rea-agents 4.0.1 → 5.0.0

package/dist/domain/callPath.js

@@ -1,8 +1,53 @@
-import { DirectedGraph } from "graphology";
-import { bidirectional } from "graphology-shortest-path/unweighted.js";
 import { callPathInputSchema, callPathResultSchema, parseCallPathAddress, } from "./callPathSchemas.js";
 import { parseFunctionEvidence, } from "./functionDossierEvidence.js";
 export { callPathInputSchema, callPathResultSchema };
+/** Minimal directed caller-to-callee adjacency for call-path search. */
+class CallGraph {
+    successors = new Map();
+    predecessors = new Map();
+    mergeNode(node) {
+        if (!this.successors.has(node))
+            this.successors.set(node, new Set());
+        if (!this.predecessors.has(node))
+            this.predecessors.set(node, new Set());
+    }
+    mergeDirectedEdge(source, target) {
+        this.mergeNode(source);
+        this.mergeNode(target);
+        this.successors.get(source)?.add(target);
+        this.predecessors.get(target)?.add(source);
+    }
+    hasNode(node) {
+        return this.successors.has(node);
+    }
+    outDegree(node) {
+        return this.successors.get(node)?.size ?? 0;
+    }
+    outNeighbors(node) {
+        return [...(this.successors.get(node) ?? [])];
+    }
+    inNeighbors(node) {
+        return [...(this.predecessors.get(node) ?? [])];
+    }
+}
+/** Shortest remaining distance for every node that can reach the goal. */
+const distancesToGoal = (graph, goal) => {
+    if (!graph.hasNode(goal))
+        return new Map();
+    const depth = new Map([[goal, 0]]);
+    const queue = [goal];
+    for (let index = 0; index < queue.length; index += 1) {
+        const node = queue[index] ?? "";
+        const next = (depth.get(node) ?? 0) + 1;
+        for (const neighbor of graph.inNeighbors(node)) {
+            if (!depth.has(neighbor)) {
+                depth.set(neighbor, next);
+                queue.push(neighbor);
+            }
+        }
+    }
+    return depth;
+};
 /** Reconstruct direct-callee paths from explicit analyze_function Evidence. */
 export const buildCallPath = (input) => {
     const parsed = callPathInputSchema.parse(input);
@@ -13,16 +58,15 @@ export const buildCallPath = (input) => {
         start: parsed.start.address,
         goal: parsed.goal.address,
     });
-    const shortest = graph.hasNode(parsed.start.address) && graph.hasNode(parsed.goal.address)
-        ? bidirectional(graph, parsed.start.address, parsed.goal.address)
-        : null;
-    const paths = shortest === null
+    const goalDistances = distancesToGoal(graph, parsed.goal.address);
+    const shortestDepth = goalDistances.get(parsed.start.address) ?? null;
+    const paths = shortestDepth === null
         ? []
         : enumeratePaths({
             graph,
             start: parsed.start.address,
             goal: parsed.goal.address,
-            shortestDepth: shortest.length - 1,
+            goalDistances,
         }).paths.map((path) => citePath(path, snapshots));
     const shortestHops = paths[0]?.hops;
     const found = shortestHops !== undefined;
@@ -55,7 +99,7 @@ export const buildCallPath = (input) => {
 const summarizeSearch = (graph, reached) => ({
     nodes: reached.size,
     edges: [...reached.keys()].reduce((count, node) => count + (graph.hasNode(node) ? graph.outDegree(node) : 0), 0),
-    depth_reached: Math.max(0, ...reached.values()),
+    depth_reached: [...reached.values()].reduce((maximum, depth) => Math.max(maximum, depth), 0),
 });
 const prepareCallGraph = (input) => {
     const snapshots = parseSnapshots(input.functions);
@@ -94,7 +138,7 @@ const assertCompatible = (snapshots) => {
     }
 };
 const createGraph = (snapshots) => {
-    const graph = new DirectedGraph({ allowSelfLoops: true, multi: false });
+    const graph = new CallGraph();
     for (const [address, snapshot] of snapshots) {
         graph.mergeNode(address);
         for (const callee of snapshot.collections.callees.items) {
@@ -148,41 +192,45 @@ const inspectSearch = ({ graph, snapshots, start, goal, }) => {
         limitations,
     };
 };
-const enumeratePaths = ({ graph, start, goal, shortestDepth, }) => {
+const enumeratePaths = ({ graph, start, goal, goalDistances, }) => {
     const output = [];
-    const state = {
-        graph,
-        goal,
-        path: [start],
-        visited: new Set([start]),
-        output,
+    const path = [start];
+    const neighbors = new Map();
+    const frame = (node) => {
+        let candidates = neighbors.get(node);
+        if (candidates === undefined) {
+            const distance = goalDistances.get(node);
+            candidates = graph
+                .outNeighbors(node)
+                .filter((neighbor) => distance !== undefined &&
+                goalDistances.get(neighbor) === distance - 1)
+                .sort((left, right) => left.localeCompare(right));
+            neighbors.set(node, candidates);
+        }
+        return { neighbors: candidates, nextIndex: 0 };
     };
-    enumerateAtDepth(state, shortestDepth);
-    return { paths: output };
-};
-const enumerateAtDepth = (state, remaining) => {
-    const { graph, goal, path, visited, output } = state;
-    const current = path.at(-1);
-    if (current === undefined)
-        return;
-    if (remaining === 0) {
-        if (current === goal)
+    const pending = [frame(start)];
+    while (pending.length > 0) {
+        const current = pending.at(-1);
+        if (current === undefined)
+            break;
+        if (path.at(-1) === goal) {
             output.push([...path]);
-        return;
-    }
-    if (current === goal)
-        return;
-    for (const neighbor of graph
-        .outNeighbors(current)
-        .sort((left, right) => left.localeCompare(right))) {
-        if (visited.has(neighbor))
+            pending.pop();
+            path.pop();
+            continue;
+        }
+        const neighbor = current.neighbors[current.nextIndex];
+        if (neighbor === undefined) {
+            pending.pop();
+            path.pop();
             continue;
-        visited.add(neighbor);
+        }
+        current.nextIndex += 1;
         path.push(neighbor);
-        enumerateAtDepth(state, remaining - 1);
-        path.pop();
-        visited.delete(neighbor);
+        pending.push(frame(neighbor));
     }
+    return { paths: output };
 };
 const citePath = (addresses, snapshots) => {
     const edges = addresses.slice(0, -1).map((source, index) => {

package/dist/domain/canonicalDigest.js

@@ -0,0 +1,65 @@
+import { createHash } from "node:crypto";
+/** Hash canonicalize-compatible JSON without assembling an aggregate string. */
+export const digestCanonicalValue = (value, context = "Comparison") => {
+    const hash = createHash("sha256");
+    const encoded = emitCanonical(value, (part) => hash.update(part), new Set());
+    if (!encoded)
+        throw new TypeError(`${context} could not canonicalize data`);
+    return hash.digest("hex");
+};
+const emitCanonical = (value, emit, ancestors) => {
+    if (typeof value === "number" && !Number.isFinite(value))
+        throw new Error(Number.isNaN(value) ? "NaN is not allowed" : "Infinity is not allowed");
+    if (value === null || typeof value !== "object") {
+        const encoded = JSON.stringify(value);
+        if (encoded === undefined)
+            return false;
+        emit(encoded);
+        return true;
+    }
+    if (ancestors.has(value))
+        throw new Error("Circular reference detected");
+    ancestors.add(value);
+    try {
+        if ("toJSON" in value && typeof value.toJSON === "function") {
+            const normalized = value.toJSON();
+            return emitCanonical(normalized, emit, ancestors);
+        }
+        if (Array.isArray(value)) {
+            emit("[");
+            const length = value.length;
+            for (let index = 0; index < length; index += 1) {
+                if (index > 0)
+                    emit(",");
+                // Preserve canonicalize's sparse-array and unsupported-value behavior.
+                if (!(index in value))
+                    continue;
+                const item = value[index];
+                emitCanonical(item === undefined || typeof item === "symbol" ? null : item, emit, ancestors);
+            }
+            emit("]");
+        }
+        else {
+            emit("{");
+            let first = true;
+            for (const key of Object.keys(value).sort()) {
+                if (Reflect.get(value, key) === undefined ||
+                    typeof Reflect.get(value, key) === "symbol")
+                    continue;
+                const item = Reflect.get(value, key);
+                if (!first)
+                    emit(",");
+                first = false;
+                emit(JSON.stringify(key));
+                emit(":");
+                if (!emitCanonical(item, emit, ancestors))
+                    emit("undefined");
+            }
+            emit("}");
+        }
+        return true;
+    }
+    finally {
+        ancestors.delete(value);
+    }
+};

package/dist/domain/canonicalOrdering.js

@@ -0,0 +1,11 @@
+/**
+ * Canonical code-point ordering shared across domain and application layers.
+ *
+ * Compares strings by Unicode code point (`<`/`>`) so graph ordering,
+ * fingerprints, and deterministic tie-breaks stay stable regardless of
+ * locale. Prefer this over `String.prototype.localeCompare`, which is
+ * locale-dependent.
+ */
+export const compareCodePoints = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+/** Deduplicate and sort strings with canonical code-point ordering. */
+export const uniqueSorted = (values) => [...new Set(values)].sort(compareCodePoints);

package/dist/domain/changedBehavior.js

@@ -1,7 +1,9 @@
 import { z } from "zod";
 import { artifactComparisonResultSchema } from "./artifactComparison.js";
+import { uniqueSorted } from "./canonicalOrdering.js";
 import { evidenceSchema, parseEvidence } from "./evidence.js";
 import { functionComparisonResultSchema } from "./functionComparison.js";
+import { PROCESS_PROVIDER, isProcessEvidenceProvider, } from "./processEvidenceProvider.js";
 import { comparisonStatusSchema, deriveProcessComparisonStatus, PROCESS_COMPARISON_DIMENSIONS, processCaptureComparisonSchema, } from "./processCapture.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
@@ -65,9 +67,7 @@ export const changedBehaviorResultSchema = z
 const EXPECTED_PROVIDERS = {
     compare_process_captures: {
         predicates: ["rea.process-comparison"],
-        id: "rea-process",
-        name: "REA deterministic process harness",
-        version: "3",
+        ...PROCESS_PROVIDER,
     },
     compare_artifacts: {
         predicates: ["rea.artifact-comparison"],
@@ -132,9 +132,11 @@ const parseComparisonEvidence = (input) => {
         .parse(evidence.operation);
     const expected = EXPECTED_PROVIDERS[operation];
     if (!acceptsPredicate(expected.predicates, evidence.predicate_type) ||
-        evidence.provider.id !== expected.id ||
-        evidence.provider.name !== expected.name ||
-        evidence.provider.version !== expected.version ||
+        (operation === "compare_process_captures"
+            ? !isProcessEvidenceProvider(evidence.provider)
+            : evidence.provider.id !== expected.id ||
+                evidence.provider.name !== expected.name ||
+                evidence.provider.version !== expected.version) ||
         evidence.confidence !== "derived" ||
         evidence.authority !== "analyst-inference" ||
         evidence.subject !== null)
@@ -275,7 +277,6 @@ const count = (findings, classification) => findings.filter((finding) => finding
 const compareFindings = (left, right) => [left.scope, left.dimension, left.source_comparison_id]
     .join("\0")
     .localeCompare([right.scope, right.dimension, right.source_comparison_id].join("\0"), "en");
-const uniqueSorted = (values) => [...new Set(values)].sort((left, right) => left.localeCompare(right, "en"));
 const assertUnique = (values, label) => {
     if (new Set(values).size !== values.length)
         throw new TypeError(`Changed-behavior analysis rejects duplicate ${label}`);

package/dist/domain/comparisonSemantics.js

@@ -1,14 +1,12 @@
-import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
+import { digestCanonicalValue } from "./canonicalDigest.js";
 /** Whether an inventory can support a claim that an item is absent. */
 export const absenceClaimable = (coverage) => coverage.status === "complete" &&
     coverage.truncated !== true &&
     (coverage.omitted_count === undefined || coverage.omitted_count === 0);
 /** SHA-256 of canonical JSON for stable, provider-neutral comparison IDs. */
 export const canonicalDigest = (value, context = "Comparison") => {
-    return createHash("sha256")
-        .update(canonicalJson(value, context))
-        .digest("hex");
+    return digestCanonicalValue(value, context);
 };
 /** Canonical JSON used for deterministic tie breaking and stable digests. */
 export const canonicalJson = (value, context = "Comparison") => {

package/dist/domain/comparisonStatus.js

@@ -0,0 +1,39 @@
+import { z } from "zod";
+/**
+ * Canonical top-level comparison outcome shared by every comparison
+ * pipeline. Pipeline-native detail enums (bundle classifications,
+ * source-to-bundle split/merge kinds, scenario alignment states, function
+ * truncation) keep their wire schemas; the mappers below project each of
+ * them onto this triple without changing any pipeline result.
+ */
+export const comparisonStatusSchema = z.enum([
+    "unchanged",
+    "changed",
+    "unknown",
+]);
+/** Canonical comparison conclusion shared by every comparison pipeline. */
+export const comparisonConclusionSchema = z.enum([
+    "observed_change",
+    "derived_relationship",
+    "contradiction",
+    "unresolved_branch",
+]);
+/** Project a bundle change classification onto the canonical triple. */
+export const bundleClassificationToCanonical = (classification) => (classification === "unknown" ? "unknown" : "changed");
+/** Project a source-to-bundle item status onto the canonical triple. */
+export const sourceToBundleStatusToCanonical = (status) => status === "unchanged"
+    ? "unchanged"
+    : status === "unknown"
+        ? "unknown"
+        : "changed";
+/**
+ * Project a function dimension status onto the canonical triple. A
+ * truncated dimension cannot support an unchanged/changed claim.
+ */
+export const functionStatusToCanonical = (status) => status === "unchanged"
+    ? "unchanged"
+    : status === "changed"
+        ? "changed"
+        : "unknown";
+/** Project a browser-scenario artifact status onto the canonical triple. */
+export const scenarioArtifactStatusToCanonical = (status) => status;

package/dist/domain/configurationErrors.js

@@ -0,0 +1,25 @@
+import { AnalysisError } from "./analysisErrorBase.js";
+/** Runtime configuration could not be parsed safely. */
+export class ConfigurationError extends AnalysisError {
+    _tag = "ConfigurationError";
+}
+/** No app or binary session exists for an analysis request. */
+export class NoBinaryOpenError extends AnalysisError {
+    _tag = "NoBinaryOpenError";
+    constructor() {
+        super("No app is open. Ask the user which app to investigate, then call open_binary with its local path.");
+    }
+}
+/** A supplied target path could not be safely opened as a supported app or binary. */
+export class BinaryTargetError extends AnalysisError {
+    path;
+    reason;
+    _tag = "BinaryTargetError";
+    constraint;
+    constructor(path, reason, options) {
+        super(`Cannot open artifact: ${reason}`, options);
+        this.path = path;
+        this.reason = reason;
+        this.constraint = options?.constraint;
+    }
+}

package/dist/domain/dosCom.js

@@ -0,0 +1,8 @@
+import { z } from "zod";
+import { err, ok } from "./result.js";
+/** Headerless DOS COM interpretation explicitly selected by the caller. */
+export const executableFormatHintSchema = z.literal("dos-com");
+/** Validate the single 64 KiB COM segment, excluding its 256-byte PSP prefix. */
+export const validateDosComLength = (length) => Number.isSafeInteger(length) && length >= 1 && length <= 0xff00
+    ? ok(null)
+    : err("DOS COM requires 1..65280 file bytes (64 KiB segment minus the 256-byte PSP prefix)");

package/dist/domain/evidence.js

@@ -1,6 +1,5 @@
-import { createHash } from "node:crypto";
-import canonicalize from "canonicalize";
 import { z } from "zod";
+import { digestCanonicalValue } from "./canonicalDigest.js";
 import { analysisProfileSchema, } from "./analysisProfile.js";
 import { jsonValueSchema } from "./jsonValue.js";
 import { digestSchema } from "./../domain/digests.js";
@@ -21,6 +20,7 @@ const subjectSchema = z.object({
         "elf",
         "pe",
         "dos-mz",
+        "dos-com",
         "zip",
         "ipa",
         "apk",
@@ -116,14 +116,6 @@ export const evidenceRecordSchema = z.union([
     profiledEvidenceSchema,
     evidenceBaseSchema,
 ]);
-const sha256 = (value) => createHash("sha256").update(value).digest("hex");
-/** Serialize JSON according to RFC 8785 JSON Canonicalization Scheme. */
-const canonicalJson = (value) => {
-    const serialized = canonicalize(value);
-    if (serialized === undefined)
-        throw new TypeError("RFC 8785 canonicalization rejected a JSON value");
-    return serialized;
-};
 const semanticProjection = (evidence) => ({
     subject: evidence.subject === null
         ? null
@@ -149,7 +141,7 @@ const semanticProjection = (evidence) => ({
     evidence_links: evidence.evidence_links,
 });
 /** Recompute the semantic identifier, excluding paths and raw payload bytes. */
-const computeEvidenceId = (evidence) => `ev_${sha256(canonicalJson(semanticProjection(evidence)))}`;
+const computeEvidenceId = (evidence) => `ev_${digestCanonicalValue(semanticProjection(evidence), "Evidence")}`;
 /** Parse evidence and reject a syntactically valid but tampered semantic ID. */
 export const parseEvidence = (input) => {
     const evidence = evidenceRecordSchema.parse(input);

package/dist/domain/evidenceBundle.js

@@ -69,21 +69,47 @@ export const createEvidenceBundle = (records, unknowns = []) => {
 /** Restrict a bundle to records and complete unknown histories for one artifact. */
 export const evidenceBundleForTarget = (bundle, sha256) => {
     const recordsById = new Map(bundle.records.map((record) => [record.evidence_id, record]));
-    let unknowns = bundle.unknowns.filter(({ scope_digest: scopeDigest }) => scopeDigest === sha256);
-    let changed = true;
-    while (changed) {
-        const ids = new Set(unknowns.map(({ unknown_id: id }) => id));
-        const retained = unknowns.filter((unknown) => unknown.relationships.every(({ unknown_id: id }) => ids.has(id)) &&
-            referencedEvidenceIds(unknown).every((id) => {
-                const record = recordsById.get(id);
-                return (record?.subject?.digest.sha256 === sha256 ||
-                    (unknown.mutation_evidence_ids.includes(id) &&
-                        record?.subject === null &&
-                        record.predicate_type === "rea.residual-unknown-mutation"));
-            }));
-        changed = retained.length !== unknowns.length;
-        unknowns = retained;
+    const candidates = bundle.unknowns.filter(({ scope_digest: scopeDigest }) => scopeDigest === sha256);
+    const retained = new Set();
+    const revisionsById = new Map();
+    const dependents = new Map();
+    for (const unknown of candidates) {
+        const mutationEvidenceIds = new Set(unknown.mutation_evidence_ids);
+        const evidenceAvailable = referencedEvidenceIds(unknown).every((id) => {
+            const record = recordsById.get(id);
+            return (record?.subject?.digest.sha256 === sha256 ||
+                (mutationEvidenceIds.has(id) &&
+                    record?.subject === null &&
+                    record.predicate_type === "rea.residual-unknown-mutation"));
+        });
+        if (!evidenceAvailable)
+            continue;
+        retained.add(unknown);
+        revisionsById.set(unknown.unknown_id, (revisionsById.get(unknown.unknown_id) ?? 0) + 1);
+        for (const relatedId of new Set(unknown.relationships.map(({ unknown_id: id }) => id))) {
+            const references = dependents.get(relatedId) ?? new Set();
+            references.add(unknown);
+            dependents.set(relatedId, references);
+        }
     }
+    const pending = [];
+    for (const unknown of retained)
+        if (unknown.relationships.some(({ unknown_id: id }) => !revisionsById.has(id)))
+            pending.push(unknown);
+    for (let index = 0; index < pending.length; index += 1) {
+        const unknown = pending[index];
+        if (unknown === undefined || !retained.delete(unknown))
+            continue;
+        const remaining = (revisionsById.get(unknown.unknown_id) ?? 1) - 1;
+        if (remaining > 0) {
+            revisionsById.set(unknown.unknown_id, remaining);
+            continue;
+        }
+        revisionsById.delete(unknown.unknown_id);
+        for (const dependent of dependents.get(unknown.unknown_id) ?? [])
+            pending.push(dependent);
+    }
+    const unknowns = candidates.filter((unknown) => retained.has(unknown));
     const mutationIds = new Set(unknowns.flatMap(({ mutation_evidence_ids: ids }) => ids));
     return createEvidenceBundle(bundle.records.filter((record) => record.subject?.digest.sha256 === sha256 ||
         mutationIds.has(record.evidence_id)), unknowns);
@@ -182,13 +208,20 @@ export const validateResidualUnknownAddition = (unknown, evidenceById, currentHe
             throw new TypeError(`Residual unknown references missing unknown ${relationship.unknown_id}`);
     if (unknown.resolution?.disposition === "verified")
         validateVerifiedResolution(unknown, evidenceById);
-    for (const relationship of unknown.relationships)
-        if (relationship.type === "depends-on" &&
-            reachesUnknown(relationship.unknown_id, unknown.unknown_id, currentHeads, unknown))
+    // In a valid graph, no existing node can point to an absent ID. Since the
+    // schema rejects self-relations, a new node's outgoing edges cannot close a
+    // cycle; keep graph traversal for revisions of existing nodes only.
+    if (current !== undefined) {
+        const dependencies = unknown.relationships
+            .filter((relationship) => relationship.type === "depends-on")
+            .map(({ unknown_id }) => unknown_id);
+        if (dependencies.length > 0 &&
+            reachesUnknown(dependencies, unknown.unknown_id, currentHeads, unknown))
             throw new TypeError("Residual unknown dependency graph contains a cycle");
+    }
 };
-const reachesUnknown = (start, goal, currentHeads, candidate) => {
-    const pending = [start];
+const reachesUnknown = (starts, goal, currentHeads, candidate) => {
+    const pending = [...starts];
     const visited = new Set();
     while (pending.length > 0) {
         const id = pending.pop();
@@ -232,23 +265,53 @@ const evidenceQualifies = (unknown, evidence) => {
 const rejectDependencyCycles = (unknownById) => {
     const visited = new Set();
     const active = new Set();
-    const visit = (id) => {
-        if (active.has(id))
-            throw new TypeError("Residual unknown dependency graph contains a cycle");
-        if (visited.has(id))
-            return;
-        active.add(id);
-        const unknown = unknownById.get(id);
-        if (unknown === undefined)
+    const pending = [];
+    for (const root of unknownById.keys()) {
+        if (visited.has(root))
+            continue;
+        const rootUnknown = unknownById.get(root);
+        if (rootUnknown === undefined)
             throw new TypeError("Residual unknown dependency graph is inconsistent");
-        for (const relationship of unknown.relationships)
-            if (relationship.type === "depends-on")
-                visit(relationship.unknown_id);
-        active.delete(id);
-        visited.add(id);
-    };
-    for (const id of unknownById.keys())
-        visit(id);
+        active.add(root);
+        pending.push({
+            id: root,
+            relationships: rootUnknown.relationships,
+            nextRelationship: 0,
+        });
+        while (pending.length > 0) {
+            const frame = pending[pending.length - 1];
+            if (frame === undefined)
+                break;
+            let descended = false;
+            while (frame.nextRelationship < frame.relationships.length) {
+                const relationship = frame.relationships[frame.nextRelationship];
+                frame.nextRelationship += 1;
+                if (relationship?.type !== "depends-on")
+                    continue;
+                const dependency = relationship.unknown_id;
+                if (active.has(dependency))
+                    throw new TypeError("Residual unknown dependency graph contains a cycle");
+                if (visited.has(dependency))
+                    continue;
+                const unknown = unknownById.get(dependency);
+                if (unknown === undefined)
+                    throw new TypeError("Residual unknown dependency graph is inconsistent");
+                active.add(dependency);
+                pending.push({
+                    id: dependency,
+                    relationships: unknown.relationships,
+                    nextRelationship: 0,
+                });
+                descended = true;
+                break;
+            }
+            if (descended)
+                continue;
+            pending.pop();
+            active.delete(frame.id);
+            visited.add(frame.id);
+        }
+    }
 };
 /** Encode a validated bundle as byte-stable RFC 8785 canonical JSON. */
 export const serializeEvidenceBundle = (bundle) => {

package/dist/domain/evidenceErrors.js

@@ -0,0 +1,30 @@
+import { AnalysisError } from "./analysisErrorBase.js";
+/** Evidence identity, schema, or bundle manifests failed integrity checks. */
+export class EvidenceIntegrityError extends AnalysisError {
+    _tag = "EvidenceIntegrityError";
+}
+/** A session Evidence reference is missing or has the wrong semantic identity. */
+export class EvidenceReferenceError extends EvidenceIntegrityError {
+    evidenceId;
+    reason;
+    expected;
+    actual;
+    constructor(evidenceId, reason, expected, actual) {
+        super(`Evidence reference ${reason}: ${evidenceId}`);
+        this.evidenceId = evidenceId;
+        this.reason = reason;
+        this.expected = expected;
+        this.actual = actual;
+    }
+}
+/** Evidence bundle filesystem access failed within the configured policy. */
+export class EvidenceFileError extends AnalysisError {
+    operation;
+    reason;
+    _tag = "EvidenceFileError";
+    constructor(operation, reason, options) {
+        super(`Evidence bundle ${operation} failed: ${reason}`, options);
+        this.operation = operation;
+        this.reason = reason;
+    }
+}