rea-agents 4.0.1 → 5.0.0

package/dist/domain/referenceSourceImportParsing.js

@@ -1,5 +1,5 @@
 import { parse } from "@babel/parser";
-import { isCallExpression, isExportAllDeclaration, isExportNamedDeclaration, isIdentifier, isImport, isImportDeclaration, isMemberExpression, isNode, isStringLiteral, isTSExternalModuleReference, isTSImportEqualsDeclaration, isTSModuleDeclaration, } from "@babel/types";
+import { isCallExpression, isExportAllDeclaration, isExportNamedDeclaration, isIdentifier, isImport, isImportDeclaration, isImportExpression, isMemberExpression, isNode, isStringLiteral, isTSExternalModuleReference, isTSImportEqualsDeclaration, isTSModuleDeclaration, } from "@babel/types";
 const codeSourceLanguages = new Set(["JavaScript", "TypeScript", "JSX", "TSX"]);
 const safeModuleName = (node) => {
     if (isStringLiteral(node))
@@ -101,7 +101,8 @@ const isRequireCallee = (callee) => {
     if (isMemberExpression(callee) &&
         isIdentifier(callee.object) &&
         callee.object.name === "require" &&
-        (isIdentifier(callee.property) || isStringLiteral(callee.property))) {
+        ((!callee.computed && isIdentifier(callee.property)) ||
+            isStringLiteral(callee.property))) {
         const propertyName = isIdentifier(callee.property)
             ? callee.property.name
             : isStringLiteral(callee.property)
@@ -112,19 +113,19 @@ const isRequireCallee = (callee) => {
     return false;
 };
 const isImportCallee = (callee) => isImport(callee);
-const collectCallExpressions = (node, targets) => {
+const collectModuleExpressions = (node, targets) => {
     if (node === null || node === undefined)
         return;
     if (typeof node !== "object")
         return;
     if (Array.isArray(node)) {
         for (const item of node)
-            collectCallExpressions(item, targets);
+            collectModuleExpressions(item, targets);
         return;
     }
     if (!isNode(node))
         return;
-    if (isCallExpression(node)) {
+    if (isCallExpression(node) || isImportExpression(node)) {
         targets.push(node);
     }
     for (const value of Object.values(node)) {
@@ -132,7 +133,7 @@ const collectCallExpressions = (node, targets) => {
             value !== undefined &&
             typeof value === "object" &&
             !isSourceLocation(value)) {
-            collectCallExpressions(value, targets);
+            collectModuleExpressions(value, targets);
         }
     }
 };
@@ -142,10 +143,21 @@ const isSourceLocation = (value) => typeof value === "object" &&
     "end" in value &&
     !("type" in value);
 const extractRequireAndDynamicImports = (body, from_path, relationships) => {
-    const calls = [];
+    const expressions = [];
     for (const statement of body)
-        collectCallExpressions(statement, calls);
-    for (const call of calls) {
+        collectModuleExpressions(statement, expressions);
+    for (const call of expressions) {
+        if (isImportExpression(call)) {
+            const specifier = safeModuleName(call.source);
+            appendRelationship(relationships, {
+                fromPath: from_path,
+                to: specifier ?? "<dynamic-import>",
+                kind: "imports",
+                parseState: specifier === undefined ? "partial" : "parsed",
+                ...(specifier === undefined ? { resolution: "unknown" } : {}),
+            });
+            continue;
+        }
         const first = call.arguments[0];
         if (isRequireCallee(call.callee) && isModuleExpression(first)) {
             const result = moduleSpecifierFromExpression(first);
@@ -193,13 +205,12 @@ const parseWithBabel = (path, source, language) => {
             errorRecovery: true,
             plugins,
         });
-        return { ast, parseState: "parsed" };
+        return { ast, reasons: ast.errors.map((error) => error.message) };
     }
     catch (cause) {
         return {
             ast: undefined,
-            parseState: "unknown",
-            reason: cause instanceof Error ? cause.message : "Parse failed",
+            reasons: [cause instanceof Error ? cause.message : "Parse failed"],
         };
     }
 };
@@ -208,24 +219,28 @@ export const parseReferenceSourceImports = (path, bytes, language) => {
     if (language !== null && !codeSourceLanguages.has(language))
         return { relationships: [], parse_failures: [] };
     const source = new TextDecoder("utf-8", { fatal: false }).decode(bytes);
-    const { ast, parseState, reason } = parseWithBabel(path, source, language);
-    if (ast === undefined || parseState === "unknown") {
+    const { ast, reasons } = parseWithBabel(path, source, language);
+    const parseFailures = reasons.map((reason) => ({
+        path,
+        parser: "babel",
+        reason,
+    }));
+    if (ast === undefined) {
         return {
             relationships: [],
-            parse_failures: [
-                {
-                    path,
-                    parser: "babel",
-                    reason: reason ?? "Unknown parse failure",
-                },
-            ],
+            parse_failures: parseFailures,
         };
     }
     const relationships = [];
     extractImportDeclarations(ast.program.body, path, relationships);
     extractRequireAndDynamicImports(ast.program.body, path, relationships);
     return {
-        relationships,
-        parse_failures: [],
+        relationships: relationships.map((relationship) => ({
+            ...relationship,
+            parse_state: parseFailures.length > 0 && relationship.parse_state === "parsed"
+                ? "partial"
+                : relationship.parse_state,
+        })),
+        parse_failures: parseFailures,
     };
 };

package/dist/domain/runtimeIdentification.js

@@ -194,7 +194,7 @@ const familiesFor = (format, path) => {
         families.add("javascript");
     if (format === "jvm-class" || /(?:^|\/)[^/]+\.class$/iu.test(path))
         families.add("jvm");
-    if (["elf", "mach-o", "mach-o-universal", "pe", "dos-mz"].includes(format))
+    if (["elf", "mach-o", "mach-o-universal", "pe", "dos-mz", "dos-com"].includes(format))
         families.add("native");
     if (format === "webassembly" || /(?:^|\/)[^/]+\.wasm$/iu.test(path))
         families.add("webassembly");

package/dist/domain/runtimeVersion.js

@@ -1,8 +1,7 @@
+import { satisfies } from "semver";
+/** Supported runtime range, kept in sync with the published package engines. */
+export const SUPPORTED_NODE_VERSION_RANGE = "^22.19.0 || ^24.11.0 || >=26.0.0";
+/** Human-readable form of {@link SUPPORTED_NODE_VERSION_RANGE} for remediation. */
+export const SUPPORTED_NODE_VERSION_PROSE = "Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+";
 /** Return whether a Node.js version satisfies REA's tested runtime families. */
-export const supportsNodeVersion = (version) => {
-    const [majorText = "", minorText = ""] = version.split(".");
-    const major = Number.parseInt(majorText, 10);
-    const minor = Number.parseInt(minorText, 10);
-    return ((major === 22 && minor >= 19) ||
-        (major >= 24 && (major !== 24 || minor >= 11)));
-};
+export const supportsNodeVersion = (version) => satisfies(version, SUPPORTED_NODE_VERSION_RANGE);

package/dist/domain/safeJson.js

@@ -0,0 +1,13 @@
+/** Parse JSON text, returning the failure reason instead of throwing. */
+export const safeParseJson = (value) => {
+    try {
+        return { ok: true, value: JSON.parse(value) };
+    }
+    catch (cause) {
+        return {
+            ok: false,
+            error: cause instanceof Error ? cause.message : String(cause),
+            cause,
+        };
+    }
+};

package/dist/domain/sourceMapEnvelope.js

@@ -0,0 +1,38 @@
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** Whether a parsed value has the version-3 map shape. */
+export const isVersion3Map = (value) => isRecord(value) && value.version === 3;
+const isValidOffset = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+/**
+ * Collect leaf maps from an indexed source-map envelope, or undefined when
+ * the envelope is not a version-3 map. A map carrying neither `mappings`
+ * nor `sections` yields itself as the single leaf; callers decide whether
+ * that leaf is valid content.
+ */
+export const flattenSourceMapLeaves = (root, options) => {
+    if (!isVersion3Map(root))
+        return undefined;
+    const leaves = [];
+    const pending = [root];
+    while (pending.length > 0) {
+        const map = pending.pop();
+        if (!isVersion3Map(map))
+            return undefined;
+        if (Array.isArray(map.sections)) {
+            for (const section of map.sections) {
+                if (!isRecord(section) || !isRecord(section.map))
+                    return undefined;
+                if (options?.validateOffsets === true) {
+                    if (!isRecord(section.offset))
+                        return undefined;
+                    if (!isValidOffset(section.offset.line) ||
+                        !isValidOffset(section.offset.column))
+                        return undefined;
+                }
+                pending.push(section.map);
+            }
+        }
+        else
+            leaves.push(map);
+    }
+    return leaves;
+};

package/dist/domain/staticRuntimeCorrelation.js

@@ -2,8 +2,10 @@ import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
 import { artifactComparisonResultSchema } from "./artifactComparison.js";
+import { uniqueSorted } from "./canonicalOrdering.js";
 import { evidenceSchema, parseEvidence } from "./evidence.js";
 import { functionComparisonResultSchema } from "./functionComparison.js";
+import { PROCESS_PROVIDER, isProcessEvidenceProvider, } from "./processEvidenceProvider.js";
 import { comparisonStatusSchema, processCaptureComparisonSchema, } from "./processCapture.js";
 import { PROCESS_COMPARISON_DIMENSIONS } from "./processComparison.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
@@ -128,8 +130,8 @@ const EXPECTED = {
     ],
     compare_process_captures: [
         "rea.process-comparison",
-        "rea-process",
-        "REA deterministic process harness",
+        PROCESS_PROVIDER.id,
+        PROCESS_PROVIDER.name,
     ],
 };
 /** Correlate only caller-declared static/runtime hypotheses. */
@@ -280,10 +282,11 @@ const assertComparisonIdentity = (evidence) => {
         !(Array.isArray(expected[0])
             ? expected[0].includes(evidence.predicate_type)
             : evidence.predicate_type === expected[0]) ||
-        evidence.provider.id !== expected[1] ||
-        evidence.provider.name !== expected[2] ||
-        evidence.provider.version !==
-            (evidence.operation === "compare_process_captures" ? "3" : "1") ||
+        (evidence.operation === "compare_process_captures"
+            ? !isProcessEvidenceProvider(evidence.provider)
+            : evidence.provider.id !== expected[1] ||
+                evidence.provider.name !== expected[2] ||
+                evidence.provider.version !== "1") ||
         evidence.confidence !== "derived" ||
         evidence.authority !== "analyst-inference" ||
         evidence.subject !== null ||
@@ -358,7 +361,6 @@ const assertUnique = (evidence, label) => {
     if (new Set(evidence.map(({ evidence_id: id }) => id)).size !== evidence.length)
         throw new TypeError(`Static/runtime correlation rejects duplicate ${label}`);
 };
-const uniqueSorted = (values) => [...new Set(values)].sort((left, right) => left.localeCompare(right, "en"));
 const sha256 = (value) => createHash("sha256").update(value).digest("hex");
 const canonicalJson = (value) => {
     const serialized = canonicalize(value);

package/dist/domain/unicodeCodePointOrder.js

@@ -1,12 +1,17 @@
 /** Compare strings lexicographically by Unicode code point, independent of locale. */
 export const compareUnicodeCodePoints = (left, right) => {
-    const leftPoints = [...left].map((value) => value.codePointAt(0) ?? 0);
-    const rightPoints = [...right].map((value) => value.codePointAt(0) ?? 0);
-    const length = Math.min(leftPoints.length, rightPoints.length);
-    for (let index = 0; index < length; index += 1) {
-        const difference = (leftPoints[index] ?? 0) - (rightPoints[index] ?? 0);
+    let leftIndex = 0;
+    let rightIndex = 0;
+    while (leftIndex < left.length && rightIndex < right.length) {
+        const leftPoint = left.codePointAt(leftIndex) ?? 0;
+        const rightPoint = right.codePointAt(rightIndex) ?? 0;
+        const difference = leftPoint - rightPoint;
         if (difference !== 0)
             return difference;
+        leftIndex += leftPoint > 0xffff ? 2 : 1;
+        rightIndex += rightPoint > 0xffff ? 2 : 1;
     }
-    return leftPoints.length - rightPoints.length;
+    if (leftIndex === left.length && rightIndex === right.length)
+        return 0;
+    return leftIndex === left.length ? -1 : 1;
 };

package/dist/domain/unknownRegistryError.js

@@ -0,0 +1,10 @@
+import { AnalysisError } from "./analysisErrorBase.js";
+/** Residual-unknown mutation failed a lifecycle, reference, or CAS invariant. */
+export class UnknownRegistryError extends AnalysisError {
+    reason;
+    _tag = "UnknownRegistryError";
+    constructor(reason, options) {
+        super(`Residual unknown registry mutation failed: ${reason}`, options);
+        this.reason = reason;
+    }
+}

package/dist/domain/webBundleAnalyzerAst.js

@@ -1,38 +1,31 @@
 import * as t from "@babel/types";
 import { sanitizeBrowserUrl } from "./browserObservation.js";
-/** Name of a call/new callee from its AST node. */
-export const calleeName = (callee) => {
-    if (t.isIdentifier(callee))
-        return callee.name;
-    if (t.isImport(callee))
-        return "import";
-    if (t.isMemberExpression(callee) || t.isOptionalMemberExpression(callee)) {
-        const object = t.isExpression(callee.object)
-            ? calleeName(callee.object)
-            : "";
-        const property = propertyName(callee.property);
-        return object === "" ? property : `${object}.${property}`;
-    }
-    return "";
-};
-export const stringArgument = (value) => (t.isStringLiteral(value) ? value.value : undefined);
-export const propertyName = (value) => {
-    if (t.isIdentifier(value))
-        return value.name;
-    if (t.isStringLiteral(value))
-        return value.value;
-    return "";
-};
+import { semanticStaticPropertyName } from "./javascript/javascriptAstValues.js";
+/** Pick the endpoint argument for common network-call patterns. */
 export const objectValue = (object, name) => {
-    for (const property of object.properties)
-        if (t.isObjectProperty(property) && propertyName(property.key) === name)
-            return property.value;
-    return undefined;
+    let value;
+    for (const property of object.properties) {
+        if (t.isSpreadElement(property)) {
+            value = undefined;
+            continue;
+        }
+        const key = semanticStaticPropertyName(property.key, property.computed);
+        if (key === "" && !t.isStringLiteral(property.key))
+            value = undefined;
+        else if (key === name)
+            value = t.isObjectProperty(property) ? property.value : undefined;
+    }
+    return value;
 };
 export const objectString = (object, name) => {
     const value = objectValue(object, name);
     return t.isStringLiteral(value) ? value.value : undefined;
 };
+/** Whether module syntax supplies a URL location without a package/import-map resolver. */
+export const isUrlLikeModuleSpecifier = (specifier) => specifier.startsWith("/") ||
+    specifier.startsWith("./") ||
+    specifier.startsWith("../") ||
+    /^[A-Za-z][A-Za-z0-9+.-]*:/u.test(specifier);
 export const resolveSpecifier = (specifier, base) => {
     try {
         const resolved = new URL(specifier, base);
@@ -40,7 +33,9 @@ export const resolveSpecifier = (specifier, base) => {
             return null;
         return sanitizeBrowserUrl(resolved.href).url;
     }
-    catch {
+    catch (cause) {
+        // Unresolvable specifiers are represented by the null return.
+        void cause;
         return null;
     }
 };
@@ -52,13 +47,3 @@ export const locationFields = (node) => ({
     line: node.loc?.start.line ?? null,
     column: node.loc?.start.column ?? null,
 });
-/** Pick the endpoint argument for common network-call patterns. */
-export const endpointArgument = (name, args) => {
-    if (name === "fetch" || name.endsWith(".fetch") || name === "WebSocket")
-        return stringArgument(args[0]);
-    if (name.endsWith(".open") && stringArgument(args[1]) !== undefined)
-        return stringArgument(args[1]);
-    if (["get", "post", "put", "patch", "delete", "request"].some((method) => name === method || name.endsWith(`.${method}`)))
-        return stringArgument(args[0]);
-    return undefined;
-};

package/dist/domain/webBundleAnalyzerInspection.js

@@ -1,7 +1,10 @@
 import { parse } from "@babel/parser";
 import * as t from "@babel/types";
 import { sanitizeEndpointCandidate } from "./browserObservation.js";
-import { calleeName, endpointArgument, location, locationFields, objectString, objectValue, propertyName, resolveSpecifier, stringArgument, } from "./webBundleAnalyzerAst.js";
+import { traverseJavaScriptAst } from "./javascript/javascriptSemanticTraversal.js";
+import { semanticStaticPropertyName } from "./javascript/javascriptAstValues.js";
+import { calleeName, endpointArgument, stringValue, } from "./javascript/javascriptStaticAnalysisHelpers.js";
+import { location, locationFields, objectString, objectValue, resolveSpecifier, isUrlLikeModuleSpecifier, } from "./webBundleAnalyzerAst.js";
 export const analyzeScript = (script, accumulator) => {
     let file;
     try {
@@ -11,16 +14,19 @@ export const analyzeScript = (script, accumulator) => {
             plugins: ["jsx", "typescript"],
         });
     }
-    catch {
+    catch (cause) {
+        // Unparseable scripts are counted; the failure needs no extra detail.
+        void cause;
         accumulator.parseFailures += 1;
         return;
     }
     accumulator.parsedScripts += 1;
     detectVendorFingerprints(script, accumulator);
-    t.traverseFast(file, (node) => {
-        accumulator.visitedNodes += 1;
-        inspectNode(script, node, accumulator);
-        return undefined;
+    traverseJavaScriptAst(file, {
+        enter: (node) => {
+            accumulator.visitedNodes += 1;
+            inspectNode(script, node, accumulator);
+        },
     });
 };
 const inspectNode = (script, node, accumulator) => {
@@ -56,7 +62,7 @@ const inspectNode = (script, node, accumulator) => {
 };
 const inspectCall = (script, node, accumulator) => {
     const name = calleeName(node.callee);
-    const first = stringArgument(node.arguments[0]);
+    const first = stringValue(node.arguments[0]);
     if ((name === "require" || name.endsWith(".require")) && first !== undefined)
         addEdge({
             script,
@@ -65,15 +71,13 @@ const inspectCall = (script, node, accumulator) => {
             node,
             accumulator,
         });
-    if ((name === "importScripts" || name.endsWith(".importScripts")) &&
-        first !== undefined)
-        addEdge({
-            script,
-            specifier: first,
-            kind: "worker_import",
-            node,
-            accumulator,
-        });
+    if (name === "importScripts" || name.endsWith(".importScripts"))
+        for (const argument of node.arguments) {
+            const specifier = stringValue(argument);
+            if (specifier === undefined)
+                continue;
+            addEdge({ script, specifier, kind: "worker_import", node, accumulator });
+        }
     if (routeCallNames.some((candidate) => name === candidate || name.endsWith(`.${candidate}`))) {
         if (first !== undefined)
             addFinding({
@@ -91,7 +95,7 @@ const inspectCall = (script, node, accumulator) => {
             accumulator,
         });
     }
-    const endpoint = endpointArgument(name, node.arguments);
+    const endpoint = endpointArgument(name, node.arguments, node.callee);
     if (endpoint !== undefined)
         addFinding({
             collection: accumulator.endpoints,
@@ -106,7 +110,7 @@ const inspectCall = (script, node, accumulator) => {
         addWebMcpDeclaration(script, node, accumulator);
 };
 const inspectRouteProperty = (script, node, accumulator) => {
-    const key = propertyName(node.key);
+    const key = semanticStaticPropertyName(node.key, node.computed);
     if ((key === "path" || key === "route") && t.isStringLiteral(node.value))
         addFinding({
             collection: accumulator.routes,
@@ -123,7 +127,10 @@ const addEdge = (context) => {
         from_script_key: context.script.script_key,
         kind: context.kind,
         specifier: context.specifier,
-        resolved_url: resolveSpecifier(context.specifier, context.script.url),
+        resolved_url: context.kind === "worker_import" ||
+            isUrlLikeModuleSpecifier(context.specifier)
+            ? resolveSpecifier(context.specifier, context.script.url)
+            : null,
         location: location(context.script.script_key, context.node),
     }));
 };
@@ -152,7 +159,9 @@ const addWebMcpDeclaration = (script, node, accumulator) => {
         : schema;
     const schemaPropertyNames = t.isObjectExpression(propertyObject)
         ? propertyObject.properties.flatMap((property) => t.isObjectProperty(property)
-            ? [propertyName(property.key)].filter(Boolean)
+            ? [
+                semanticStaticPropertyName(property.key, property.computed),
+            ].filter(Boolean)
             : [])
         : [];
     const key = `webmcp\0${script.script_key}\0${name ?? ""}\0${schemaPropertyNames.join("\0")}`;

package/dist/domain/webEventListeners.js

@@ -0,0 +1,28 @@
+import { z } from "zod";
+import { webRuntimeBrowserSchema, webRuntimeLocationSchema, webRuntimeScopeSchema, webRuntimeSourceSchema, webRuntimeTargetSchema, } from "./webRuntime.js";
+/** Inspect listeners registered directly on the first main-document CSS match. */
+export const inspectWebEventListenersInputSchema = webRuntimeScopeSchema.extend({
+    selector: z.string().min(1),
+});
+/** A listener declaration and its source location do not establish that it ran. */
+export const webEventListenersSchema = z.object({
+    browser: webRuntimeBrowserSchema,
+    target: webRuntimeTargetSchema,
+    inspected_at: z.iso.datetime(),
+    selected_node: z.object({
+        selector: z.string(),
+        match: z.enum(["found", "not_found"]),
+        backend_node_id: z.number().int().min(1).nullable(),
+    }),
+    listeners: z.array(z.object({
+        type: z.string(),
+        use_capture: z.boolean(),
+        passive: z.boolean(),
+        once: z.boolean(),
+        location: webRuntimeLocationSchema,
+        execution: z.literal("unknown"),
+    })),
+    sources: z.array(webRuntimeSourceSchema),
+    cleanup: z.literal("confirmed"),
+    limitations: z.array(z.string()),
+});

package/dist/domain/webExecution.js

@@ -0,0 +1,74 @@
+import { z } from "zod";
+import { jsonObjectSchema } from "./jsonValue.js";
+import { webRuntimeBrowserSchema, webRuntimeLocationSchema, webRuntimeScopeSchema, webRuntimeSourceSchema, webRuntimeTargetSchema, } from "./webRuntime.js";
+/** Explicit instrumentation request for one finite, externally driven execution window. */
+export const observeWebExecutionInputSchema = webRuntimeScopeSchema.extend({
+    observation_ms: z.number().int().min(1).max(2_147_483_647).default(10_000),
+});
+const rangeSchema = z.object({
+    start_offset: z.number().int().min(0),
+    end_offset: z.number().int().min(0),
+    count: z.number().int().min(0),
+    source_bounds: z.enum(["verified", "unknown"]),
+});
+const functionSchema = z.object({
+    name: z.string(),
+    is_block_coverage: z.boolean(),
+    ranges: z.array(rangeSchema),
+});
+/** Precise V8 ranges retain their nested structure and counts without summing them. */
+export const webExecutionSchema = z.object({
+    browser: webRuntimeBrowserSchema,
+    target: webRuntimeTargetSchema,
+    window: z.object({
+        armed_at: z.iso.datetime(),
+        ended_at: z.iso.datetime(),
+        requested_ms: z.number().int().min(1),
+        end_reason: z.enum([
+            "window_elapsed",
+            "document_changed",
+            "target_terminated",
+        ]),
+        producer_started_seconds: z.number().min(0),
+        producer_sampled_seconds: z.number().min(0).nullable(),
+    }),
+    coverage: z.object({
+        state: z.enum(["captured", "unavailable"]),
+        reason: z.string().nullable(),
+        offset_units: z.literal("utf16-code-units"),
+        end_offset: z.literal("exclusive"),
+        scripts: z.array(z.object({
+            script_id: z.string().min(1),
+            reported_url: z.string(),
+            functions: z.array(functionSchema),
+        })),
+        excluded_scripts: z.number().int().min(0),
+    }),
+    requests: z.array(z.object({
+        request_id: z.string().min(1),
+        url: z.string(),
+        method: z.string(),
+        timestamp_seconds: z.number().min(0),
+        initiator_type: z.string(),
+        reported_initiator: jsonObjectSchema,
+        callsites: z.array(webRuntimeLocationSchema),
+        async_parent_ids: z.array(z.object({ id: z.string(), debugger_id: z.string().nullable() })),
+        causal_attribution: z.literal("unknown"),
+    })),
+    excluded_requests: z.number().int().min(0),
+    script_inventory: z.object({
+        main_document_scripts: z.number().int().min(0),
+        not_reported_script_ids: z.array(z.string().min(1)),
+        coverage_absence: z.literal("unknown"),
+    }),
+    sources: z.array(webRuntimeSourceSchema),
+    instrumentation: z.object({
+        resets_execution_counters: z.literal(true),
+        disables_optimized_execution: z.literal(true),
+        takes_one_resetting_sample: z.boolean(),
+        executes_selected_code: z.literal(false),
+        cleanup: z.literal("confirmed"),
+        page_ownership: z.literal("external"),
+    }),
+    limitations: z.array(z.string()),
+});

package/dist/domain/webMcpDiscovery.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { browserCompletenessSchema } from "./browserCompleteness.js";
 import { browserAllowedOriginsSchema, browserEndpointSchema, } from "./browserObservation.js";
+import { browserVersionSchema } from "./browserObservationSchemas.js";
 import { jsonShapeSchema } from "./jsonShape.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 /** Input for passive discovery of page-registered WebMCP tools. */
@@ -10,13 +11,6 @@ export const discoverWebMcpToolsInputSchema = z.strictObject({
     target_id: z.string().trim().min(1),
     observation_ms: z.number().int().min(0).default(100),
 });
-const browserVersionSchema = z.object({
-    product: z.string(),
-    protocol_version: z.string(),
-    revision: z.string(),
-    user_agent: z.string(),
-    js_version: z.string(),
-});
 const webMcpToolSchema = z.object({
     tool_key: prefixedDigestSchema("webmcp"),
     name: z.string(),