rea-agents 4.0.0 → 4.1.0

package/dist/domain/referenceSourceImportParsing.js

@@ -1,5 +1,5 @@
 import { parse } from "@babel/parser";
-import { isCallExpression, isExportAllDeclaration, isExportNamedDeclaration, isIdentifier, isImport, isImportDeclaration, isMemberExpression, isNode, isStringLiteral, isTSExternalModuleReference, isTSImportEqualsDeclaration, isTSModuleDeclaration, } from "@babel/types";
+import { isCallExpression, isExportAllDeclaration, isExportNamedDeclaration, isIdentifier, isImport, isImportDeclaration, isImportExpression, isMemberExpression, isNode, isStringLiteral, isTSExternalModuleReference, isTSImportEqualsDeclaration, isTSModuleDeclaration, } from "@babel/types";
 const codeSourceLanguages = new Set(["JavaScript", "TypeScript", "JSX", "TSX"]);
 const safeModuleName = (node) => {
     if (isStringLiteral(node))
@@ -101,7 +101,8 @@ const isRequireCallee = (callee) => {
     if (isMemberExpression(callee) &&
         isIdentifier(callee.object) &&
         callee.object.name === "require" &&
-        (isIdentifier(callee.property) || isStringLiteral(callee.property))) {
+        ((!callee.computed && isIdentifier(callee.property)) ||
+            isStringLiteral(callee.property))) {
         const propertyName = isIdentifier(callee.property)
             ? callee.property.name
             : isStringLiteral(callee.property)
@@ -112,19 +113,19 @@ const isRequireCallee = (callee) => {
     return false;
 };
 const isImportCallee = (callee) => isImport(callee);
-const collectCallExpressions = (node, targets) => {
+const collectModuleExpressions = (node, targets) => {
     if (node === null || node === undefined)
         return;
     if (typeof node !== "object")
         return;
     if (Array.isArray(node)) {
         for (const item of node)
-            collectCallExpressions(item, targets);
+            collectModuleExpressions(item, targets);
         return;
     }
     if (!isNode(node))
         return;
-    if (isCallExpression(node)) {
+    if (isCallExpression(node) || isImportExpression(node)) {
         targets.push(node);
     }
     for (const value of Object.values(node)) {
@@ -132,7 +133,7 @@ const collectCallExpressions = (node, targets) => {
             value !== undefined &&
             typeof value === "object" &&
             !isSourceLocation(value)) {
-            collectCallExpressions(value, targets);
+            collectModuleExpressions(value, targets);
         }
     }
 };
@@ -142,10 +143,21 @@ const isSourceLocation = (value) => typeof value === "object" &&
     "end" in value &&
     !("type" in value);
 const extractRequireAndDynamicImports = (body, from_path, relationships) => {
-    const calls = [];
+    const expressions = [];
     for (const statement of body)
-        collectCallExpressions(statement, calls);
-    for (const call of calls) {
+        collectModuleExpressions(statement, expressions);
+    for (const call of expressions) {
+        if (isImportExpression(call)) {
+            const specifier = safeModuleName(call.source);
+            appendRelationship(relationships, {
+                fromPath: from_path,
+                to: specifier ?? "<dynamic-import>",
+                kind: "imports",
+                parseState: specifier === undefined ? "partial" : "parsed",
+                ...(specifier === undefined ? { resolution: "unknown" } : {}),
+            });
+            continue;
+        }
         const first = call.arguments[0];
         if (isRequireCallee(call.callee) && isModuleExpression(first)) {
             const result = moduleSpecifierFromExpression(first);
@@ -193,13 +205,12 @@ const parseWithBabel = (path, source, language) => {
             errorRecovery: true,
             plugins,
         });
-        return { ast, parseState: "parsed" };
+        return { ast, reasons: ast.errors.map((error) => error.message) };
     }
     catch (cause) {
         return {
             ast: undefined,
-            parseState: "unknown",
-            reason: cause instanceof Error ? cause.message : "Parse failed",
+            reasons: [cause instanceof Error ? cause.message : "Parse failed"],
         };
     }
 };
@@ -208,24 +219,28 @@ export const parseReferenceSourceImports = (path, bytes, language) => {
     if (language !== null && !codeSourceLanguages.has(language))
         return { relationships: [], parse_failures: [] };
     const source = new TextDecoder("utf-8", { fatal: false }).decode(bytes);
-    const { ast, parseState, reason } = parseWithBabel(path, source, language);
-    if (ast === undefined || parseState === "unknown") {
+    const { ast, reasons } = parseWithBabel(path, source, language);
+    const parseFailures = reasons.map((reason) => ({
+        path,
+        parser: "babel",
+        reason,
+    }));
+    if (ast === undefined) {
         return {
             relationships: [],
-            parse_failures: [
-                {
-                    path,
-                    parser: "babel",
-                    reason: reason ?? "Unknown parse failure",
-                },
-            ],
+            parse_failures: parseFailures,
         };
     }
     const relationships = [];
     extractImportDeclarations(ast.program.body, path, relationships);
     extractRequireAndDynamicImports(ast.program.body, path, relationships);
     return {
-        relationships,
-        parse_failures: [],
+        relationships: relationships.map((relationship) => ({
+            ...relationship,
+            parse_state: parseFailures.length > 0 && relationship.parse_state === "parsed"
+                ? "partial"
+                : relationship.parse_state,
+        })),
+        parse_failures: parseFailures,
     };
 };

package/dist/domain/runtimeIdentification.js

@@ -194,7 +194,7 @@ const familiesFor = (format, path) => {
         families.add("javascript");
     if (format === "jvm-class" || /(?:^|\/)[^/]+\.class$/iu.test(path))
         families.add("jvm");
-    if (["elf", "mach-o", "mach-o-universal", "pe", "dos-mz"].includes(format))
+    if (["elf", "mach-o", "mach-o-universal", "pe", "dos-mz", "dos-com"].includes(format))
         families.add("native");
     if (format === "webassembly" || /(?:^|\/)[^/]+\.wasm$/iu.test(path))
         families.add("webassembly");

package/dist/domain/runtimeVersion.js

@@ -1,8 +1,5 @@
+import { satisfies } from "semver";
+/** Supported runtime range, kept in sync with the published package engines. */
+export const SUPPORTED_NODE_VERSION_RANGE = "^22.19.0 || ^24.11.0 || >=26.0.0";
 /** Return whether a Node.js version satisfies REA's tested runtime families. */
-export const supportsNodeVersion = (version) => {
-    const [majorText = "", minorText = ""] = version.split(".");
-    const major = Number.parseInt(majorText, 10);
-    const minor = Number.parseInt(minorText, 10);
-    return ((major === 22 && minor >= 19) ||
-        (major >= 24 && (major !== 24 || minor >= 11)));
-};
+export const supportsNodeVersion = (version) => satisfies(version, SUPPORTED_NODE_VERSION_RANGE);

package/dist/domain/safeJson.js

@@ -0,0 +1,13 @@
+/** Parse JSON text, returning the failure reason instead of throwing. */
+export const safeParseJson = (value) => {
+    try {
+        return { ok: true, value: JSON.parse(value) };
+    }
+    catch (cause) {
+        return {
+            ok: false,
+            error: cause instanceof Error ? cause.message : String(cause),
+            cause,
+        };
+    }
+};

package/dist/domain/sourceToBundleComparison.js

@@ -1,3 +1,4 @@
+import { compareCodePoints, uniqueSorted } from "./canonicalOrdering.js";
 import { absenceClaimable, canonicalDigest } from "./comparisonSemantics.js";
 import { SOURCE_TO_BUNDLE_SIGNAL_WEIGHTS, sourceToBundleComparisonResultSchema, } from "./sourceToBundleComparisonSchemas.js";
 import { buildSourceToBundleCandidateIndex, candidateIdsForSource, historicalSourceFiles, scoreSourceToBundleCandidate, sourceBearingNodes, } from "./sourceToBundleSignals.js";
@@ -32,7 +33,7 @@ export const compareSourceToBundle = (input) => {
     };
     return sourceToBundleComparisonResultSchema.parse({
         ...semanticResult,
-        comparison_id: `stbc_${digestCanonical(semanticResult)}`,
+        comparison_id: `stbc_${canonicalDigest(semanticResult, "Source-to-bundle comparison")}`,
     });
 };
 const projectComparison = (input) => {
@@ -208,11 +209,11 @@ const markMergedMappings = (input, items) => {
         return { ...semantic, mapping_id: mappingId(input, semantic) };
     });
 };
-const mappingId = (input, item) => `stbc_item_${digestCanonical({
+const mappingId = (input, item) => `stbc_item_${canonicalDigest({
     reference_root_sha256: input.reference.root_sha256,
     application_graph_id: input.application.graph.graph_id,
     ...item,
-})}`;
+}, "Source-to-bundle comparison")}`;
 const comparisonSummary = (items) => ({
     unchanged: countStatus(items, "unchanged"),
     modified: countStatus(items, "modified"),
@@ -246,7 +247,4 @@ const comparisonLimitations = (factors) => uniqueSorted([
 ]);
 const hasSignal = (candidate, kind) => candidate.signals.some((signal) => signal.kind === kind);
 const compareCandidates = (left, right) => right.score - left.score ||
-    compareText(left.current_node_id, right.current_node_id);
-const digestCanonical = (value) => canonicalDigest(value, "Source-to-bundle comparison");
-const uniqueSorted = (values) => [...new Set(values)].sort(compareText);
-const compareText = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+    compareCodePoints(left.current_node_id, right.current_node_id);

package/dist/domain/sourceToBundleSignals.js

@@ -1,4 +1,5 @@
 import { posix } from "node:path";
+import { compareCodePoints } from "./canonicalOrdering.js";
 import { SOURCE_TO_BUNDLE_SIGNAL_WEIGHTS, } from "./sourceToBundleComparisonSchemas.js";
 import { isDigest } from "./digests.js";
 const RELEVANT_NODE_KINDS = new Set([
@@ -23,11 +24,11 @@ const signalWeight = (kind) => {
 /** Keep source-bearing application nodes in stable identifier order. */
 export const sourceBearingNodes = (nodes) => nodes
     .filter(({ kind }) => RELEVANT_NODE_KINDS.has(kind))
-    .sort((left, right) => compareText(left.node_id, right.node_id));
+    .sort((left, right) => compareCodePoints(left.node_id, right.node_id));
 /** Keep historical source files in stable path order. */
 export const historicalSourceFiles = (graph) => graph.entries
     .filter((entry) => entry.kind === "file" && entry.classifications.includes("source"))
-    .sort((left, right) => compareText(left.path, right.path));
+    .sort((left, right) => compareCodePoints(left.path, right.path));
 /** Build deterministic candidate indices without assigning fuzzy matches. */
 export const buildSourceToBundleCandidateIndex = (nodes) => {
     const projections = nodes.map(projectCurrentNode);
@@ -62,7 +63,7 @@ export const candidateIdsForSource = (source, index) => {
     for (const group of groups) {
         if (group === undefined)
             continue;
-        for (const nodeId of [...group].sort(compareText)) {
+        for (const nodeId of [...group].sort(compareCodePoints)) {
             if (seen.has(nodeId))
                 continue;
             seen.add(nodeId);
@@ -149,7 +150,7 @@ const signal = (kind, sourceValue, currentValues) => ({
     kind,
     weight: signalWeight(kind),
     source_value: sourceValue,
-    current_values: [...new Set(currentValues)].sort(compareText),
+    current_values: [...new Set(currentValues)].sort(compareCodePoints),
 });
 const candidateConfidence = (signals) => {
     const kinds = new Set(signals.map(({ kind }) => kind));
@@ -190,7 +191,7 @@ const normalizeCurrentPath = (raw) => {
 };
 const uniquePaths = (paths) => [
     ...new Map(paths.map((path) => [`${path.kind}\0${path.value}`, path])).values(),
-].sort((left, right) => compareText(`${left.kind}\0${left.value}`, `${right.kind}\0${right.value}`));
+].sort((left, right) => compareCodePoints(`${left.kind}\0${left.value}`, `${right.kind}\0${right.value}`));
 const pathSuffixes = (path) => {
     const parts = path.split("/");
     return parts.map((_, index) => parts.slice(index).join("/"));
@@ -200,4 +201,3 @@ const addIndexValue = (index, key, nodeId) => {
     values.add(nodeId);
     index.set(key, values);
 };
-const compareText = (left, right) => left < right ? -1 : left > right ? 1 : 0;

package/dist/domain/staticRuntimeCorrelation.js

@@ -2,8 +2,10 @@ import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
 import { artifactComparisonResultSchema } from "./artifactComparison.js";
+import { uniqueSorted } from "./canonicalOrdering.js";
 import { evidenceSchema, parseEvidence } from "./evidence.js";
 import { functionComparisonResultSchema } from "./functionComparison.js";
+import { PROCESS_PROVIDER, isProcessEvidenceProvider, } from "./processEvidenceProvider.js";
 import { comparisonStatusSchema, processCaptureComparisonSchema, } from "./processCapture.js";
 import { PROCESS_COMPARISON_DIMENSIONS } from "./processComparison.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
@@ -128,8 +130,8 @@ const EXPECTED = {
     ],
     compare_process_captures: [
         "rea.process-comparison",
-        "rea-process",
-        "REA deterministic process harness",
+        PROCESS_PROVIDER.id,
+        PROCESS_PROVIDER.name,
     ],
 };
 /** Correlate only caller-declared static/runtime hypotheses. */
@@ -280,10 +282,11 @@ const assertComparisonIdentity = (evidence) => {
         !(Array.isArray(expected[0])
             ? expected[0].includes(evidence.predicate_type)
             : evidence.predicate_type === expected[0]) ||
-        evidence.provider.id !== expected[1] ||
-        evidence.provider.name !== expected[2] ||
-        evidence.provider.version !==
-            (evidence.operation === "compare_process_captures" ? "3" : "1") ||
+        (evidence.operation === "compare_process_captures"
+            ? !isProcessEvidenceProvider(evidence.provider)
+            : evidence.provider.id !== expected[1] ||
+                evidence.provider.name !== expected[2] ||
+                evidence.provider.version !== "1") ||
         evidence.confidence !== "derived" ||
         evidence.authority !== "analyst-inference" ||
         evidence.subject !== null ||
@@ -358,7 +361,6 @@ const assertUnique = (evidence, label) => {
     if (new Set(evidence.map(({ evidence_id: id }) => id)).size !== evidence.length)
         throw new TypeError(`Static/runtime correlation rejects duplicate ${label}`);
 };
-const uniqueSorted = (values) => [...new Set(values)].sort((left, right) => left.localeCompare(right, "en"));
 const sha256 = (value) => createHash("sha256").update(value).digest("hex");
 const canonicalJson = (value) => {
     const serialized = canonicalize(value);

package/dist/domain/unknownRegistryError.js

@@ -0,0 +1,10 @@
+import { AnalysisError } from "./analysisErrorBase.js";
+/** Residual-unknown mutation failed a lifecycle, reference, or CAS invariant. */
+export class UnknownRegistryError extends AnalysisError {
+    reason;
+    _tag = "UnknownRegistryError";
+    constructor(reason, options) {
+        super(`Residual unknown registry mutation failed: ${reason}`, options);
+        this.reason = reason;
+    }
+}

package/dist/domain/webBundleAnalyzerAst.js

@@ -1,5 +1,6 @@
 import * as t from "@babel/types";
 import { sanitizeBrowserUrl } from "./browserObservation.js";
+import { semanticStaticPropertyName } from "./javascriptAstValues.js";
 /** Name of a call/new callee from its AST node. */
 export const calleeName = (callee) => {
     if (t.isIdentifier(callee))
@@ -24,15 +25,29 @@ export const propertyName = (value) => {
     return "";
 };
 export const objectValue = (object, name) => {
-    for (const property of object.properties)
-        if (t.isObjectProperty(property) && propertyName(property.key) === name)
-            return property.value;
-    return undefined;
+    let value;
+    for (const property of object.properties) {
+        if (t.isSpreadElement(property)) {
+            value = undefined;
+            continue;
+        }
+        const key = semanticStaticPropertyName(property.key, property.computed);
+        if (key === "" && !t.isStringLiteral(property.key))
+            value = undefined;
+        else if (key === name)
+            value = t.isObjectProperty(property) ? property.value : undefined;
+    }
+    return value;
 };
 export const objectString = (object, name) => {
     const value = objectValue(object, name);
     return t.isStringLiteral(value) ? value.value : undefined;
 };
+/** Whether module syntax supplies a URL location without a package/import-map resolver. */
+export const isUrlLikeModuleSpecifier = (specifier) => specifier.startsWith("/") ||
+    specifier.startsWith("./") ||
+    specifier.startsWith("../") ||
+    /^[A-Za-z][A-Za-z0-9+.-]*:/u.test(specifier);
 export const resolveSpecifier = (specifier, base) => {
     try {
         const resolved = new URL(specifier, base);
@@ -40,7 +55,9 @@ export const resolveSpecifier = (specifier, base) => {
             return null;
         return sanitizeBrowserUrl(resolved.href).url;
     }
-    catch {
+    catch (cause) {
+        // Unresolvable specifiers are represented by the null return.
+        void cause;
         return null;
     }
 };

package/dist/domain/webBundleAnalyzerInspection.js

@@ -1,7 +1,8 @@
 import { parse } from "@babel/parser";
 import * as t from "@babel/types";
 import { sanitizeEndpointCandidate } from "./browserObservation.js";
-import { calleeName, endpointArgument, location, locationFields, objectString, objectValue, propertyName, resolveSpecifier, stringArgument, } from "./webBundleAnalyzerAst.js";
+import { semanticStaticPropertyName } from "./javascriptAstValues.js";
+import { calleeName, endpointArgument, location, locationFields, objectString, objectValue, resolveSpecifier, isUrlLikeModuleSpecifier, stringArgument, } from "./webBundleAnalyzerAst.js";
 export const analyzeScript = (script, accumulator) => {
     let file;
     try {
@@ -11,7 +12,9 @@ export const analyzeScript = (script, accumulator) => {
             plugins: ["jsx", "typescript"],
         });
     }
-    catch {
+    catch (cause) {
+        // Unparseable scripts are counted; the failure needs no extra detail.
+        void cause;
         accumulator.parseFailures += 1;
         return;
     }
@@ -65,15 +68,13 @@ const inspectCall = (script, node, accumulator) => {
             node,
             accumulator,
         });
-    if ((name === "importScripts" || name.endsWith(".importScripts")) &&
-        first !== undefined)
-        addEdge({
-            script,
-            specifier: first,
-            kind: "worker_import",
-            node,
-            accumulator,
-        });
+    if (name === "importScripts" || name.endsWith(".importScripts"))
+        for (const argument of node.arguments) {
+            const specifier = stringArgument(argument);
+            if (specifier === undefined)
+                continue;
+            addEdge({ script, specifier, kind: "worker_import", node, accumulator });
+        }
     if (routeCallNames.some((candidate) => name === candidate || name.endsWith(`.${candidate}`))) {
         if (first !== undefined)
             addFinding({
@@ -106,7 +107,7 @@ const inspectCall = (script, node, accumulator) => {
         addWebMcpDeclaration(script, node, accumulator);
 };
 const inspectRouteProperty = (script, node, accumulator) => {
-    const key = propertyName(node.key);
+    const key = semanticStaticPropertyName(node.key, node.computed);
     if ((key === "path" || key === "route") && t.isStringLiteral(node.value))
         addFinding({
             collection: accumulator.routes,
@@ -123,7 +124,10 @@ const addEdge = (context) => {
         from_script_key: context.script.script_key,
         kind: context.kind,
         specifier: context.specifier,
-        resolved_url: resolveSpecifier(context.specifier, context.script.url),
+        resolved_url: context.kind === "worker_import" ||
+            isUrlLikeModuleSpecifier(context.specifier)
+            ? resolveSpecifier(context.specifier, context.script.url)
+            : null,
         location: location(context.script.script_key, context.node),
     }));
 };
@@ -152,7 +156,9 @@ const addWebMcpDeclaration = (script, node, accumulator) => {
         : schema;
     const schemaPropertyNames = t.isObjectExpression(propertyObject)
         ? propertyObject.properties.flatMap((property) => t.isObjectProperty(property)
-            ? [propertyName(property.key)].filter(Boolean)
+            ? [
+                semanticStaticPropertyName(property.key, property.computed),
+            ].filter(Boolean)
             : [])
         : [];
     const key = `webmcp\0${script.script_key}\0${name ?? ""}\0${schemaPropertyNames.join("\0")}`;

package/dist/dotnet/ManagedMemberRows.js

@@ -70,7 +70,7 @@ export const parseMethods = ({ bytes, layout, pe, ranges, }) => {
             impl_flags: implFlags,
             flags,
             signature: signature(sig),
-            body: methodBody(bytes, pe, rva),
+            body: methodBody(bytes, pe, rva, { implFlags, flags }),
         });
         core.set(token, { token, name, declaringType: declared?.fullName ?? null });
     }

package/dist/dotnet/ManagedMetadataHeaps.js

@@ -80,9 +80,10 @@ export const readMetadataString = (bytes, layout, index, heapExtent) => {
     if (end === maximum)
         throw managedFailure("invalid-string", "metadata.#Strings", "String heap item has no terminator within #Strings", start);
     try {
-        return new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(start, end));
+        return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes.subarray(start, end));
     }
-    catch {
+    catch (cause) {
+        void cause;
         throw managedFailure("invalid-string", "metadata.#Strings", "String heap item is not valid UTF-8", start);
     }
 };

package/dist/dotnet/ManagedMetadataInventoryRows.js

@@ -201,9 +201,11 @@ const decodeFixedString = (blob) => {
     if (start > blob.length - length.length)
         return null;
     try {
-        return new TextDecoder("utf-8", { fatal: true }).decode(blob.subarray(start, start + length.length));
+        return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(blob.subarray(start, start + length.length));
     }
-    catch {
+    catch (cause) {
+        // Invalid UTF-8 blobs decode as null.
+        void cause;
         return null;
     }
 };

package/dist/dotnet/ManagedMethodBodyReader.js

@@ -38,9 +38,16 @@ const readMethodBodyHeader = (bytes, offset) => {
         localSig: bytes.readUInt32LE(offset + 8),
     };
 };
-export const methodBody = (bytes, pe, rva) => {
+/** Decode admitted managed CIL, retaining unavailable implementation metadata as partial. */
+export const methodBody = (bytes, pe, rva, implementation = {
+    implFlags: 0,
+    flags: 0,
+}) => {
     if (rva === 0)
         return emptyMethodBody(rva, "absent", null);
+    if ((implementation.implFlags & 7) !== 0 ||
+        (implementation.flags & 0x2000) !== 0)
+        return emptyMethodBody(rva, "partial", "CIL decoding is unavailable for native, runtime, unmanaged, or P/Invoke implementations");
     try {
         const offset = pe.rvaToOffset(rva, 1, "method.body");
         const header = readMethodBodyHeader(bytes, offset);

package/dist/dotnet/ManagedStaticProvider.js

@@ -4,7 +4,9 @@ import { readFile } from "node:fs/promises";
 import { createAnalysisExecution, } from "../application/AnalysisProvider.js";
 import { MANAGED_STATIC_PROVIDER } from "../application/InvestigationProviders.js";
 import { MANAGED_TOOL_CONTRACTS, managedArtifactInputSchema, managedMemberInputSchema, managedNativeBoundaryInputSchema, } from "../contracts/managedToolContracts.js";
-import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, EvidenceIntegrityError, ProviderAdapterError, } from "../domain/errors.js";
+import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, } from "../domain/analysisErrorCore.js";
+import { EvidenceIntegrityError } from "../domain/evidenceErrors.js";
+import { ProviderAdapterError } from "../domain/providerAdapterError.js";
 import { err, ok } from "../domain/result.js";
 import { inspectManagedArtifactBytes } from "./ManagedArtifactInspector.js";
 import { inspectManagedMembersBytes } from "./ManagedMemberInspector.js";