rea-agents 4.0.1 → 5.0.0

package/dist/domain/firmware/firmwareAnalysis.js

@@ -0,0 +1,121 @@
+import { z } from "zod";
+import { digestSchema } from "../digests.js";
+import { jsonValueSchema } from "../jsonValue.js";
+const bytes = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
+const range = z.strictObject({ offset: bytes, length: bytes.positive() });
+const target = {
+    path: z.string().min(1).describe("Local firmware file; never executed"),
+};
+/** Explicit firmware inspection and extraction intent, independent of engines. */
+export const firmwareInputSchemas = {
+    inspect_firmware_regions: z.strictObject(target),
+    extract_firmware: z.strictObject({
+        ...target,
+        output_directory: z
+            .string()
+            .min(1)
+            .describe("Absolute, absent output directory; parent must exist"),
+        range: range
+            .optional()
+            .describe("Explicit file-byte interval; omit to extract the whole file"),
+        max_depth: z
+            .number()
+            .int()
+            .min(1)
+            .max(10)
+            .default(3)
+            .describe("Extraction depth; reaching it yields partial analysis"),
+        max_output_bytes: z
+            .number()
+            .int()
+            .min(1)
+            .max(512 * 1024 * 1024)
+            .default(256 * 1024 * 1024)
+            .describe("Staging file-byte budget, checked during extraction; transient overshoot is possible"),
+        max_output_files: z
+            .number()
+            .int()
+            .min(1)
+            .max(100_000)
+            .default(10_000)
+            .describe("Staging entry budget, including directories and links"),
+    }),
+};
+/** Validate the operation with its exact input contract. */
+export const firmwareRequestSchema = z.discriminatedUnion("operation", [
+    z.strictObject({
+        operation: z.literal("inspect_firmware_regions"),
+        input: firmwareInputSchemas.inspect_firmware_regions,
+    }),
+    z.strictObject({
+        operation: z.literal("extract_firmware"),
+        input: firmwareInputSchemas.extract_firmware,
+    }),
+]);
+const engine = z.strictObject({
+    name: z.string(),
+    version: z.string(),
+    executable_path: z.string(),
+    executable_sha256: digestSchema,
+    source_revision: z.null(),
+    worker_count: z.literal(1),
+});
+const selection = z.strictObject({ ...range.shape, sha256: digestSchema });
+const chunk = z.strictObject({
+    input_path: z.string(),
+    provider_id: z.string(),
+    range,
+    handler: z.string().nullable(),
+    encrypted: z.boolean().nullable(),
+    root_file_range: range.nullable(),
+});
+/** Portable results retain reported boundaries, unknowns and extraction lineage. */
+export const firmwareResultSchemas = {
+    inspect_firmware_regions: z.strictObject({
+        engine,
+        input_size: bytes,
+        regions: z.array(z.strictObject({
+            provider_id: z.string(),
+            offset: bytes,
+            reported_size: bytes,
+            signature: z.string(),
+            description: z.string(),
+            reported_confidence: z.number().int().min(0).max(255),
+            size_basis: z.literal("provider_reported_validation_unknown"),
+        })),
+        coverage: z.literal("signature_scan"),
+    }),
+    extract_firmware: z.strictObject({
+        engine,
+        selection,
+        output_directory: z.string(),
+        coverage: z.enum(["complete", "partial"]),
+        files: z.array(z.strictObject({
+            relative_path: z.string(),
+            path: z.string(),
+            size: bytes,
+            sha256: digestSchema,
+            reported_sha256: digestSchema.nullable(),
+            mime_type: z.string().nullable(),
+            analysis_depth: bytes.nullable(),
+            runtime_address: z.null(),
+            original_file_range: z.null(),
+        })),
+        unpublished_entries: z.array(z.strictObject({
+            relative_path: z.string(),
+            kind: z.enum(["symlink", "special"]),
+            link_target: z.string().nullable(),
+        })),
+        chunks: z.array(chunk),
+        derivations: z.array(z.strictObject({
+            parent_path: z.string(),
+            child_path: z.string(),
+            provider_blob_id: z.string(),
+            handler: z.string().nullable(),
+            parent_file_range: range.nullable(),
+        })),
+        depth_limited_paths: z.array(z.string()),
+        diagnostics: z.array(jsonValueSchema),
+        published_bytes: bytes,
+    }),
+};

package/dist/domain/functionComparison.js

@@ -1,7 +1,8 @@
+import { canonicalJson } from "./comparisonSemantics.js";
 import { parseFunctionEvidence } from "./functionDossierEvidence.js";
 import { functionMatch } from "./functionComparisonNormalization.js";
 import { functionComparisonResultSchema, } from "./functionComparisonSchemas.js";
-import { overallStatus, summarize, canonicalJson, } from "./functionComparisonResults.js";
+import { overallStatus, summarize } from "./functionComparisonResults.js";
 import { compareDimensions } from "./functionComparisonDimensions.js";
 export { functionComparisonInputSchema, functionComparisonResultSchema, } from "./functionComparisonSchemas.js";
 /** Compare two complete function Evidence records without fuzzy matching. */
@@ -9,7 +10,8 @@ export const compareFunctions = (leftInput, rightInput) => {
     const left = parseFunctionEvidence(leftInput);
     const right = parseFunctionEvidence(rightInput);
     const links = [left.evidence[0].evidence_id, right.evidence[0].evidence_id];
-    const providersDiffer = canonicalJson(left.provider) !== canonicalJson(right.provider);
+    const providersDiffer = canonicalJson(left.provider, "Function comparison") !==
+        canonicalJson(right.provider, "Function comparison");
     const dimensions = compareDimensions(left, right, links, providersDiffer);
     const match = functionMatch(left, right);
     const changes = dimensions.filter(({ status }) => status !== "unchanged");

package/dist/domain/functionComparisonDimensions.js

@@ -1,6 +1,7 @@
+import { canonicalJson } from "./comparisonSemantics.js";
 import { diffLines } from "diff";
 import { commentProjection, combineCoverage, identityProjection, isAutoName, normalizeCfg, project, referenceKindProjection, referenceProjection, sorted, stringAndNameProjection, } from "./functionComparisonNormalization.js";
-import { canonicalJson, dimensionResult, unresolvedDimension as buildUnresolvedDimension, } from "./functionComparisonResults.js";
+import { dimensionResult, unresolvedDimension as buildUnresolvedDimension, } from "./functionComparisonResults.js";
 const unresolvedDimension = (...[dimension, status, links, leftCount, rightCount, limitations]) => buildUnresolvedDimension({
     dimension,
     status,
@@ -86,7 +87,8 @@ const compareReferences = (left, right, links, providersDiffer) => {
     const rightProjection = referenceProjection(right);
     if (leftProjection.length === 0 && rightProjection.length === 0)
         return compareValues("references", leftProjection, rightProjection, links, true, true, providersDiffer);
-    if (canonicalJson(leftProjection) !== canonicalJson(rightProjection))
+    if (canonicalJson(leftProjection, "Function comparison") !==
+        canonicalJson(rightProjection, "Function comparison"))
         return dimensionResult({
             dimension: "references",
             status: "changed",
@@ -147,8 +149,8 @@ const compareCfg = (left, right, links, providersDiffer) => {
 const compareValues = (...[dimension, left, right, links, leftComplete, rightComplete, providersDiffer,]) => {
     if (!leftComplete || !rightComplete)
         return unresolvedDimension(dimension, "unknown", links, null, null, []);
-    const leftJson = canonicalJson(left);
-    const rightJson = canonicalJson(right);
+    const leftJson = canonicalJson(left, "Function comparison");
+    const rightJson = canonicalJson(right, "Function comparison");
     return dimensionResult({
         dimension,
         status: leftJson === rightJson ? "unchanged" : "changed",

package/dist/domain/functionComparisonNormalization.js

@@ -1,4 +1,5 @@
-import canonicalize from "canonicalize";
+import { canonicalJson } from "./comparisonSemantics.js";
+import { compareCodePoints } from "./canonicalOrdering.js";
 export const identityProjection = (snapshot) => ({
     name: snapshot.procedure.name,
     signature: snapshot.procedure.signature,
@@ -128,7 +129,17 @@ export const stringAndNameProjection = (snapshot) => {
         ? null
         : sorted(values);
 };
-export const sorted = (values) => [...values].sort((left, right) => canonicalJson(left).localeCompare(canonicalJson(right)));
+export const sorted = (values) => values
+    .map((value) => ({
+    value,
+    json: canonicalJson(value, "Function normalization"),
+}))
+    .sort((left, right) => {
+    // Preserve existing collation while ordering distinct values within a tie.
+    return (left.json.localeCompare(right.json) ||
+        compareCodePoints(left.json, right.json));
+})
+    .map(({ value }) => value);
 export const combineCoverage = (left, right) => {
     return {
         items: [...left.items, ...right.items],
@@ -147,9 +158,3 @@ const relativeAddress = (value, base) => {
         ? null
         : String(parsed - parsedBase);
 };
-const canonicalJson = (value) => {
-    const encoded = canonicalize(value);
-    if (encoded === undefined)
-        throw new TypeError("Function normalization could not canonicalize data");
-    return encoded;
-};

package/dist/domain/functionComparisonResults.js

@@ -1,4 +1,4 @@
-import { canonicalDigest, canonicalJson as encodeCanonicalJson, } from "./comparisonSemantics.js";
+import { canonicalDigest } from "./comparisonSemantics.js";
 export const dimensionResult = (input) => {
     const context = {
         dimension: input.dimension,
@@ -54,7 +54,4 @@ export const summarize = (dimensions) => ({
     truncated: dimensions.filter(({ status }) => status === "truncated").length,
     unknown: dimensions.filter(({ status }) => status === "unknown").length,
 });
-export const canonicalJson = (value) => {
-    return encodeCanonicalJson(value, "Function comparison");
-};
 const digest = (value) => canonicalDigest(value, "Function comparison");

package/dist/domain/hopperErrors.js

@@ -0,0 +1,78 @@
+import { AnalysisError } from "./analysisErrorBase.js";
+import { hopperStartupFailure, } from "./hopperStartupFailure.js";
+/** Base class for failures produced specifically by the Hopper provider. */
+export class HopperError extends AnalysisError {
+}
+/** Hopper did not respond within the configured operation deadline. */
+export class HopperTimeoutError extends HopperError {
+    timeoutMs;
+    operation;
+    requestId;
+    providerState;
+    _tag = "HopperTimeoutError";
+    constructor(timeoutMs, operation, requestId, providerState = "not_started") {
+        super(`Hopper ${operation === undefined ? "startup" : operation} timed out after ${String(timeoutMs)}ms`);
+        this.timeoutMs = timeoutMs;
+        this.operation = operation;
+        this.requestId = requestId;
+        this.providerState = providerState;
+    }
+}
+/** The caller cancelled a Hopper operation before it completed. */
+export class HopperCancelledError extends HopperError {
+    _tag = "HopperCancelledError";
+    constructor() {
+        super("Hopper operation was cancelled");
+    }
+}
+/** Hopper returned bytes or JSON that do not satisfy the NDJSON RPC contract. */
+export class HopperProtocolError extends HopperError {
+    _tag = "HopperProtocolError";
+}
+export class HopperRemoteError extends HopperError {
+    code;
+    safeMessage;
+    _tag = "HopperRemoteError";
+    diagnosticType;
+    operation;
+    requestId;
+    constructor(code, safeMessage, context = {}) {
+        super(`Hopper request failed (${String(code)}): ${safeMessage}`);
+        this.code = code;
+        this.safeMessage = safeMessage;
+        this.diagnosticType = context.diagnosticType ?? "remote";
+        this.operation = context.operation;
+        this.requestId = context.requestId;
+    }
+}
+/** The owned Hopper bridge stopped before its client was closed. */
+export class HopperProcessError extends HopperError {
+    exitCode;
+    diagnostic;
+    operation;
+    requestId;
+    _tag = "HopperProcessError";
+    failureCode;
+    userMessage;
+    constructor(exitCode, diagnostic, operation, requestId) {
+        super(`Hopper bridge stopped unexpectedly with code ${String(exitCode)}`);
+        this.exitCode = exitCode;
+        this.diagnostic = diagnostic;
+        this.operation = operation;
+        this.requestId = requestId;
+        const failure = hopperStartupFailure(exitCode);
+        this.failureCode = failure?.code;
+        this.userMessage = failure?.message;
+    }
+}
+/** Hopper or the repository bridge could not be started. */
+export class HopperStartError extends HopperError {
+    _tag = "HopperStartError";
+    userMessage;
+    ownerRunId;
+    constructor(options) {
+        super("Hopper application bridge could not be started", options);
+        this.userMessage = options?.userMessage;
+        this.ownerRunId = options?.ownerRunId;
+    }
+}

package/dist/domain/hopperValues.js

@@ -1,8 +1,9 @@
 import { z } from "zod";
-import { AnalysisOutputError, HopperProtocolError } from "./errors.js";
 import { err, ok } from "./result.js";
-import { nativeApiBoundarySchema } from "./nativeApiBoundary.js";
-import { nativeValueFlowSchema } from "./nativeValueFlow.js";
+import { nativeApiBoundarySchema } from "./native/nativeApiBoundary.js";
+import { nativeValueFlowSchema } from "./native/nativeValueFlow.js";
+import { AnalysisOutputError } from "./analysisErrorCore.js";
+import { HopperProtocolError } from "./hopperErrors.js";
 /** Return a bounded byte distance between canonical addresses in one space. */
 export const addressDistance = (start, end) => {
     const left = addressCoordinate(start);

package/dist/domain/inputIssueProjection.js

@@ -2,8 +2,11 @@
 export const projectInputIssues = (issues, input) => issues.flatMap((issue) => projectIssue(issue, input));
 const projectIssue = (issue, input) => {
     const path = issue.path.flatMap((part) => typeof part === "string" || typeof part === "number" ? [part] : []);
+    // Branch issue paths are relative to the union; branches often agree.
     if (issue.code === "invalid_union")
-        return issue.errors.flatMap((branch) => branch.flatMap((branchIssue) => projectIssue(branchIssue, input)));
+        return uniqueIssues(issue.errors.flatMap((branch) => branch.flatMap((branchIssue) => projectIssue({ ...branchIssue, path: [...issue.path, ...branchIssue.path] }, input))));
+    if (issue.code === "invalid_key")
+        return issue.issues.flatMap((keyIssue) => projectIssue({ ...keyIssue, path: [...issue.path, ...keyIssue.path] }, input));
     if (issue.code === "unrecognized_keys")
         return issue.keys.map((key) => ({
             path: [...path, key],
@@ -24,7 +27,16 @@ const projectIssue = (issue, input) => {
     if (issue.code === "too_big")
         return [boundedIssue(path, "maximum", numericBound(issue.maximum))];
     if (issue.code === "invalid_format")
-        return [{ path, reason: "invalid_format", expected: issue.format }];
+        return [
+            {
+                path,
+                reason: "invalid_format",
+                expected: issue.format,
+                ...(issue.format === "regex" && issue.message.length > 0
+                    ? { message: issue.message }
+                    : {}),
+            },
+        ];
     if (issue.code === "invalid_value")
         return [
             {
@@ -41,6 +53,9 @@ const projectIssue = (issue, input) => {
         },
     ];
 };
+const uniqueIssues = (issues) => [
+    ...new Map(issues.map((issue) => [JSON.stringify(issue), issue])).values(),
+];
 const valueAtPath = (input, path) => {
     let current = input;
     for (const part of path) {

package/dist/domain/{electronActiveObservation.js → javascript/electronActiveObservation.js}

@@ -14,7 +14,9 @@ const deepLinkUrlSchema = z
     try {
         return new URL(value).protocol.length > 0;
     }
-    catch {
+    catch (cause) {
+        // Invalid input fails the refinement.
+        void cause;
         return false;
     }
 }, "deep-link url must be an absolute URL");

package/dist/domain/{electronObservation.js → javascript/electronObservation.js}

@@ -1,8 +1,9 @@
 import { z } from "zod";
-import { browserCompletenessSchema } from "./browserCompleteness.js";
-import { browserEndpointSchema } from "./browserObservation.js";
-import { webTextArtifactSchema } from "./webContentArtifact.js";
-import { prefixedDigestSchema } from "./../domain/digests.js";
+import { browserCompletenessSchema } from "../browserCompleteness.js";
+import { browserEndpointSchema } from "../browserObservation.js";
+import { browserVersionSchema } from "../browserObservationSchemas.js";
+import { webTextArtifactSchema } from "../webContentArtifact.js";
+import { prefixedDigestSchema } from "../digests.js";
 const approvedElectronInput = {
     cdp_endpoint: browserEndpointSchema,
 };
@@ -26,13 +27,6 @@ export const inspectElectronPageInputSchema = z.union([
         include_script_sources: z.literal(true),
     }),
 ]);
-const browserVersionSchema = z.object({
-    product: z.string(),
-    protocol_version: z.string(),
-    revision: z.string(),
-    user_agent: z.string(),
-    js_version: z.string(),
-});
 const electronTargetSchema = z.object({
     target_id: z.string(),
     type: z.string(),

package/dist/domain/{electronStaticAnalysisBrowser.js → javascript/electronStaticAnalysisBrowser.js}

@@ -1,7 +1,9 @@
 import * as t from "@babel/types";
 import { boundedExpression, collectContextBridgeMembers, electronStaticValue, objectProperty, } from "./electronStaticAnalysisValues.js";
+import { compareCodePoints } from "../canonicalOrdering.js";
 import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
-import { argumentNode, calleeName, compareCodePoints, propertyName, range, staticPath, staticPathResolutionContext, } from "./javascriptStaticAnalysisHelpers.js";
+import { argumentNode, calleeName, range, staticPath, staticPathResolutionContext, } from "./javascriptStaticAnalysisHelpers.js";
+import { semanticStaticPropertyName } from "./javascriptAstValues.js";
 /** Inspect BrowserWindow, contextBridge, and utility-process syntax. */
 export const inspectElectronBrowserNode = (node, context) => {
     if (t.isNewExpression(node))
@@ -38,29 +40,16 @@ const inspectBrowserWindow = (node, context) => {
     });
 };
 const collectWindowOptions = (source, options) => {
-    if (!t.isObjectExpression(options))
+    const lookup = objectProperty(options, "webPreferences");
+    if (lookup.status !== "explicit" ||
+        !t.isObjectExpression(lookup.property.value))
         return {
-            status: options === undefined ? "missing" : "dynamic",
+            status: lookup.status === "missing" ? "missing" : "dynamic",
             preferences: [],
             preload: { preload_path: null, preload_resolution_context: null },
-            unknown: options === undefined ? 0 : 1,
+            unknown: lookup.status === "missing" ? 0 : 1,
         };
-    const property = objectProperty(options, "webPreferences");
-    if (property === undefined)
-        return {
-            status: "missing",
-            preferences: [],
-            preload: { preload_path: null, preload_resolution_context: null },
-            unknown: 0,
-        };
-    if (!t.isObjectExpression(property.value))
-        return {
-            status: "dynamic",
-            preferences: [],
-            preload: { preload_path: null, preload_resolution_context: null },
-            unknown: 1,
-        };
-    return collectWebPreferences(source, property.value);
+    return collectWebPreferences(source, lookup.property.value);
 };
 const collectWebPreferences = (source, object) => {
     const preferences = [];
@@ -78,7 +67,7 @@ const collectWebPreferences = (source, object) => {
             });
             continue;
         }
-        const name = propertyName(property.key);
+        const name = semanticStaticPropertyName(property.key, property.computed);
         if (name === "" || property.computed) {
             unknown += 1;
             preferences.push({
@@ -164,10 +153,12 @@ const inspectUtilityProcess = (node, context) => {
     const moduleNode = argumentNode(node.arguments[0]);
     const modulePath = moduleNode === undefined ? undefined : staticPath(moduleNode);
     const options = argumentNode(node.arguments[2]);
-    const serviceName = t.isObjectExpression(options) &&
-        objectProperty(options, "serviceName") !== undefined
-        ? staticPath(objectProperty(options, "serviceName")?.value ?? options)
+    const serviceNameProperty = objectProperty(options, "serviceName");
+    const serviceName = serviceNameProperty.status === "explicit"
+        ? staticPath(serviceNameProperty.property.value)
         : undefined;
+    if (serviceNameProperty.status !== "missing" && serviceName === undefined)
+        context.accumulator.unknownFindings += 1;
     if (modulePath === undefined)
         context.accumulator.unknownFindings += 1;
     const moduleReference = modulePath === undefined || moduleNode === undefined

package/dist/domain/{electronStaticAnalysisIpc.js → javascript/electronStaticAnalysisIpc.js}

@@ -1,7 +1,7 @@
 import * as t from "@babel/types";
 import { boundedExpression, electronStaticValue, handlerKind, } from "./electronStaticAnalysisValues.js";
 import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
-import { argumentNode, calleeName, propertyName, range, } from "./javascriptStaticAnalysisHelpers.js";
+import { argumentNode, calleeName, range, semanticStaticPropertyName, } from "./javascriptStaticAnalysisHelpers.js";
 /** Inspect Electron IPC operations and validation candidates. */
 export const inspectElectronIpcNode = (node, context) => {
     if (t.isCallExpression(node)) {
@@ -90,7 +90,7 @@ const inspectValidationCall = (node, context) => {
     if (!t.isMemberExpression(node.callee) &&
         !t.isOptionalMemberExpression(node.callee))
         return;
-    const method = propertyName(node.callee.property);
+    const method = semanticStaticPropertyName(node.callee.property, node.callee.computed);
     if (!["startsWith", "endsWith", "includes"].includes(method))
         return;
     const subject = t.isNode(node.callee.object)

package/dist/domain/{electronStaticAnalysisNative.js → javascript/electronStaticAnalysisNative.js}

@@ -1,6 +1,8 @@
 import * as t from "@babel/types";
+import { compareCodePoints } from "../canonicalOrdering.js";
+import { stripQueryAndFragment } from "../artifactPathSyntax.js";
 import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
-import { argumentNode, calleeName, compareCodePoints, propertyName, range, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
+import { argumentNode, calleeName, propertyName, range, semanticStaticPropertyName, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
 /** Inspect JavaScript-side imports and re-exports of native .node addons. */
 export const inspectElectronNativeNode = (node, context) => {
     if (t.isImportDeclaration(node))
@@ -112,14 +114,14 @@ const addBinding = (input) => {
     });
 };
 const nativeRequire = (node) => {
-    if (t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) {
-        const nested = t.isNode(node.object)
-            ? nativeRequire(node.object)
-            : undefined;
-        if (nested === undefined)
+    let member = null;
+    while (t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) {
+        if (!t.isNode(node.object))
             return undefined;
-        const member = propertyName(node.property);
-        return { ...nested, member: member === "" ? nested.member : member };
+        const property = semanticStaticPropertyName(node.property, node.computed);
+        if (member === null && property !== "")
+            member = property;
+        node = node.object;
     }
     if (!t.isCallExpression(node))
         return undefined;
@@ -130,7 +132,7 @@ const nativeRequire = (node) => {
         return undefined;
     const specifier = stringValue(argumentNode(node.arguments[0]));
     return specifier !== undefined && isNativeSpecifier(specifier, "require")
-        ? { specifier, member: null }
+        ? { specifier, member }
         : undefined;
 };
 const bindingMembers = (pattern) => {
@@ -159,8 +161,6 @@ const exportedMember = (node) => {
     return undefined;
 };
 const isNativeSpecifier = (specifier, moduleKind) => {
-    const path = moduleKind === "require"
-        ? specifier
-        : (specifier.split("#", 1)[0]?.split("?", 1)[0] ?? "");
+    const path = moduleKind === "require" ? specifier : stripQueryAndFragment(specifier);
     return path.toLowerCase().endsWith(".node");
 };

package/dist/domain/javascript/electronStaticAnalysisTypes.js

@@ -0,0 +1 @@
+export {};

package/dist/domain/{electronStaticAnalysisValues.js → javascript/electronStaticAnalysisValues.js}

@@ -1,5 +1,7 @@
 import * as t from "@babel/types";
-import { compareCodePoints, propertyName, sourceSlice, } from "./javascriptStaticAnalysisHelpers.js";
+import { compareCodePoints } from "../canonicalOrdering.js";
+import { semanticStaticPropertyName } from "./javascriptAstValues.js";
+import { sourceSlice } from "./javascriptStaticAnalysisHelpers.js";
 /** Preserve one literal value or the exact inert expression. */
 export const electronStaticValue = (source, node) => {
     const literal = literalValue(node);
@@ -18,8 +20,26 @@ export const boundedExpression = (source, node) => {
     const expression = sourceSlice(source, node).trim();
     return expression === "" ? `[${node.type}]` : expression;
 };
-/** Read one named object property without following spreads or bindings. */
-export const objectProperty = (object, name) => object.properties.find((property) => t.isObjectProperty(property) && propertyName(property.key) === name);
+/** Find the effective explicit property, preserving unresolved overrides. */
+export const objectProperty = (object, name) => {
+    if (object === undefined)
+        return { status: "missing" };
+    if (!t.isObjectExpression(object))
+        return { status: "dynamic" };
+    for (const property of object.properties.toReversed()) {
+        if (t.isSpreadElement(property))
+            return { status: "dynamic" };
+        const key = semanticStaticPropertyName(property.key, property.computed);
+        if (key === "" && !t.isStringLiteral(property.key))
+            return { status: "dynamic" };
+        if (key !== name)
+            continue;
+        return t.isObjectProperty(property)
+            ? { status: "explicit", property }
+            : { status: "dynamic" };
+    }
+    return { status: "missing" };
+};
 export function handlerKind(node) {
     if (node === null || node === undefined)
         return "missing";
@@ -69,7 +89,7 @@ const collectMembersAt = (object, prefix, depth, state) => {
             state.unknown += 1;
             continue;
         }
-        const name = propertyName(property.key);
+        const name = semanticStaticPropertyName(property.key, property.computed);
         if (name === "" || property.computed) {
             state.unknown += 1;
             continue;

package/dist/domain/{javascriptApplicationAnalysis.js → javascript/javascriptApplicationAnalysis.js}

@@ -1,8 +1,8 @@
 import { z } from "zod";
 import { javascriptApplicationGraphSchema } from "./javascriptApplicationGraph.js";
 import { javaScriptSemanticGraphSchema } from "./javascriptSemanticGraph.js";
-import { digestSchema } from "./../domain/digests.js";
-import { prefixedDigestSchema } from "./../domain/digests.js";
+import { digestSchema } from "../digests.js";
+import { prefixedDigestSchema } from "../digests.js";
 const countSchema = z.number().int().min(0);
 /** Public target-free request for static JavaScript application analysis. */
 export const analyzeJavaScriptApplicationInputSchema = z.strictObject({

package/dist/domain/{javascriptApplicationChangeGraph.js → javascript/javascriptApplicationChangeGraph.js}

@@ -1,4 +1,5 @@
-import { compareCodePoints, createJavaScriptApplicationEdge, createJavaScriptApplicationGraph, createJavaScriptApplicationNode, } from "./javascriptApplicationGraph.js";
+import { createJavaScriptApplicationEdge, createJavaScriptApplicationGraph, createJavaScriptApplicationNode, } from "./javascriptApplicationGraph.js";
+import { compareCodePoints, uniqueSorted } from "../canonicalOrdering.js";
 /** Merge compared nodes and add inferred right-to-left changed_from edges. */
 export const buildJavaScriptApplicationChangeGraph = (input) => {
     const allNodes = nodeCandidates(input);
@@ -168,4 +169,3 @@ const mergeNodes = (nodes) => {
     return merged.sort((left, right) => compareCodePoints(left.node_id, right.node_id));
 };
 const uniqueEdges = (edges) => [...new Map(edges.map((edge) => [edge.edge_id, edge])).values()].sort((left, right) => compareCodePoints(left.edge_id, right.edge_id));
-const uniqueSorted = (values) => [...new Set(values)].sort(compareCodePoints);

package/dist/domain/{javascriptApplicationEvidenceSchemas.js → javascript/javascriptApplicationEvidenceSchemas.js}

@@ -1,6 +1,6 @@
 import { z } from "zod";
-import { digestSchema } from "./../domain/digests.js";
-import { prefixedDigestSchema } from "./../domain/digests.js";
+import { digestSchema } from "../digests.js";
+import { prefixedDigestSchema } from "../digests.js";
 const boundedTextSchema = z.string().min(1);
 const boundedKeySchema = z.string().min(1);
 const unsafePathSegments = new Set(["", ".", ".."]);
@@ -345,7 +345,8 @@ export const applicationNodeIdentitySchema = z.discriminatedUnion("strategy", [
         strategy: z.literal("source-map-original"),
         stability: z.literal("source-map-exact"),
         source_map_sha256: digestSchema,
-        original_source: boundedTextSchema,
+        // The exact `sources` entry; `""` is a legal relative reference.
+        original_source: z.string(),
         source_sha256: digestSchema.nullable(),
     }),
     z.strictObject({
@@ -375,7 +376,8 @@ export const applicationNodeIdentitySchema = z.discriminatedUnion("strategy", [
         stability: z.literal("artifact-version"),
         artifact_sha256: digestSchema,
         namespace: boundedKeySchema,
-        key: boundedTextSchema,
+        // The exact artifact-local value, such as `""` from `fetch("")`.
+        key: z.string(),
     }),
     z.strictObject({
         strategy: z.literal("runtime-instance"),