rea-agents 4.1.0 → 6.0.0

package/dist/domain/evidenceBundle.js

@@ -69,21 +69,47 @@ export const createEvidenceBundle = (records, unknowns = []) => {
 /** Restrict a bundle to records and complete unknown histories for one artifact. */
 export const evidenceBundleForTarget = (bundle, sha256) => {
     const recordsById = new Map(bundle.records.map((record) => [record.evidence_id, record]));
-    let unknowns = bundle.unknowns.filter(({ scope_digest: scopeDigest }) => scopeDigest === sha256);
-    let changed = true;
-    while (changed) {
-        const ids = new Set(unknowns.map(({ unknown_id: id }) => id));
-        const retained = unknowns.filter((unknown) => unknown.relationships.every(({ unknown_id: id }) => ids.has(id)) &&
-            referencedEvidenceIds(unknown).every((id) => {
-                const record = recordsById.get(id);
-                return (record?.subject?.digest.sha256 === sha256 ||
-                    (unknown.mutation_evidence_ids.includes(id) &&
-                        record?.subject === null &&
-                        record.predicate_type === "rea.residual-unknown-mutation"));
-            }));
-        changed = retained.length !== unknowns.length;
-        unknowns = retained;
+    const candidates = bundle.unknowns.filter(({ scope_digest: scopeDigest }) => scopeDigest === sha256);
+    const retained = new Set();
+    const revisionsById = new Map();
+    const dependents = new Map();
+    for (const unknown of candidates) {
+        const mutationEvidenceIds = new Set(unknown.mutation_evidence_ids);
+        const evidenceAvailable = referencedEvidenceIds(unknown).every((id) => {
+            const record = recordsById.get(id);
+            return (record?.subject?.digest.sha256 === sha256 ||
+                (mutationEvidenceIds.has(id) &&
+                    record?.subject === null &&
+                    record.predicate_type === "rea.residual-unknown-mutation"));
+        });
+        if (!evidenceAvailable)
+            continue;
+        retained.add(unknown);
+        revisionsById.set(unknown.unknown_id, (revisionsById.get(unknown.unknown_id) ?? 0) + 1);
+        for (const relatedId of new Set(unknown.relationships.map(({ unknown_id: id }) => id))) {
+            const references = dependents.get(relatedId) ?? new Set();
+            references.add(unknown);
+            dependents.set(relatedId, references);
+        }
     }
+    const pending = [];
+    for (const unknown of retained)
+        if (unknown.relationships.some(({ unknown_id: id }) => !revisionsById.has(id)))
+            pending.push(unknown);
+    for (let index = 0; index < pending.length; index += 1) {
+        const unknown = pending[index];
+        if (unknown === undefined || !retained.delete(unknown))
+            continue;
+        const remaining = (revisionsById.get(unknown.unknown_id) ?? 1) - 1;
+        if (remaining > 0) {
+            revisionsById.set(unknown.unknown_id, remaining);
+            continue;
+        }
+        revisionsById.delete(unknown.unknown_id);
+        for (const dependent of dependents.get(unknown.unknown_id) ?? [])
+            pending.push(dependent);
+    }
+    const unknowns = candidates.filter((unknown) => retained.has(unknown));
     const mutationIds = new Set(unknowns.flatMap(({ mutation_evidence_ids: ids }) => ids));
     return createEvidenceBundle(bundle.records.filter((record) => record.subject?.digest.sha256 === sha256 ||
         mutationIds.has(record.evidence_id)), unknowns);
@@ -182,13 +208,20 @@ export const validateResidualUnknownAddition = (unknown, evidenceById, currentHe
             throw new TypeError(`Residual unknown references missing unknown ${relationship.unknown_id}`);
     if (unknown.resolution?.disposition === "verified")
         validateVerifiedResolution(unknown, evidenceById);
-    for (const relationship of unknown.relationships)
-        if (relationship.type === "depends-on" &&
-            reachesUnknown(relationship.unknown_id, unknown.unknown_id, currentHeads, unknown))
+    // In a valid graph, no existing node can point to an absent ID. Since the
+    // schema rejects self-relations, a new node's outgoing edges cannot close a
+    // cycle; keep graph traversal for revisions of existing nodes only.
+    if (current !== undefined) {
+        const dependencies = unknown.relationships
+            .filter((relationship) => relationship.type === "depends-on")
+            .map(({ unknown_id }) => unknown_id);
+        if (dependencies.length > 0 &&
+            reachesUnknown(dependencies, unknown.unknown_id, currentHeads, unknown))
             throw new TypeError("Residual unknown dependency graph contains a cycle");
+    }
 };
-const reachesUnknown = (start, goal, currentHeads, candidate) => {
-    const pending = [start];
+const reachesUnknown = (starts, goal, currentHeads, candidate) => {
+    const pending = [...starts];
     const visited = new Set();
     while (pending.length > 0) {
         const id = pending.pop();
@@ -232,23 +265,53 @@ const evidenceQualifies = (unknown, evidence) => {
 const rejectDependencyCycles = (unknownById) => {
     const visited = new Set();
     const active = new Set();
-    const visit = (id) => {
-        if (active.has(id))
-            throw new TypeError("Residual unknown dependency graph contains a cycle");
-        if (visited.has(id))
-            return;
-        active.add(id);
-        const unknown = unknownById.get(id);
-        if (unknown === undefined)
+    const pending = [];
+    for (const root of unknownById.keys()) {
+        if (visited.has(root))
+            continue;
+        const rootUnknown = unknownById.get(root);
+        if (rootUnknown === undefined)
             throw new TypeError("Residual unknown dependency graph is inconsistent");
-        for (const relationship of unknown.relationships)
-            if (relationship.type === "depends-on")
-                visit(relationship.unknown_id);
-        active.delete(id);
-        visited.add(id);
-    };
-    for (const id of unknownById.keys())
-        visit(id);
+        active.add(root);
+        pending.push({
+            id: root,
+            relationships: rootUnknown.relationships,
+            nextRelationship: 0,
+        });
+        while (pending.length > 0) {
+            const frame = pending[pending.length - 1];
+            if (frame === undefined)
+                break;
+            let descended = false;
+            while (frame.nextRelationship < frame.relationships.length) {
+                const relationship = frame.relationships[frame.nextRelationship];
+                frame.nextRelationship += 1;
+                if (relationship?.type !== "depends-on")
+                    continue;
+                const dependency = relationship.unknown_id;
+                if (active.has(dependency))
+                    throw new TypeError("Residual unknown dependency graph contains a cycle");
+                if (visited.has(dependency))
+                    continue;
+                const unknown = unknownById.get(dependency);
+                if (unknown === undefined)
+                    throw new TypeError("Residual unknown dependency graph is inconsistent");
+                active.add(dependency);
+                pending.push({
+                    id: dependency,
+                    relationships: unknown.relationships,
+                    nextRelationship: 0,
+                });
+                descended = true;
+                break;
+            }
+            if (descended)
+                continue;
+            pending.pop();
+            active.delete(frame.id);
+            visited.add(frame.id);
+        }
+    }
 };
 /** Encode a validated bundle as byte-stable RFC 8785 canonical JSON. */
 export const serializeEvidenceBundle = (bundle) => {

package/dist/domain/evm/evmInterface.js

@@ -0,0 +1,63 @@
+import { z } from "zod";
+const byteOffset = z.number().int().nonnegative();
+const sha256 = z.string().regex(/^[a-f0-9]{64}$/);
+/** Select the carrier representation explicitly; no RPC or deployed-contract lookup is implied. */
+export const inspectEvmInterfaceInputSchema = z.strictObject({
+    path: z
+        .string()
+        .min(1)
+        .describe("Absolute path to caller-selected local bytecode carrier"),
+    encoding: z
+        .enum(["raw", "hex"])
+        .describe("Raw bytes or UTF-8 hex with optional 0x prefix and outer ASCII whitespace"),
+});
+/** Recovered interface candidates are inferences, independently of observed byte identity. */
+export const evmInterfaceSchema = z
+    .strictObject({
+    artifact: z.strictObject({
+        path: z.string().min(1),
+        sha256,
+        bytes: byteOffset,
+        encoding: z.enum(["raw", "hex"]),
+    }),
+    bytecode: z.strictObject({
+        sha256,
+        bytes: byteOffset,
+        hex: z.string().regex(/^(?:[0-9a-f]{2})*$/),
+        digest_algorithm: z.literal("sha256"),
+        kind: z.literal("unknown"),
+        deployment_authenticity: z.literal("unknown"),
+        hardfork: z.literal("unknown"),
+    }),
+    evidence_kind: z.literal("inferred"),
+    functions: z.array(z.strictObject({
+        selector: z.string().regex(/^0x[0-9a-f]{8}$/),
+        bytecode_offset: byteOffset,
+        dispatch: z.enum(["abi", "fallback"]),
+        inferred_arguments: z.string().nullable(),
+        inferred_state_mutability: z.string().nullable(),
+    })),
+    discovery_completeness: z.literal("unknown"),
+    runtime_execution: z.literal("not-performed"),
+    diagnostics: z.strictObject({
+        stdout: z.string(),
+        stderr: z.string(),
+        truncated: z.boolean(),
+    }),
+    limitations: z.array(z.string()),
+})
+    .superRefine((value, context) => {
+    if (value.bytecode.hex.length !== value.bytecode.bytes * 2)
+        context.addIssue({
+            code: "custom",
+            path: ["bytecode"],
+            message: "Selected byte count does not match the bytecode hex representation.",
+        });
+    for (const [index, fn] of value.functions.entries())
+        if (fn.bytecode_offset >= value.bytecode.bytes)
+            context.addIssue({
+                code: "custom",
+                path: ["functions", index, "bytecode_offset"],
+                message: "Inferred body offset lies outside the selected bytecode.",
+            });
+});

package/dist/domain/explicitSensitiveFailure.js

@@ -0,0 +1,92 @@
+import { AnalysisAccessDeniedError, AnalysisArtifactChangedError, AnalysisInputError, AnalysisOutputError, AnalysisCapabilityUnavailableError, } from "./analysisErrorCore.js";
+import { redactExplicitText } from "./explicitSensitiveValues.js";
+import { ProviderAdapterError } from "./providerAdapterError.js";
+import { ProviderCleanupError } from "./providerCleanupError.js";
+/** Keep a real JSON-pointer ancestor when a property identity is explicitly excluded. */
+export const redactExplicitPointer = (pointer, values) => {
+    let parent = "";
+    for (const segment of pointer.split("/").slice(1)) {
+        const decoded = segment.replaceAll("~1", "/").replaceAll("~0", "~");
+        const child = `${parent}/${segment}`;
+        if (values.some((literal) => decoded.includes(literal) || child.includes(literal)))
+            return parent;
+        parent = child;
+    }
+    return parent;
+};
+/** Exclude explicit literals from common acquisition/decoder failures, preserving typed diagnostics. */
+export const redactExplicitFailure = (error, values) => {
+    if (values.length === 0)
+        return error;
+    const text = (value) => redactExplicitText(value, values);
+    const path = (parts, ordinaryNames) => {
+        const retained = [];
+        for (const part of parts) {
+            if (typeof part !== "string") {
+                retained.push(part);
+            }
+            else if (!ordinaryNames && part.startsWith("/")) {
+                const pointer = redactExplicitPointer(part, values);
+                retained.push(pointer);
+                if (pointer !== part)
+                    break;
+            }
+            else {
+                if (values.some((literal) => part.includes(literal)))
+                    break;
+                retained.push(part);
+            }
+        }
+        return retained;
+    };
+    const diagnostics = (value) => Object.fromEntries(Object.entries(value)
+        .filter(([key]) => !values.some((literal) => key.includes(literal)))
+        .map(([key, item]) => [key, visit(item)]));
+    const visit = (value) => {
+        if (typeof value === "string")
+            return text(value);
+        if (Array.isArray(value))
+            return value.map(visit);
+        if (typeof value === "object" && value !== null)
+            return diagnostics(value);
+        return value;
+    };
+    if (error instanceof AnalysisAccessDeniedError)
+        return new AnalysisAccessDeniedError(error.operation, text(error.path), error.systemCode, { cause: error });
+    if (error instanceof AnalysisArtifactChangedError)
+        return new AnalysisArtifactChangedError(error.operation, text(error.path), text(error.reason), { cause: error });
+    if (error instanceof AnalysisInputError)
+        return new AnalysisInputError(error.operation, { cause: error }, error.issues.map((issue) => ({
+            ...issue,
+            // Unknown-argument paths contain literal field names, including names
+            // beginning with '/'; they are not producer JSON-pointer coordinates.
+            path: path(issue.path, issue.reason === "unknown_argument"),
+            ...(issue.message === undefined
+                ? {}
+                : { message: text(issue.message) }),
+            ...(issue.expected === undefined
+                ? {}
+                : { expected: visit(issue.expected) }),
+        })));
+    if (error instanceof AnalysisOutputError)
+        return new AnalysisOutputError(error.operation, text(error.reason), {
+            cause: error,
+        });
+    if (error instanceof AnalysisCapabilityUnavailableError)
+        return new AnalysisCapabilityUnavailableError(error.providerId, error.operation, text(error.reason), {
+            cause: error,
+            ...(error.userMessage === undefined
+                ? {}
+                : { userMessage: text(error.userMessage) }),
+        });
+    if (error instanceof ProviderCleanupError)
+        return new ProviderCleanupError(error.providerId, error.cleanupResources.map(text), diagnostics(error.diagnostics ?? {}), { operation: error.operation, cause: error });
+    if (error instanceof ProviderAdapterError)
+        return new ProviderAdapterError(error.providerId, error.operation, {
+            cause: error,
+            ...(error.diagnostics === undefined
+                ? {}
+                : { diagnostics: diagnostics(error.diagnostics) }),
+        });
+    return error;
+};

package/dist/domain/explicitSensitiveValues.js

@@ -0,0 +1,10 @@
+/** Replace caller-declared literal text values without guessing sensitivity from names. */
+export const redactExplicitText = (value, sensitiveValues) => {
+    const literals = [...new Set(sensitiveValues)].filter((literal) => literal !== "");
+    const replacement = ["[REDACTED]", "…", ""].find((candidate) => literals.every((literal) => !candidate.includes(literal))) ?? "";
+    let result = value;
+    for (const literal of literals.sort((left, right) => right.length - left.length))
+        result = result.replaceAll(literal, replacement);
+    // Replacement boundaries can form another declaration; exclude that text.
+    return literals.some((literal) => result.includes(literal)) ? "" : result;
+};

package/dist/domain/{firmwareAnalysis.js → firmware/firmwareAnalysis.js}

@@ -1,10 +1,17 @@
 import { z } from "zod";
-import { digestSchema } from "./digests.js";
-import { jsonValueSchema } from "./jsonValue.js";
+import { digestSchema } from "../digests.js";
+import { jsonValueSchema } from "../jsonValue.js";
+import { isAbsoluteLocalPath } from "../localPath.js";
 const bytes = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
 const range = z.strictObject({ offset: bytes, length: bytes.positive() });
 const target = {
-    path: z.string().min(1).describe("Local firmware file; never executed"),
+    path: z
+        .string()
+        .min(1)
+        .refine(isAbsoluteLocalPath, {
+        message: "path must be an absolute local filesystem path (for example /tmp/firmware.bin or C:\\firmware\\firmware.bin)",
+    })
+        .describe("Absolute local firmware file; never executed. Relative paths are rejected."),
 };
 /** Explicit firmware inspection and extraction intent, independent of engines. */
 export const firmwareInputSchemas = {

package/dist/domain/functionComparisonNormalization.js

@@ -1,4 +1,4 @@
-import canonicalize from "canonicalize";
+import { canonicalJson } from "./comparisonSemantics.js";
 import { compareCodePoints } from "./canonicalOrdering.js";
 export const identityProjection = (snapshot) => ({
     name: snapshot.procedure.name,
@@ -129,13 +129,17 @@ export const stringAndNameProjection = (snapshot) => {
         ? null
         : sorted(values);
 };
-export const sorted = (values) => [...values].sort((left, right) => {
-    const leftJson = canonicalJson(left);
-    const rightJson = canonicalJson(right);
+export const sorted = (values) => values
+    .map((value) => ({
+    value,
+    json: canonicalJson(value, "Function normalization"),
+}))
+    .sort((left, right) => {
     // Preserve existing collation while ordering distinct values within a tie.
-    return (leftJson.localeCompare(rightJson) ||
-        compareCodePoints(leftJson, rightJson));
-});
+    return (left.json.localeCompare(right.json) ||
+        compareCodePoints(left.json, right.json));
+})
+    .map(({ value }) => value);
 export const combineCoverage = (left, right) => {
     return {
         items: [...left.items, ...right.items],
@@ -154,9 +158,3 @@ const relativeAddress = (value, base) => {
         ? null
         : String(parsed - parsedBase);
 };
-const canonicalJson = (value) => {
-    const encoded = canonicalize(value);
-    if (encoded === undefined)
-        throw new TypeError("Function normalization could not canonicalize data");
-    return encoded;
-};

package/dist/domain/hopperValues.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { err, ok } from "./result.js";
-import { nativeApiBoundarySchema } from "./nativeApiBoundary.js";
-import { nativeValueFlowSchema } from "./nativeValueFlow.js";
+import { nativeApiBoundarySchema } from "./native/nativeApiBoundary.js";
+import { nativeValueFlowSchema } from "./native/nativeValueFlow.js";
 import { AnalysisOutputError } from "./analysisErrorCore.js";
 import { HopperProtocolError } from "./hopperErrors.js";
 /** Return a bounded byte distance between canonical addresses in one space. */

package/dist/domain/inputIssueProjection.js

@@ -2,8 +2,11 @@
 export const projectInputIssues = (issues, input) => issues.flatMap((issue) => projectIssue(issue, input));
 const projectIssue = (issue, input) => {
     const path = issue.path.flatMap((part) => typeof part === "string" || typeof part === "number" ? [part] : []);
+    // Branch issue paths are relative to the union; branches often agree.
     if (issue.code === "invalid_union")
-        return issue.errors.flatMap((branch) => branch.flatMap((branchIssue) => projectIssue(branchIssue, input)));
+        return uniqueIssues(issue.errors.flatMap((branch) => branch.flatMap((branchIssue) => projectIssue({ ...branchIssue, path: [...issue.path, ...branchIssue.path] }, input))));
+    if (issue.code === "invalid_key")
+        return issue.issues.flatMap((keyIssue) => projectIssue({ ...keyIssue, path: [...issue.path, ...keyIssue.path] }, input));
     if (issue.code === "unrecognized_keys")
         return issue.keys.map((key) => ({
             path: [...path, key],
@@ -24,7 +27,16 @@ const projectIssue = (issue, input) => {
     if (issue.code === "too_big")
         return [boundedIssue(path, "maximum", numericBound(issue.maximum))];
     if (issue.code === "invalid_format")
-        return [{ path, reason: "invalid_format", expected: issue.format }];
+        return [
+            {
+                path,
+                reason: "invalid_format",
+                expected: issue.format,
+                ...(issue.format === "regex" && issue.message.length > 0
+                    ? { message: issue.message }
+                    : {}),
+            },
+        ];
     if (issue.code === "invalid_value")
         return [
             {
@@ -41,6 +53,9 @@ const projectIssue = (issue, input) => {
         },
     ];
 };
+const uniqueIssues = (issues) => [
+    ...new Map(issues.map((issue) => [JSON.stringify(issue), issue])).values(),
+];
 const valueAtPath = (input, path) => {
     let current = input;
     for (const part of path) {

package/dist/domain/{electronActiveObservation.js → javascript/electronActiveObservation.js}

@@ -1,5 +1,8 @@
 import { z } from "zod";
-const pathInputSchema = z.string().trim().min(1);
+import { isAbsoluteLocalPath } from "../localPath.js";
+const pathInputSchema = z.string().trim().min(1).refine(isAbsoluteLocalPath, {
+    message: "Electron executable, application, and root paths must be absolute local filesystem paths (for example /Applications/Electron.app/Contents/MacOS/Electron)",
+});
 const absolutePathSchema = z
     .string()
     .min(1)
@@ -52,9 +55,11 @@ const actionSchema = z.discriminatedUnion("kind", [
 ]);
 /** Input for one explicit, provider-owned Electron runtime experiment. */
 export const electronActiveObservationInputSchema = z.strictObject({
-    executable_path: pathInputSchema,
-    application_path: pathInputSchema,
-    application_root: pathInputSchema.optional(),
+    executable_path: pathInputSchema.describe("Absolute local filesystem path for the Electron executable; relative paths are rejected."),
+    application_path: pathInputSchema.describe("Absolute local filesystem path for the Electron application; relative paths are rejected."),
+    application_root: pathInputSchema
+        .optional()
+        .describe("Absolute local filesystem root for application-relative paths; omit to derive it from the application path. Relative paths are rejected."),
     args: z.array(z.string()).default([]),
     actions: z.array(actionSchema).default([]),
 });

package/dist/domain/{electronObservation.js → javascript/electronObservation.js}

@@ -1,8 +1,9 @@
 import { z } from "zod";
-import { browserCompletenessSchema } from "./browserCompleteness.js";
-import { browserEndpointSchema } from "./browserObservation.js";
-import { webTextArtifactSchema } from "./webContentArtifact.js";
-import { prefixedDigestSchema } from "./../domain/digests.js";
+import { browserCompletenessSchema } from "../browserCompleteness.js";
+import { browserEndpointSchema } from "../browserObservation.js";
+import { browserVersionSchema } from "../browserObservationSchemas.js";
+import { webTextArtifactSchema } from "../webContentArtifact.js";
+import { prefixedDigestSchema } from "../digests.js";
 const approvedElectronInput = {
     cdp_endpoint: browserEndpointSchema,
 };
@@ -26,13 +27,6 @@ export const inspectElectronPageInputSchema = z.union([
         include_script_sources: z.literal(true),
     }),
 ]);
-const browserVersionSchema = z.object({
-    product: z.string(),
-    protocol_version: z.string(),
-    revision: z.string(),
-    user_agent: z.string(),
-    js_version: z.string(),
-});
 const electronTargetSchema = z.object({
     target_id: z.string(),
     type: z.string(),

package/dist/domain/{electronStaticAnalysisBrowser.js → javascript/electronStaticAnalysisBrowser.js}

@@ -1,8 +1,9 @@
 import * as t from "@babel/types";
 import { boundedExpression, collectContextBridgeMembers, electronStaticValue, objectProperty, } from "./electronStaticAnalysisValues.js";
-import { compareCodePoints } from "./canonicalOrdering.js";
+import { compareCodePoints } from "../canonicalOrdering.js";
 import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
-import { argumentNode, calleeName, propertyName, range, staticPath, staticPathResolutionContext, } from "./javascriptStaticAnalysisHelpers.js";
+import { argumentNode, calleeName, range, staticPath, staticPathResolutionContext, } from "./javascriptStaticAnalysisHelpers.js";
+import { semanticStaticPropertyName } from "./javascriptAstValues.js";
 /** Inspect BrowserWindow, contextBridge, and utility-process syntax. */
 export const inspectElectronBrowserNode = (node, context) => {
     if (t.isNewExpression(node))
@@ -66,7 +67,7 @@ const collectWebPreferences = (source, object) => {
             });
             continue;
         }
-        const name = propertyName(property.key);
+        const name = semanticStaticPropertyName(property.key, property.computed);
         if (name === "" || property.computed) {
             unknown += 1;
             preferences.push({

package/dist/domain/{electronStaticAnalysisIpc.js → javascript/electronStaticAnalysisIpc.js}

@@ -1,7 +1,7 @@
 import * as t from "@babel/types";
 import { boundedExpression, electronStaticValue, handlerKind, } from "./electronStaticAnalysisValues.js";
 import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
-import { argumentNode, calleeName, propertyName, range, } from "./javascriptStaticAnalysisHelpers.js";
+import { argumentNode, calleeName, range, semanticStaticPropertyName, } from "./javascriptStaticAnalysisHelpers.js";
 /** Inspect Electron IPC operations and validation candidates. */
 export const inspectElectronIpcNode = (node, context) => {
     if (t.isCallExpression(node)) {
@@ -90,7 +90,7 @@ const inspectValidationCall = (node, context) => {
     if (!t.isMemberExpression(node.callee) &&
         !t.isOptionalMemberExpression(node.callee))
         return;
-    const method = propertyName(node.callee.property);
+    const method = semanticStaticPropertyName(node.callee.property, node.callee.computed);
     if (!["startsWith", "endsWith", "includes"].includes(method))
         return;
     const subject = t.isNode(node.callee.object)

package/dist/domain/{electronStaticAnalysisNative.js → javascript/electronStaticAnalysisNative.js}

@@ -1,7 +1,8 @@
 import * as t from "@babel/types";
-import { compareCodePoints } from "./canonicalOrdering.js";
+import { compareCodePoints } from "../canonicalOrdering.js";
+import { stripQueryAndFragment } from "../artifactPathSyntax.js";
 import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
-import { argumentNode, calleeName, propertyName, range, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
+import { argumentNode, calleeName, propertyName, range, semanticStaticPropertyName, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
 /** Inspect JavaScript-side imports and re-exports of native .node addons. */
 export const inspectElectronNativeNode = (node, context) => {
     if (t.isImportDeclaration(node))
@@ -113,14 +114,14 @@ const addBinding = (input) => {
     });
 };
 const nativeRequire = (node) => {
-    if (t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) {
-        const nested = t.isNode(node.object)
-            ? nativeRequire(node.object)
-            : undefined;
-        if (nested === undefined)
+    let member = null;
+    while (t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) {
+        if (!t.isNode(node.object))
             return undefined;
-        const member = propertyName(node.property);
-        return { ...nested, member: member === "" ? nested.member : member };
+        const property = semanticStaticPropertyName(node.property, node.computed);
+        if (member === null && property !== "")
+            member = property;
+        node = node.object;
     }
     if (!t.isCallExpression(node))
         return undefined;
@@ -131,7 +132,7 @@ const nativeRequire = (node) => {
         return undefined;
     const specifier = stringValue(argumentNode(node.arguments[0]));
     return specifier !== undefined && isNativeSpecifier(specifier, "require")
-        ? { specifier, member: null }
+        ? { specifier, member }
         : undefined;
 };
 const bindingMembers = (pattern) => {
@@ -160,8 +161,6 @@ const exportedMember = (node) => {
     return undefined;
 };
 const isNativeSpecifier = (specifier, moduleKind) => {
-    const path = moduleKind === "require"
-        ? specifier
-        : (specifier.split("#", 1)[0]?.split("?", 1)[0] ?? "");
+    const path = moduleKind === "require" ? specifier : stripQueryAndFragment(specifier);
     return path.toLowerCase().endsWith(".node");
 };

package/dist/domain/javascript/electronStaticAnalysisTypes.js

@@ -0,0 +1 @@
+export {};

package/dist/domain/{electronStaticAnalysisValues.js → javascript/electronStaticAnalysisValues.js}

@@ -1,7 +1,7 @@
 import * as t from "@babel/types";
-import { compareCodePoints } from "./canonicalOrdering.js";
+import { compareCodePoints } from "../canonicalOrdering.js";
 import { semanticStaticPropertyName } from "./javascriptAstValues.js";
-import { propertyName, sourceSlice, } from "./javascriptStaticAnalysisHelpers.js";
+import { sourceSlice } from "./javascriptStaticAnalysisHelpers.js";
 /** Preserve one literal value or the exact inert expression. */
 export const electronStaticValue = (source, node) => {
     const literal = literalValue(node);
@@ -89,7 +89,7 @@ const collectMembersAt = (object, prefix, depth, state) => {
             state.unknown += 1;
             continue;
         }
-        const name = propertyName(property.key);
+        const name = semanticStaticPropertyName(property.key, property.computed);
         if (name === "" || property.computed) {
             state.unknown += 1;
             continue;

package/dist/domain/javascript/htmlArtifactReferences.js

@@ -0,0 +1,40 @@
+import { defaultTreeAdapter, parse, } from "parse5";
+/** Extract inert HTML script references and the first document base href. */
+export const htmlArtifactReferences = (text) => {
+    const pending = [
+        parse(text, { sourceCodeLocationInfo: true }),
+    ];
+    const scripts = [];
+    let baseHref = null;
+    while (pending.length > 0) {
+        const node = pending.pop();
+        if (node === undefined)
+            continue;
+        if (defaultTreeAdapter.isElementNode(node) &&
+            node.namespaceURI === "http://www.w3.org/1999/xhtml") {
+            if (node.tagName === "base" && baseHref === null) {
+                const href = node.attrs.find(({ name }) => name === "href");
+                if (href !== undefined)
+                    baseHref = href.value;
+            }
+            if (node.tagName === "script") {
+                const src = node.attrs.find(({ name }) => name === "src");
+                const location = node.sourceCodeLocation?.startTag;
+                if (src !== undefined && src.value !== "" && location !== undefined) {
+                    scripts.push({
+                        scriptPath: src.value,
+                        startOffset: location.startOffset,
+                        endOffset: location.endOffset,
+                    });
+                }
+            }
+        }
+        // Template content belongs to a separate inert document fragment. Only
+        // traverse the actual document children, without recursion on deep input.
+        if ("childNodes" in node) {
+            for (const child of node.childNodes.toReversed())
+                pending.push(child);
+        }
+    }
+    return { baseHref, scripts };
+};