedStatuses.includes(sourceMaps.status))
         context.addIssue({
             code: "custom",

package/dist/domain/webBundleAnalyzer.js

@@ -1,6 +1,6 @@
 import { analyzeScript, emptyAccumulator, isIncludedScript, } from "./webBundleAnalyzerInspection.js";
 import { buildWebBundleAnalysis } from "./webBundleAnalyzerResult.js";
-/** Analyze captured, explicitly approved JavaScript source without execution. */
+/** Analyze selected captured JavaScript source without execution. */
 export const analyzeCapturedWebBundle = (inspection, sourceMaps = {
     status: "not_requested",
     requested: 0,

package/dist/domain/webCaptureDiff.js

@@ -1,5 +1,4 @@
-import { createHash } from "node:crypto";
-import canonicalize from "canonicalize";
+import { canonicalDigest } from "./comparisonSemantics.js";
 import { webCaptureDiffSchema, } from "./webCaptureDiffSchemas.js";
 export { captureSnapshotSchema, compareWebCapturesInputSchema, webCaptureDiffSchema, } from "./webCaptureDiffSchemas.js";
 /** Compare normalized observations without treating incomplete absence as proof. */
@@ -26,8 +25,8 @@ export const compareWebCaptures = (input) => {
         limitations: [
             "A changed status proves an observed difference; an unknown status means absence could not be established from capture completeness.",
             "Network comparison covers only activity observed after each CDP attachment.",
-            "Accessibility roles, ignored state, text, and hierarchy are compared only when the accessibility tree was fully captured and text capture was approved and not truncated.",
-            "Storage key inventories are compared only when approved and complete; usage and quota are compared only when reported. Redacted content is compared through complete SHA-256 fingerprints.",
+            "Accessibility roles, ignored state, text, and hierarchy are compared only when the accessibility tree was fully captured and text capture was selected and not truncated.",
+            "Storage key inventories are compared only when selected and complete; usage and quota are compared only when reported. Redacted content is compared through complete SHA-256 fingerprints.",
         ],
     });
 };
@@ -47,7 +46,7 @@ const compareIdentities = (before, after) => {
         left.change.localeCompare(right.change));
 };
 const compareDimension = (before, after, complete, reason) => {
-    const all = compareIdentities(before, after);
+    const all = compareIdentities(before, after).filter(({ change }) => complete || change === "modified");
     if (all.length > 0)
         return {
             status: "changed",
@@ -173,12 +172,7 @@ const metadataProjection = (inspection) => ({
     headers_allowlisted: inspection.metadata.headers_allowlisted,
 });
 const singleton = (key, value) => new Map([[key, value]]);
-const digest = (value) => {
-    const encoded = canonicalize(value);
-    if (encoded === undefined)
-        throw new TypeError("Expected canonical JSON");
-    return createHash("sha256").update(encoded).digest("hex");
-};
+const digest = (value) => canonicalDigest(value);
 const accessibilityComparable = (inspection) => {
     const text = inspection.accessibility.text_capture.status === "included" &&
         inspection.accessibility.text_capture.excluded_fields === 0;

package/dist/domain/webCaptureDiffSchemas.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { emptyArraySchema } from "./emptyArraySchema.js";
 import { webPageInspectionSchema } from "./browserObservation.js";
 import { webMcpDiscoverySchema } from "./webMcpDiscovery.js";
 /** One normalized passive page snapshot accepted by capture comparison. */
@@ -17,7 +18,7 @@ const changeSchema = z.object({
 });
 const emptyDimensionShape = {
     total_changes: z.literal(0),
-    changes: z.tuple([]),
+    changes: emptyArraySchema,
 };
 const dimensionSchema = z.union([
     z

package/dist/domain/webMcpDiscovery.js

@@ -2,6 +2,7 @@ import { z } from "zod";
 import { browserCompletenessSchema } from "./browserCompleteness.js";
 import { browserAllowedOriginsSchema, browserEndpointSchema, } from "./browserObservation.js";
 import { jsonShapeSchema } from "./jsonShape.js";
+import { prefixedDigestSchema } from "./../domain/digests.js";
 /** Input for passive discovery of page-registered WebMCP tools. */
 export const discoverWebMcpToolsInputSchema = z.strictObject({
     cdp_endpoint: browserEndpointSchema,
@@ -17,7 +18,7 @@ const browserVersionSchema = z.object({
     js_version: z.string(),
 });
 const webMcpToolSchema = z.object({
-    tool_key: z.string().regex(/^webmcp_[a-f0-9]{64}$/u),
+    tool_key: prefixedDigestSchema("webmcp"),
     name: z.string(),
     description: z.string(),
     frame_id: z.string(),

package/dist/dotnet/ManagedMemberInspectorCore.js

@@ -1,3 +1,4 @@
+import { managedFailure, ManagedReaderFailure, } from "./ManagedReaderFailure.js";
 import {} from "./ManagedMetadataLayout.js";
 import { metadataRowCursor, metadataCodedToken, metadataToken, readMetadataString, sha256Bytes, } from "./ManagedMetadataHeaps.js";
 const rowRange = (table, start, nextStart) => {
@@ -98,7 +99,7 @@ export const parseTypes = (bytes, layout, ranges) => {
 const readCompressed = (bytes, offset) => {
     const first = bytes[offset];
     if (first === undefined)
-        throw new RangeError("truncated compressed integer");
+        throw managedFailure("invalid-blob", "signature", "truncated compressed integer", offset);
     if ((first & 0x80) === 0)
         return { value: first, next: offset + 1 };
     const second = bytes[offset + 1];
@@ -115,7 +116,7 @@ const readCompressed = (bytes, offset) => {
             value: (first & 0x1f) * 0x01_00_00_00 + b1 * 0x01_00_00 + b2 * 0x0100 + b3,
             next: offset + 4,
         };
-    throw new RangeError("reserved compressed integer");
+    throw managedFailure("invalid-blob", "signature", "reserved compressed integer", offset);
 };
 const ELEMENT_TYPES = new Map([
     [0x01, "void"],
@@ -143,7 +144,7 @@ const ELEMENT_TYPE_SUFFIXES = new Map([
 const readTypeSignature = (blob, offset) => {
     const kind = blob[offset];
     if (kind === undefined)
-        throw new RangeError("truncated type signature");
+        throw managedFailure("invalid-blob", "signature", "truncated type signature", offset);
     const named = ELEMENT_TYPES.get(kind);
     if (named !== undefined)
         return { value: named, next: offset + 1 };
@@ -171,7 +172,7 @@ const readTypeSignature = (blob, offset) => {
         const variable = readCompressed(blob, offset + 1);
         return { value: `var:${String(variable.value)}`, next: variable.next };
     }
-    throw new RangeError(`unsupported element type 0x${kind.toString(16)}`);
+    throw managedFailure("unsupported-signature", "signature", `unsupported element type 0x${kind.toString(16)}`, offset);
 };
 const callingConvention = (value) => {
     const base = value & 0x0f;
@@ -196,7 +197,7 @@ export const signature = (blob) => {
     };
     try {
         if (blob.length === 0)
-            throw new RangeError("empty signature");
+            throw managedFailure("invalid-blob", "signature", "empty signature", 0);
         const first = blob[0] ?? 0;
         if ((first & 0x0f) === 6) {
             const fieldType = readTypeSignature(blob, 1);
@@ -244,17 +245,24 @@ export const signature = (blob) => {
         };
     }
     catch (cause) {
+        if (!(cause instanceof ManagedReaderFailure))
+            throw cause;
+        if (cause.issue.code !== "invalid-blob" &&
+            cause.issue.code !== "unsupported-signature")
+            throw cause;
         return {
             ...raw,
             kind: "unknown",
-            parse_status: cause instanceof RangeError ? "unsupported" : "malformed",
+            parse_status: cause.issue.code === "unsupported-signature"
+                ? "unsupported"
+                : "malformed",
             calling_convention: null,
             generic_parameter_count: null,
             parameter_count: null,
             return_type: null,
             parameter_types: [],
             field_type: null,
-            issue: cause instanceof Error ? cause.message : "Signature parse failed",
+            issue: cause.issue.detail,
         };
     }
 };