rea-agents 4.0.1 → 5.0.0

package/dist/application/UpdateRuntime.js

@@ -58,7 +58,9 @@ export const detectNpmInstallation = async (packageRoot, host) => {
     try {
         canonicalPackageRoot = await host.canonicalPath(packageRoot);
     }
-    catch {
+    catch (cause) {
+        // best-effort cleanup: optional install-location probing; unknown means not npm-managed.
+        void cause;
         return undefined;
     }
     try {
@@ -71,8 +73,9 @@ export const detectNpmInstallation = async (packageRoot, host) => {
                 : { prefix, packageRoot: canonicalPackageRoot };
         }
     }
-    catch {
+    catch (cause) {
         // The curl installer uses a Unix prefix that may differ from npm's current default.
+        void cause;
     }
     const nodeModules = dirname(canonicalPackageRoot);
     const library = dirname(nodeModules);

package/dist/application/ValidateSelectedWebScript.js

@@ -0,0 +1,27 @@
+import { createHash } from "node:crypto";
+import { AnalysisOutputError } from "../domain/analysisErrorCore.js";
+import { err, ok } from "../domain/result.js";
+/** Bind actual source text to the selected manifest entry before analysis. */
+export const validateSelectedWebScript = (input, data, operation) => {
+    const selected = data.manifest.scripts[input.script_index];
+    if (selected === undefined ||
+        selected.content.state !== "exported" ||
+        selected.content.sha256 !== data.sourceFile.sha256 ||
+        selected.content.bytes !== data.sourceFile.bytes ||
+        Buffer.byteLength(data.source) !== data.sourceFile.bytes ||
+        createHash("sha256").update(data.source, "utf8").digest("hex") !==
+            data.sourceFile.sha256 ||
+        data.manifestFile.path !== input.manifest_path)
+        return err(new AnalysisOutputError(operation, "Artifact port changed the selected script/source identity."));
+    return ok(selected);
+};
+/** Carry reported capture context alongside independently verified manifest bytes. */
+export const capturedWebManifestIdentity = (data) => ({
+    ...data.manifestFile,
+    reported_output_directory: data.manifest.output_directory,
+    capture_sha256: data.manifest.capture_sha256,
+    capture_path: data.manifest.capture_path,
+    capture_kind: data.manifest.capture_kind,
+    capture_completeness: data.manifest.capture_completeness,
+    source_evidence_id: data.manifest.source_evidence_id,
+});

package/dist/application/WebModuleTraceService.js

@@ -0,0 +1,209 @@
+import { isAbsolute } from "node:path";
+import { z } from "zod";
+import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, AnalysisInputError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
+import { createEvidence } from "../domain/evidence.js";
+import { jsonObjectSchema } from "../domain/jsonValue.js";
+import { projectInputIssues } from "../domain/inputIssueProjection.js";
+import { err, ok } from "../domain/result.js";
+import { collectWebModuleImports, matchCapturedModules, } from "../domain/webModuleImports.js";
+import { webModuleTraceInputSchema, webModuleFileSchema, webModuleResolutionSchema, webModuleTraceResultSchema, } from "../domain/webModuleTrace.js";
+import { selectedWebScriptArtifactsSchema } from "../domain/webScriptArtifacts.js";
+import { capturedWebManifestIdentity, validateSelectedWebScript, } from "./ValidateSelectedWebScript.js";
+const OPERATION = "trace_web_module_imports";
+const artifactsSchema = selectedWebScriptArtifactsSchema.extend({
+    importMap: z
+        .strictObject({
+        file: webModuleFileSchema,
+        baseUrl: z.string().min(1),
+        value: jsonObjectSchema,
+    })
+        .nullable(),
+});
+const resolutionBatchSchema = z.strictObject({
+    engine: z.strictObject({ id: z.string().min(1), version: z.string().min(1) }),
+    resolutions: z.array(webModuleResolutionSchema),
+    diagnostics: z.array(z.string()),
+    rawResult: jsonObjectSchema,
+});
+const LIMITATIONS = [
+    "Resolution is derived under the selected importer URL and optional import map; it does not establish that the map was installed in the captured page.",
+    "Reported source URLs do not establish an inline script's document base. Select importer_url explicitly when that context differs or is unknown.",
+    "Captured candidates retain reported capture metadata; their bytes are not reverified by this trace unless selected as the source.",
+    "A resolved URL or captured source does not prove loading, execution, UI causality, or module namespace identity. Execution remains unknown.",
+    "Only native ES module syntax is resolved. Bundler module IDs, computed imports, workers and non-HTTP(S) importer contexts are outside this trace.",
+    "Source-map declarations do not establish retained map bytes or executed original-source coverage.",
+    "Selected application code is parsed as data and never executed. The owned resolver executes only REA's trusted stub; its page requests are locally fulfilled or blocked.",
+    "Manifest, source and import-map limits are 32 MiB, 16 MiB and 4 MiB. Native resolution has a 20-second deadline; cleanup may extend it. One renderer is requested; no aggregate host memory limit is claimed.",
+];
+/** Compose verified captures, inert syntax and a replaceable URL resolution engine. */
+export class WebModuleTraceService {
+    artifacts;
+    resolver;
+    constructor(artifacts, resolver) {
+        this.artifacts = artifacts;
+        this.resolver = resolver;
+    }
+    async trace(rawInput, options) {
+        if (isAborted(options?.signal))
+            return err(new AnalysisCancelledError(OPERATION));
+        const parsed = webModuleTraceInputSchema.safeParse(rawInput);
+        if (!parsed.success)
+            return err(new AnalysisInputError(OPERATION, { cause: parsed.error }, projectInputIssues(parsed.error.issues, rawInput)));
+        const input = parsed.data;
+        for (const [path, value] of [
+            ["manifest_path", input.manifest_path],
+            ["import_map.path", input.import_map?.path],
+        ])
+            if (value !== undefined && !isAbsolute(value))
+                return invalid(path.split("."), "Expected an absolute filesystem path on this host.");
+        for (const [path, value] of [
+            ["importer_url", input.importer_url],
+            ["import_map.base_url", input.import_map?.base_url],
+        ])
+            if (value !== undefined) {
+                const admission = admitContext(value, path.split("."));
+                if (!admission.ok)
+                    return admission;
+            }
+        const loaded = await this.artifacts.load(input, options);
+        if (!loaded.ok)
+            return loaded;
+        const verified = artifactsSchema.safeParse(loaded.value);
+        if (!verified.success)
+            return err(new AnalysisOutputError(OPERATION, "Artifact port returned a malformed source/manifest report."));
+        const data = verified.data;
+        if ((input.import_map?.path ?? null) !==
+            (data.importMap?.file.path ?? null) ||
+            (input.import_map?.base_url ?? null) !== (data.importMap?.baseUrl ?? null))
+            return err(new AnalysisOutputError(OPERATION, "Artifact port changed the selected import-map identity/context."));
+        const bound = validateSelectedWebScript(input, data, OPERATION);
+        if (!bound.ok)
+            return bound;
+        const selected = bound.value;
+        const importerUrl = input.importer_url ?? selected.url;
+        const importerAdmission = admitContext(importerUrl, ["importer_url"]);
+        if (!importerAdmission.ok)
+            return importerAdmission;
+        const syntax = collectWebModuleImports(data.source);
+        const literals = syntax.imports
+            .filter((reference) => reference.specifier !== null)
+            .map((reference) => reference.specifier ?? "");
+        let resolution = null;
+        if (literals.length > 0) {
+            const execution = await this.resolver.resolve({
+                importerUrl,
+                importMap: data.importMap === null
+                    ? null
+                    : {
+                        baseUrl: data.importMap.baseUrl,
+                        value: data.importMap.value,
+                    },
+                specifiers: literals,
+            }, options);
+            if (!execution.ok)
+                return execution;
+            const report = resolutionBatchSchema.safeParse(execution.value);
+            if (!report.success)
+                return err(new AnalysisOutputError(OPERATION, "Resolver returned malformed or incomplete native evidence."));
+            resolution = report.data;
+            if (resolution.resolutions.length !== literals.length)
+                return err(new AnalysisOutputError(OPERATION, "Resolver did not return every selected literal specifier."));
+        }
+        if (isAborted(options?.signal))
+            return err(new AnalysisCancelledError(OPERATION));
+        let literalIndex = 0;
+        const imports = [];
+        for (const reference of syntax.imports) {
+            let resolved;
+            if (reference.specifier === null)
+                resolved = { state: "unknown", reason: "computed-specifier" };
+            else {
+                const reported = resolution?.resolutions[literalIndex++];
+                if (reported === undefined)
+                    return err(new AnalysisOutputError(OPERATION, "Resolver omitted a selected literal specifier."));
+                resolved = reported;
+            }
+            imports.push({
+                ...reference,
+                resolution: resolved,
+                captured_candidates: resolved.state === "resolved"
+                    ? matchCapturedModules(resolved.url, data.manifest.scripts)
+                    : [],
+                execution: "unknown",
+            });
+        }
+        const normalized = webModuleTraceResultSchema.safeParse({
+            manifest: capturedWebManifestIdentity(data),
+            source: {
+                ...data.sourceFile,
+                script_index: input.script_index,
+                script: selected,
+            },
+            importer: {
+                url: importerUrl,
+                basis: input.importer_url === undefined
+                    ? "reported-source-url"
+                    : "caller-selected",
+            },
+            import_map: data.importMap === null
+                ? null
+                : { ...data.importMap.file, base_url: data.importMap.baseUrl },
+            parser: {
+                state: syntax.state,
+                diagnostics: syntax.diagnostics,
+                location_units: "UTF-16 offsets and columns; one-based lines",
+            },
+            engine: resolution?.engine ?? null,
+            imports,
+            diagnostics: resolution?.diagnostics ?? [],
+            limitations: LIMITATIONS,
+        });
+        if (!normalized.success)
+            return err(new AnalysisOutputError(OPERATION, normalized.error.message));
+        return ok(createEvidence({
+            path: data.sourceFile.path,
+            sha256: data.sourceFile.sha256,
+            format: "file",
+        }, {
+            id: "rea-web-module-trace",
+            name: "REA captured module relationship trace",
+            version: "1",
+        }, {
+            operation: OPERATION,
+            parameters: jsonObjectSchema.parse(input),
+            result: normalized.data,
+            rawResult: resolution?.rawResult ?? null,
+            confidence: "derived",
+            authority: "historical-reference",
+            limitations: LIMITATIONS,
+            locations: [
+                { kind: "artifact-path", path: data.sourceFile.path },
+                { kind: "artifact-path", path: input.manifest_path },
+            ],
+            evidenceLinks: data.manifest.source_evidence_id === null
+                ? []
+                : [data.manifest.source_evidence_id],
+        }));
+    }
+}
+const admitContext = (value, path) => {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch (cause) {
+        void cause;
+        return invalid(path, "Expected an absolute context URL. Select importer_url explicitly when the reported source URL is unknown.");
+    }
+    if (url.username !== "" || url.password !== "")
+        return invalid(path, "Module context URLs must not contain username/password userinfo.");
+    if (url.protocol !== "http:" && url.protocol !== "https:")
+        return err(new AnalysisCapabilityUnavailableError("web-module-resolution", OPERATION, "unsupported_context_scheme", {
+            userMessage: `${path.join(".")} ${value} uses unsupported ${url.protocol} context. This trace currently supports HTTP(S) importer/map contexts; select a supported context explicitly when appropriate.`,
+        }));
+    return ok(null);
+};
+const isAborted = (signal) => signal?.aborted === true;
+const invalid = (path, message) => err(new AnalysisInputError(OPERATION, undefined, [
+    { path, reason: "invalid_format", message },
+]));

package/dist/application/WebRuntimeService.js

@@ -0,0 +1,73 @@
+import { z } from "zod";
+import { AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
+import { createEvidence } from "../domain/evidence.js";
+import { jsonObjectSchema, jsonValueSchema } from "../domain/jsonValue.js";
+import { projectInputIssues } from "../domain/inputIssueProjection.js";
+import { err, ok } from "../domain/result.js";
+import { observeWebExecutionInputSchema, webExecutionSchema, } from "../domain/webExecution.js";
+import { inspectWebEventListenersInputSchema, webEventListenersSchema, } from "../domain/webEventListeners.js";
+/** Shared public workflows keep instrumentation and listener inspection independently selectable. */
+export class WebRuntimeService {
+    provider;
+    constructor(provider) {
+        this.provider = provider;
+    }
+    /** Observe externally triggered execution; selection authorizes the declared instrumentation. */
+    async observe(rawInput, options) {
+        const operation = "observe_web_execution";
+        const parsed = parseInput(observeWebExecutionInputSchema, rawInput, operation, options);
+        if (!parsed.ok)
+            return parsed;
+        const result = await this.provider.observeExecution(parsed.value, options);
+        if (!result.ok)
+            return result;
+        const verified = webExecutionSchema.safeParse(result.value);
+        if (!verified.success)
+            return err(new AnalysisOutputError(operation, verified.error.message));
+        if (verified.data.target.target_id !== parsed.value.target_id ||
+            verified.data.window.requested_ms !== parsed.value.observation_ms)
+            return err(new AnalysisOutputError(operation, "Provider changed the selected target or requested window."));
+        return this.evidence(operation, parsed.value, verified.data, options);
+    }
+    /** Inspect one selected node's listener declarations without dispatching an event. */
+    async inspect(rawInput, options) {
+        const operation = "inspect_web_event_listeners";
+        const parsed = parseInput(inspectWebEventListenersInputSchema, rawInput, operation, options);
+        if (!parsed.ok)
+            return parsed;
+        const result = await this.provider.inspectEventListeners(parsed.value, options);
+        if (!result.ok)
+            return result;
+        const verified = webEventListenersSchema.safeParse(result.value);
+        if (!verified.success)
+            return err(new AnalysisOutputError(operation, verified.error.message));
+        if (verified.data.target.target_id !== parsed.value.target_id ||
+            verified.data.selected_node.selector !== parsed.value.selector)
+            return err(new AnalysisOutputError(operation, "Provider changed the selected target or node selector."));
+        return this.evidence(operation, parsed.value, verified.data, options);
+    }
+    evidence(operation, input, result, options) {
+        if (options?.signal?.aborted)
+            return err(new AnalysisCancelledError(operation));
+        if (input.allowed_origins.length > 0 &&
+            !input.allowed_origins.includes(result.target.origin))
+            return err(new AnalysisOutputError(operation, "Provider returned a document outside the selected origin scope."));
+        return ok(createEvidence(undefined, this.provider.identity(), {
+            predicateType: `rea.${operation.replaceAll("_", "-")}`,
+            operation,
+            parameters: jsonObjectSchema.parse(input),
+            result: jsonValueSchema.parse(result),
+            confidence: "observed",
+            authority: "external-service",
+            limitations: result.limitations,
+        }));
+    }
+}
+const parseInput = (schema, rawInput, operation, options) => {
+    if (options?.signal?.aborted)
+        return err(new AnalysisCancelledError(operation));
+    const parsed = schema.safeParse(rawInput);
+    return parsed.success
+        ? ok(parsed.data)
+        : err(new AnalysisInputError(operation, { cause: parsed.error }, projectInputIssues(parsed.error.issues, rawInput)));
+};

package/dist/application/WebScriptExportService.js

@@ -0,0 +1,115 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { isAbsolute } from "node:path";
+import { z } from "zod";
+import { ArtifactReaderFailure } from "../artifacts/ArtifactReader.js";
+import { publishWebScripts } from "../browser/assets/PublishWebScripts.js";
+import { selectScriptCapture } from "../browser/assets/ScriptCaptureAdapters.js";
+import { AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
+import { createEvidence } from "../domain/evidence.js";
+import { projectInputIssues } from "../domain/inputIssueProjection.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { ProviderAdapterError } from "../domain/providerAdapterError.js";
+import { err, ok } from "../domain/result.js";
+import { safeParseJson } from "../domain/safeJson.js";
+import { exportWebScriptsInputSchema, } from "../domain/webScriptExport.js";
+import { WebScriptExportError } from "../domain/webScriptExportError.js";
+import { WEB_SCRIPT_EXPORT_PROVIDER as PROVIDER } from "./InvestigationProviders.js";
+const OPERATION = "export_web_scripts";
+/** Export one local capture through the shared CLI/MCP application workflow. */
+export const exportWebScripts = async (rawInput, options = {}) => {
+    const input = exportWebScriptsInputSchema.safeParse(rawInput);
+    return input.success
+        ? exportWebScriptsValidated(input.data, options)
+        : err(new AnalysisInputError(OPERATION, undefined, projectInputIssues(input.error.issues, rawInput)));
+};
+/** Publish input already parsed by a named adapter contract. */
+export const exportWebScriptsValidated = async (input, options = {}) => {
+    if (!isAbsolute(input.capture_path) || !isAbsolute(input.output_directory))
+        return err(new AnalysisInputError(OPERATION, undefined, [
+            {
+                path: [],
+                reason: "invalid_format",
+                message: "capture_path and output_directory must be absolute filesystem paths on this host.",
+            },
+        ]));
+    try {
+        options.signal?.throwIfAborted();
+        const bytes = await readFile(input.capture_path, {
+            signal: options.signal,
+        });
+        const loaded = parseCapture(bytes);
+        if (!loaded.ok)
+            return loaded;
+        options.signal?.throwIfAborted();
+        const sha256 = createHash("sha256").update(bytes).digest("hex");
+        const result = await publishWebScripts(input, loaded.value, sha256, options.signal);
+        return ok(createEvidence({ path: input.capture_path, sha256, format: "file" }, PROVIDER, {
+            predicateType: "rea.web-script-export",
+            operation: OPERATION,
+            parameters: {
+                capture_path: input.capture_path,
+                output_directory: input.output_directory,
+            },
+            result: jsonValueSchema.parse(result),
+            rawResult: null,
+            confidence: "derived",
+            authority: "historical-reference",
+            limitations: result.limitations,
+            locations: [{ kind: "artifact-path", path: result.manifest.path }],
+            evidenceLinks: loaded.value.sourceEvidenceId === null
+                ? []
+                : [loaded.value.sourceEvidenceId],
+        }));
+    }
+    catch (cause) {
+        if (cause instanceof WebScriptExportError)
+            return err(cause);
+        if (options.signal?.aborted === true)
+            return err(new AnalysisCancelledError(OPERATION));
+        if (cause instanceof ArtifactReaderFailure)
+            return err(new WebScriptExportError(cause.reason, input.output_directory, cause.message));
+        if (cause instanceof z.ZodError)
+            return err(new AnalysisOutputError(OPERATION, cause.message, { cause }));
+        if (cause instanceof Error &&
+            "code" in cause &&
+            typeof cause.code === "string")
+            return err(new WebScriptExportError("io", `${input.capture_path} → ${input.output_directory}`, cause.message));
+        return err(new ProviderAdapterError(PROVIDER.id, OPERATION, {
+            cause,
+            diagnostics: {
+                capture_path: input.capture_path,
+                output_directory: input.output_directory,
+                error_name: cause instanceof Error ? cause.name : "UnknownError",
+                error_message: cause instanceof Error
+                    ? cause.message
+                    : typeof cause === "string"
+                        ? cause
+                        : "Unknown script export failure",
+            },
+        }));
+    }
+};
+const parseCapture = (bytes) => {
+    try {
+        const text = new TextDecoder("utf-8", {
+            fatal: true,
+            ignoreBOM: true,
+        }).decode(bytes);
+        const json = safeParseJson(text);
+        if (!json.ok)
+            throw new TypeError(json.error);
+        return ok(selectScriptCapture(json.value));
+    }
+    catch (cause) {
+        return err(new AnalysisInputError(OPERATION, { cause }, [
+            {
+                path: ["capture_path"],
+                reason: "invalid_format",
+                message: cause instanceof Error
+                    ? cause.message
+                    : "Capture is not valid UTF-8 JSON evidence.",
+            },
+        ]));
+    }
+};

package/dist/application/WebSourceLocationService.js

@@ -0,0 +1,160 @@
+import { createHash } from "node:crypto";
+import { isAbsolute } from "node:path";
+import { z } from "zod";
+import { AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
+import { createEvidence } from "../domain/evidence.js";
+import { projectInputIssues } from "../domain/inputIssueProjection.js";
+import { jsonObjectSchema } from "../domain/jsonValue.js";
+import { err, ok } from "../domain/result.js";
+import { selectedWebScriptArtifactsSchema, webArtifactFileSchema, } from "../domain/webScriptArtifacts.js";
+import { WEB_SOURCE_MAP_LIMITS, webSourceLocationInputSchema, webSourceLocationResultSchema, webSourceMapReportSchema, } from "../domain/webSourceLocation.js";
+import { webSourceOffset } from "../domain/webSourcePosition.js";
+import { capturedWebManifestIdentity, validateSelectedWebScript, } from "./ValidateSelectedWebScript.js";
+const OPERATION = "trace_web_source_location";
+const artifactsSchema = selectedWebScriptArtifactsSchema.extend({
+    sourceMap: z.strictObject({
+        file: webArtifactFileSchema,
+        url: z.string().min(1),
+        text: z.string(),
+    }),
+});
+const LIMITATIONS = [
+    "The source/map pairing and source-map URL context are caller-selected. Deployment authenticity and execution remain unknown.",
+    "Capture metadata and its Evidence reference are historical context; this trace independently verifies only the selected manifest, script and map bytes.",
+    "Source names and sourceRoot are reported declarations. Resolved URLs are derived by the pinned upstream codec; no original source is fetched or executed.",
+    "Embedded source hashes identify the UTF-8 encoding of decoded sourcesContent text, not an independently retained original file. Missing or out-of-range original content positions remain explicit.",
+    "Lookup returns all segments at the greatest generated position not greater than the selected point, including earlier lines and generated-only segments. A mapped point does not establish an executed range or UI causality.",
+    "Regular maps and inline indexed sections are supported. External section URLs are unsupported; unknown extensions are retained in raw map text and are not interpreted.",
+    "Complete evidence has a 4 MiB map, 32 MiB reply, 262144 decoded rows/segments and 64-level section budget. The owned codec has a 20-second deadline, 192 MiB old-generation heap and one V8 worker; cleanup may extend the deadline. V8 heap limits do not establish aggregate RSS limits.",
+];
+/** Join verified captured bytes with an explicitly selected source-map point. */
+export class WebSourceLocationService {
+    artifacts;
+    decoder;
+    constructor(artifacts, decoder) {
+        this.artifacts = artifacts;
+        this.decoder = decoder;
+    }
+    /** Shared CLI/MCP workflow preserves raw declarations and every equal-position match. */
+    async trace(rawInput, options) {
+        if (options?.signal?.aborted)
+            return err(new AnalysisCancelledError(OPERATION));
+        const parsed = webSourceLocationInputSchema.safeParse(rawInput);
+        if (!parsed.success)
+            return err(new AnalysisInputError(OPERATION, { cause: parsed.error }, projectInputIssues(parsed.error.issues, rawInput)));
+        const input = parsed.data;
+        const admitted = admitContext(input);
+        if (!admitted.ok)
+            return admitted;
+        const loaded = await this.artifacts.load(input, options);
+        if (!loaded.ok)
+            return loaded;
+        const verified = artifactsSchema.safeParse(loaded.value);
+        if (!verified.success)
+            return invalidOutput("Artifact port returned malformed source/map evidence.");
+        const data = verified.data;
+        const bound = validateSelectedWebScript(input, data, OPERATION);
+        if (!bound.ok)
+            return bound;
+        const map = data.sourceMap;
+        const pairing = verifyPairing(input, data);
+        if (!pairing.ok)
+            return pairing;
+        const generatedOffset = pairing.value;
+        if (options?.signal?.aborted)
+            return err(new AnalysisCancelledError(OPERATION));
+        const traced = await this.decoder.trace({
+            text: map.text,
+            path: map.file.path,
+            url: map.url,
+            position: input.generated_position,
+        }, options);
+        if (!traced.ok)
+            return traced;
+        const report = verifyReport(input, map.file.sha256, traced.value);
+        if (!report.ok)
+            return report;
+        if (options?.signal?.aborted)
+            return err(new AnalysisCancelledError(OPERATION));
+        const normalized = webSourceLocationResultSchema.safeParse({
+            ...report.value,
+            manifest: capturedWebManifestIdentity(data),
+            source: {
+                ...data.sourceFile,
+                script_index: input.script_index,
+                script: bound.value,
+            },
+            source_map: { ...map.file, url: map.url, association: "caller-selected" },
+            generated_offset: generatedOffset,
+            source_authenticity: "unknown",
+            execution: "unknown",
+            limitations: LIMITATIONS,
+        });
+        if (!normalized.success)
+            return invalidOutput(normalized.error.message);
+        return ok(createEvidence({
+            path: data.sourceFile.path,
+            sha256: data.sourceFile.sha256,
+            format: "file",
+        }, {
+            id: "rea-web-source-location",
+            name: "REA captured source-map point trace",
+            version: "1",
+        }, {
+            operation: OPERATION,
+            parameters: jsonObjectSchema.parse(input),
+            result: normalized.data,
+            rawResult: { source_map_text: map.text },
+            confidence: "derived",
+            authority: "historical-reference",
+            limitations: LIMITATIONS,
+            locations: [
+                data.sourceFile.path,
+                data.manifestFile.path,
+                map.file.path,
+            ].map((path) => ({ kind: "artifact-path", path })),
+            evidenceLinks: data.manifest.source_evidence_id === null
+                ? []
+                : [data.manifest.source_evidence_id],
+        }));
+    }
+}
+const invalidOutput = (message) => err(new AnalysisOutputError(OPERATION, message));
+const invalid = (path, message) => err(new AnalysisInputError(OPERATION, undefined, [
+    { path, reason: "invalid_format", message },
+]));
+const admitContext = (input) => {
+    for (const [path, value] of [
+        ["manifest_path", input.manifest_path],
+        ["source_map.path", input.source_map.path],
+    ])
+        if (!isAbsolute(value))
+            return invalid(path.split("."), "Expected an absolute filesystem path on this host.");
+    if (!URL.canParse(input.source_map.url))
+        return invalid(["source_map", "url"], "Expected an absolute source-map URL context. Select its deployment context explicitly; no URL is fetched.");
+    return ok(null);
+};
+const verifyPairing = (input, data) => {
+    const map = data.sourceMap;
+    if (map.file.path !== input.source_map.path ||
+        map.url !== input.source_map.url ||
+        Buffer.byteLength(map.text) !== map.file.bytes ||
+        createHash("sha256").update(map.text).digest("hex") !== map.file.sha256 ||
+        map.file.bytes > WEB_SOURCE_MAP_LIMITS.mapBytes)
+        return invalidOutput("Artifact port changed the selected source-map byte identity or URL context.");
+    const generatedOffset = webSourceOffset(data.source, input.generated_position);
+    if (generatedOffset === undefined)
+        return invalid(["generated_position"], "Selected generated position is outside the retained script text (one-based lines; zero-based UTF-16 columns).");
+    return ok(generatedOffset);
+};
+const verifyReport = (input, sha256, value) => {
+    const report = webSourceMapReportSchema.safeParse(value);
+    if (!report.success)
+        return invalidOutput("Codec port returned malformed source-map point evidence.");
+    if (report.data.source_map_sha256 !== sha256 ||
+        report.data.url_context !== input.source_map.url ||
+        report.data.lookup.requested.line !== input.generated_position.line ||
+        report.data.lookup.requested.column !== input.generated_position.column)
+        return invalidOutput("Codec port changed the selected map, URL context or generated point.");
+    return ok(report.data);
+};

package/dist/application/WindowsCapabilities.js

@@ -22,7 +22,8 @@ export const probeWindowsCapabilities = async (dependencies = systemDependencies
                 ? { available: true, reason: null }
                 : { available: false, reason: pty.reason },
         },
-        security: windowsNativeCapabilities(dependencies.platform),
+        security: dependencies.nativeCapabilities?.() ??
+            windowsNativeCapabilities(dependencies.platform),
     };
 };
 const systemDependencies = () => ({
@@ -30,10 +31,8 @@ const systemDependencies = () => ({
     architecture: process.arch,
     probeSymlinkCreation,
     probeNoFollowOpen: () => systemNoFollowOpenCapability(process.platform, constants.O_NOFOLLOW),
-    probePrivateAcl: () => ({
-        available: false,
-        reason: "Windows ACL enforcement is not implemented by this REA build",
-    }),
+    probePrivateAcl: () => windowsNativeCapabilities(process.platform).private_runtime_dacl,
+    nativeCapabilities: () => windowsNativeCapabilities(process.platform),
     probeUnixDomainSocket: () => process.platform === "win32"
         ? {
             available: false,
@@ -47,7 +46,7 @@ export const systemNoFollowOpenCapability = (platform, noFollow) => {
     if (platform === "win32")
         return {
             available: false,
-            reason: "Windows reparse-safe handle admission is not implemented",
+            reason: "Node pathname O_NOFOLLOW is not Windows handle authority; native admission is reported separately in security.",
         };
     return typeof noFollow === "number"
         ? { available: true, reason: null }
@@ -79,9 +78,10 @@ const probeSymlinkCreation = async () => {
         try {
             await rm(root, { recursive: true, force: true });
         }
-        catch {
+        catch (cause) {
             // Cleanup failure must not replace the machine-readable probe outcome.
             // The probe root lives beneath the OS temporary directory and is unique.
+            void cause;
         }
     }
 };