rea-agents 5.0.0 → 6.1.0

package/dist/domain/javascript/javascriptApplicationAnalysis.js

@@ -1,12 +1,13 @@
 import { z } from "zod";
-import { javascriptApplicationGraphSchema } from "./javascriptApplicationGraph.js";
-import { javaScriptSemanticGraphSchema } from "./javascriptSemanticGraph.js";
+import { javascriptApplicationGraphSchema, isValidatedImmutableJavaScriptApplicationGraph, } from "./javascriptApplicationGraph.js";
+import { javaScriptSemanticGraphSchema, isValidatedImmutableJavaScriptSemanticGraph, } from "./javascriptSemanticGraph.js";
 import { digestSchema } from "../digests.js";
 import { prefixedDigestSchema } from "../digests.js";
+import { localPathStringSchema } from "../localPath.js";
 const countSchema = z.number().int().min(0);
 /** Public target-free request for static JavaScript application analysis. */
 export const analyzeJavaScriptApplicationInputSchema = z.strictObject({
-    input_path: z.string().min(1),
+    input_path: localPathStringSchema,
     format: z.enum(["auto", "asar", "directory"]).default("auto"),
 });
 /** Compact counts for the high-level Electron architecture/security surface. */
@@ -45,9 +46,7 @@ const reconstructionStatisticsSchema = z.strictObject({
     parse_failures: countSchema,
     truncated_scopes: countSchema,
 });
-/** JavaScript application analysis with an authenticated semantic companion. */
-export const javascriptApplicationAnalysisResultSchema = z
-    .strictObject({
+const applicationAnalysisResultShape = z.strictObject({
     input_path: z.string().min(1),
     format: z.enum(["asar", "directory"]),
     root_artifact_sha256: digestSchema,
@@ -58,8 +57,8 @@ export const javascriptApplicationAnalysisResultSchema = z
     statistics: reconstructionStatisticsSchema,
     limitations: z.array(z.string().min(1)),
     semantic_graph: javaScriptSemanticGraphSchema,
-})
-    .superRefine((result, context) => {
+});
+function* checkApplicationBindingsSteps(result, context) {
     if (result.semantic_graph.application_graph_id !== result.graph.graph_id)
         context.addIssue({
             code: "custom",
@@ -72,19 +71,68 @@ export const javascriptApplicationAnalysisResultSchema = z
             path: ["semantic_graph", "root_artifact_sha256"],
             message: "Semantic graph must commit the containing root artifact",
         });
-    const applicationNodeIds = new Set(result.graph.nodes.map(({ node_id }) => node_id));
-    for (const [nodeIndex, node] of result.semantic_graph.nodes.entries())
-        for (const [identifierIndex, identifier,] of node.application_node_ids.entries())
-            if (!applicationNodeIds.has(identifier))
-                context.addIssue({
-                    code: "custom",
-                    path: [
-                        "semantic_graph",
-                        "nodes",
-                        nodeIndex,
-                        "application_node_ids",
-                        identifierIndex,
-                    ],
-                    message: "Semantic node references an absent application node",
-                });
+    const applicationNodeIds = new Set();
+    let examined = 0;
+    try {
+        for (const node of result.graph.nodes) {
+            applicationNodeIds.add(node.node_id);
+            if (++examined === 4096) {
+                examined = 0;
+                yield;
+            }
+        }
+        for (const [nodeIndex, node] of result.semantic_graph.nodes.entries()) {
+            if (++examined === 4096) {
+                examined = 0;
+                yield;
+            }
+            for (const [identifierIndex, identifier,] of node.application_node_ids.entries()) {
+                if (!applicationNodeIds.has(identifier))
+                    context.addIssue({
+                        code: "custom",
+                        path: [
+                            "semantic_graph",
+                            "nodes",
+                            nodeIndex,
+                            "application_node_ids",
+                            identifierIndex,
+                        ],
+                        message: "Semantic node references an absent application node",
+                    });
+                if (++examined === 4096) {
+                    examined = 0;
+                    yield;
+                }
+            }
+        }
+    }
+    finally {
+        applicationNodeIds.clear();
+    }
+}
+/** JavaScript application analysis with an authenticated semantic companion. */
+export const javascriptApplicationAnalysisResultSchema = applicationAnalysisResultShape.superRefine((result, context) => {
+    const steps = checkApplicationBindingsSteps(result, context);
+    while (!steps.next().done) {
+        // Public/imported results still receive complete synchronous validation.
+    }
+});
+const ownedAnalysisResultShape = applicationAnalysisResultShape.extend({
+    graph: z.custom(isValidatedImmutableJavaScriptApplicationGraph),
+    semantic_graph: z.custom(isValidatedImmutableJavaScriptSemanticGraph),
 });
+/** Reuse exact owned graphs while validating metadata and cross-graph bindings. */
+export function* parseOwnedJavaScriptApplicationAnalysisSteps(input) {
+    const prepared = ownedAnalysisResultShape.safeParse(input);
+    if (!prepared.success)
+        return javascriptApplicationAnalysisResultSchema.parse(input);
+    const issues = [];
+    yield* checkApplicationBindingsSteps(prepared.data, {
+        addIssue: (issue) => {
+            issues.push(issue);
+        },
+    });
+    if (issues.length > 0)
+        throw new z.ZodError(issues);
+    return prepared.data;
+}

package/dist/domain/javascript/javascriptApplicationGraph.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { canonicalDigest, canonicalJson } from "../comparisonSemantics.js";
 import { compareCodePoints, uniqueSorted } from "../canonicalOrdering.js";
+import { freezeOwnedJsonSnapshotSteps } from "../immutableJson.js";
 import { applicationEdgeInputSchema, applicationEdgeSchema, applicationNodeInputSchema, applicationNodeObservationSchema, applicationNodeSchema, javascriptApplicationGraphInputSchema, javascriptApplicationGraphRecordSchema, } from "./javascriptApplicationGraphSchemas.js";
 const OBSERVATION_IDENTIFIER_STRATEGY = {
     strategy: "semantic-content-sha256",
@@ -255,6 +256,18 @@ export const createJavaScriptApplicationGraph = (input) => {
         graph_id: `jag_${canonicalDigest(semantic, "JavaScript Application Graph")}`,
     });
 };
+const validatedImmutableApplicationGraphs = new WeakSet();
+/** Clone and validate synchronously, then return steps to seal the owned graph. */
+export const createImmutableJavaScriptApplicationGraphSteps = (input) => sealValidatedApplicationGraphSteps(createJavaScriptApplicationGraph(input));
+function* sealValidatedApplicationGraphSteps(graph) {
+    yield* freezeOwnedJsonSnapshotSteps(graph);
+    validatedImmutableApplicationGraphs.add(graph);
+    return graph;
+}
+/** Recognize the exact completely sealed graph produced by the owned factory. */
+export const isValidatedImmutableJavaScriptApplicationGraph = (value) => typeof value === "object" &&
+    value !== null &&
+    validatedImmutableApplicationGraphs.has(value);
 /** Parse a stored graph and reject stale IDs. */
 export const parseJavaScriptApplicationGraph = (input) => javascriptApplicationGraphSchema.parse(input);
 /** Compute the byte-stable SHA-256 commitment of a verified graph. */

package/dist/domain/javascript/javascriptAstValues.js

@@ -1,4 +1,24 @@
 import * as t from "@babel/types";
+/** Read one syntax-level primitive only when its value is exact. */
+export const readExactJavaScriptLiteral = (node) => {
+    if (t.isStringLiteral(node))
+        return { found: true, value: node.value };
+    if (t.isNumericLiteral(node) && Number.isFinite(node.value))
+        return { found: true, value: node.value };
+    if (t.isBooleanLiteral(node))
+        return { found: true, value: node.value };
+    if (t.isNullLiteral(node))
+        return { found: true, value: null };
+    if (t.isTemplateLiteral(node) &&
+        node.expressions.length === 0 &&
+        node.quasis.length === 1) {
+        const cooked = node.quasis[0]?.value.cooked;
+        return cooked === null || cooked === undefined
+            ? { found: false }
+            : { found: true, value: cooked };
+    }
+    return { found: false };
+};
 /** Read an identifier or literal property name without evaluating syntax. */
 export const propertyName = (node) => {
     if (t.isIdentifier(node))

package/dist/domain/javascript/javascriptExportShapeComparison.js

@@ -1,8 +1,8 @@
-import { uniqueSorted } from "../canonicalOrdering.js";
-import { digestExportShapeValue } from "./javascriptExportShapeComparisonIdentity.js";
+import { compareCodePoints, uniqueSorted } from "../canonicalOrdering.js";
+import { canonicalExportShapeValue, digestExportShapeValue, } from "./javascriptExportShapeComparisonIdentity.js";
 import { javaScriptExportShapeComparisonResultSchema, } from "./javascriptExportShapeComparisonSchemas.js";
 import { retainJavaScriptExportShapes, selectJavaScriptExport, } from "./javascriptExportShapeSelection.js";
-import { buildJavaScriptExportShapeChanges, compareJavaScriptExportShapeChanges, hasPartialJavaScriptExportPropertyCoverage, pairJavaScriptExportShapeVariants, } from "./javascriptExportShapeVariants.js";
+import { buildJavaScriptExportShapeChanges, hasPartialJavaScriptExportPropertyCoverage, pairJavaScriptExportShapeVariants, } from "./javascriptExportShapeVariants.js";
 /** Compare exact selected export return shapes without executing JavaScript. */
 export const compareJavaScriptExportShapes = (input) => {
     const left = selectJavaScriptExport(input.left);
@@ -11,14 +11,14 @@ export const compareJavaScriptExportShapes = (input) => {
     const rightRetained = retainJavaScriptExportShapes(right);
     const pairing = pairJavaScriptExportShapeVariants(leftRetained.shapes, rightRetained.shapes);
     const evidenceLinks = evidencePair(input.left.evidenceId, input.right.evidenceId);
-    const allChanges = buildJavaScriptExportShapeChanges({
+    const allChanges = sortChanges(buildJavaScriptExportShapeChanges({
         leftSelection: left,
         rightSelection: right,
         pairing,
         leftShapes: leftRetained.shapes,
         rightShapes: rightRetained.shapes,
         evidenceLinks,
-    }).sort(compareJavaScriptExportShapeChanges);
+    }));
     const changes = allChanges;
     const omittedChanges = 0;
     const coverage = comparisonCoverage({
@@ -46,6 +46,22 @@ export const compareJavaScriptExportShapes = (input) => {
         comparison_id: `jesc_${digestExportShapeValue(semantic)}`,
     });
 };
+const sortChanges = (changes) => changes
+    .map((change, index) => ({
+    change,
+    index,
+    sortKey: canonicalExportShapeValue({
+        discriminant: change.discriminant,
+        path: change.path,
+        status: change.status,
+        left_source_range: change.left_source_range,
+        right_source_range: change.right_source_range,
+        change_id: change.change_id,
+    }),
+}))
+    .sort((left, right) => compareCodePoints(left.sortKey, right.sortKey) ||
+    left.index - right.index)
+    .map(({ change }) => change);
 const comparisonCoverage = (context) => {
     const leftSource = context.left.projection?.return_shape_coverage;
     const rightSource = context.right.projection?.return_shape_coverage;

package/dist/domain/javascript/javascriptExportShapeVariants.js

@@ -61,8 +61,6 @@ export const buildJavaScriptExportShapeChanges = (input) => {
     });
     return [...paired, ...unpairedLeft, ...unpairedRight];
 };
-/** Sort changes by semantic content rather than traversal order. */
-export const compareJavaScriptExportShapeChanges = (left, right) => compareCodePoints(canonicalExportShapeValue(changeSortKey(left)), canonicalExportShapeValue(changeSortKey(right)));
 /** Report whether any retained shape lacks complete property coverage. */
 export const hasPartialJavaScriptExportPropertyCoverage = (shapes) => shapes.some((shape) => shape.property_coverage.some(({ status }) => status === "partial"));
 const discriminantOccurrences = (shapes) => {
@@ -270,14 +268,6 @@ const changeWithId = (semantic) => ({
     ...semantic,
     change_id: `jesc_change_${digestExportShapeValue(semantic)}`,
 });
-const changeSortKey = (change) => ({
-    discriminant: change.discriminant,
-    path: change.path,
-    status: change.status,
-    left_source_range: change.left_source_range,
-    right_source_range: change.right_source_range,
-    change_id: change.change_id,
-});
 const literalValue = (field) => field.state === "literal" && isPrimitive(field.value)
     ? { found: true, value: field.value }
     : { found: false };

package/dist/domain/javascript/javascriptRecovery.js

@@ -1,16 +1,11 @@
 import { z } from "zod";
 import { digestSchema } from "../digests.js";
 import { analyzeJavaScriptApplicationInputSchema } from "./javascriptApplicationAnalysis.js";
+import { localPathStringSchema } from "../localPath.js";
 /** Recover derived readable modules from one explicitly selected local script. */
 export const javascriptRecoveryInputSchema = z.strictObject({
-    path: z
-        .string()
-        .min(1)
-        .describe("Absolute path to a UTF-8 JavaScript file; never executed"),
-    output_directory: z
-        .string()
-        .min(1)
-        .describe("Absolute absent output directory; parent must exist"),
+    path: localPathStringSchema.describe("Absolute path to a UTF-8 JavaScript file; never executed"),
+    output_directory: localPathStringSchema.describe("Absolute absent output directory; parent must exist"),
     extraction_mode: z
         .enum(["structural", "heuristic", "inspection"])
         .default("structural")

package/dist/domain/javascript/javascriptSemanticAnalysis.js

@@ -1,13 +1,14 @@
 import * as t from "@babel/types";
 import { failedJavaScriptSemanticIr, } from "./javascriptSemanticIr.js";
 import { collectSemanticModuleLink, collectSemanticCallable, collectSemanticReferences, immutableSemanticBindings, immutableSemanticScopes, semanticStaticPropertyKey, } from "./javascriptSemanticProjection.js";
-import { currentSemanticScope, resolveSemanticBindingFromScope, semanticScopeId, semanticVariableScope, } from "./javascriptSemanticState.js";
+import { currentSemanticScope, resolveSemanticBindingState, semanticResolutionBlocked, resolveSemanticBindingFromScope, semanticScopeId, semanticVariableScope, } from "./javascriptSemanticState.js";
 import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
 import { collectSemanticMemberMutations } from "./javascriptSemanticMemberMutations.js";
 import { collectSemanticReturns, resolveSemanticModuleCallables, } from "./javascriptSemanticReturns.js";
 import { collectJavaScriptDerivedSemantics } from "./javascriptSemanticDerivedAnalysis.js";
 import { propertyName, range } from "./javascriptStaticAnalysisHelpers.js";
 import { semanticCoverage } from "./javascriptSemanticCoverage.js";
+import { semanticResourceLimitsIn } from "./javascriptSemanticResourceLimits.js";
 import { parseJavaScriptSource, } from "./javascriptSourceParser.js";
 /** Recover lexical bindings, aliases, constants, and module links. */
 export const analyzeJavaScriptSemantics = (source) => {
@@ -44,7 +45,10 @@ export const analyzeParsedJavaScriptSemantics = (file) => {
         references,
         moduleLinks,
         ...derived,
-        coverage: semanticCoverage(parserPartial),
+        coverage: semanticCoverage(parserPartial, semanticResourceLimitsIn([
+            ...bindings.map(({ value }) => value),
+            ...callables.flatMap((callable) => callable.returnSites.map(({ value }) => value)),
+        ])),
         limitations: [
             ...(parserPartial
                 ? [
@@ -59,6 +63,97 @@ export const analyzeParsedJavaScriptSemantics = (file) => {
         ],
     };
 };
+/**
+ * Resolve only the lexical receiver identity needed to distinguish browser
+ * `window.open` from XHR and global storage `.open` calls. This deliberately
+ * builds definitions without running semantic value or provenance analysis.
+ */
+export const classifyParsedJavaScriptOpenReceivers = (file) => {
+    const state = createState(file.program);
+    collectDefinitions(file.program, state);
+    const facts = new Map();
+    traverseJavaScriptAst(file.program, {
+        enter: (node) => {
+            if ((!t.isCallExpression(node) && !t.isOptionalCallExpression(node)) ||
+                (!t.isMemberExpression(node.callee) &&
+                    !t.isOptionalMemberExpression(node.callee)) ||
+                semanticStaticPropertyKey(node.callee.property, node.callee.computed) !== "open" ||
+                !t.isIdentifier(node.callee.object))
+                return;
+            const receiver = node.callee.object.name;
+            const binding = resolveSemanticBindingState(state, node, receiver);
+            if (binding === undefined) {
+                if (semanticResolutionBlocked(state, node, receiver))
+                    return;
+                const fact = openGlobalFact(receiver);
+                if (fact !== undefined)
+                    facts.set(node.start ?? -1, fact);
+                return;
+            }
+            // A lexically bound receiver overrides ambient browser globals. Mark an
+            // otherwise unresolved local as local so name-based window.open
+            // heuristics do not hide its XHR-like overloads.
+            facts.set(node.start ?? -1, "local");
+            if (receiver === "indexedDB" || receiver === "caches") {
+                facts.set(node.start ?? -1, receiver === "indexedDB" ? "local-indexed-db" : "local-cache-storage");
+                return;
+            }
+            if (binding.mutable || binding.initializers.length !== 1)
+                return;
+            const initializer = binding.initializers[0]?.node;
+            if (!t.isIdentifier(initializer))
+                return;
+            const initializerBinding = resolveSemanticBindingState(state, initializer, initializer.name);
+            if (initializerBinding !== undefined) {
+                if (initializer.name === "indexedDB" || initializer.name === "caches") {
+                    const localFact = initializer.name === "indexedDB"
+                        ? "local-indexed-db"
+                        : "local-cache-storage";
+                    facts.set(node.start ?? -1, localFact);
+                    if (initializerBinding.mutable ||
+                        initializerBinding.initializers.length !== 1)
+                        return;
+                    const nested = initializerBinding.initializers[0]?.node;
+                    if (t.isIdentifier(nested)) {
+                        const nestedFact = resolveGlobalAliasFact(state, initializer, nested.name);
+                        if (nestedFact !== undefined)
+                            facts.set(node.start ?? -1, nestedFact);
+                    }
+                }
+                else if (initializer.name === "window") {
+                    facts.set(node.start ?? -1, "local");
+                }
+                return;
+            }
+            const aliasFact = resolveGlobalAliasFact(state, initializer, initializer.name);
+            if (aliasFact !== undefined)
+                facts.set(node.start ?? -1, aliasFact);
+        },
+    });
+    return facts;
+};
+const openGlobalFact = (name) => {
+    if (name === "window" ||
+        name === "self" ||
+        name === "globalThis" ||
+        name === "top" ||
+        name === "parent" ||
+        name === "opener" ||
+        name === "frames" ||
+        name === "document")
+        return "window";
+    if (name === "indexedDB")
+        return "indexed-db";
+    if (name === "caches")
+        return "cache-storage";
+    return undefined;
+};
+const resolveGlobalAliasFact = (state, node, name) => {
+    if (resolveSemanticBindingState(state, node, name) !== undefined ||
+        semanticResolutionBlocked(state, node, name))
+        return undefined;
+    return openGlobalFact(name);
+};
 const createState = (program) => {
     const root = {
         scopeId: semanticScopeId("program", program),

package/dist/domain/javascript/javascriptSemanticCoverage.js

@@ -1,8 +1,9 @@
-/** Classify whole-file semantic coverage from parser recovery. */
-export const semanticCoverage = (parserPartial) => ({
-    status: parserPartial ? "partial" : "complete",
-    omittedCount: 0,
-});
+/** Classify whole-file semantic coverage from parsing and value bounds. */
+export const semanticCoverage = (parserPartial, resourceLimits = []) => resourceLimits.length > 0
+    ? { status: "partial", omittedCount: null, resourceLimits }
+    : { status: parserPartial ? "partial" : "complete", omittedCount: 0 };
+/** Read typed resource-limit classifications from any coverage state. */
+export const semanticCoverageResourceLimits = (coverage) => coverage.resourceLimits ?? [];
 /** Classify one callable's direct-return coverage. */
 export const semanticReturnCoverage = (retainedCount, parserPartial) => ({
     status: parserPartial ? "partial" : "complete",

package/dist/domain/javascript/javascriptSemanticDataEffectHelpers.js

@@ -3,7 +3,7 @@ import { semanticBuiltinNamespacePath } from "./javascriptSemanticProvenance.js"
 import { semanticCallableIdForNode } from "./javascriptSemanticProjection.js";
 import { resolveSemanticBindingState, semanticResolutionBlocked, } from "./javascriptSemanticState.js";
 import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
-import { semanticStaticPropertyKey, semanticStaticPropertyName, } from "./javascriptAstValues.js";
+import { readExactJavaScriptLiteral, semanticStaticPropertyKey, semanticStaticPropertyName, } from "./javascriptAstValues.js";
 /** Resolve bindings written by the nearest variable or assignment owner. */
 export const assignedSemanticResultBindings = (node, ancestors, state) => {
     for (let index = ancestors.length - 1; index >= 0; index -= 1) {
@@ -164,11 +164,14 @@ export const dataEffectPrimitive = (node) => {
 };
 /** Read one static string or expression-free template. */
 export const dataEffectLiteralString = (node) => {
-    if (t.isStringLiteral(node))
-        return node.value;
-    if (t.isTemplateLiteral(node) && node.expressions.length === 0)
-        return node.quasis[0]?.value.cooked ?? node.quasis[0]?.value.raw ?? null;
-    return null;
+    if (node === undefined)
+        return null;
+    const literal = readExactJavaScriptLiteral(node);
+    if (literal.found && typeof literal.value === "string")
+        return literal.value;
+    return t.isTemplateLiteral(node) && node.expressions.length === 0
+        ? (node.quasis[0]?.value.raw ?? null)
+        : null;
 };
 /** Read a member callee from call or construction syntax. */
 export const dataEffectMemberCallee = (node) => t.isMemberExpression(node.callee) || t.isOptionalMemberExpression(node.callee)
@@ -179,14 +182,3 @@ export const dataEffectMemberObject = (node) => node !== null &&
     (t.isMemberExpression(node) || t.isOptionalMemberExpression(node))
     ? node.object
     : null;
-/** Compare Babel source offsets for exact containment. */
-export const containsSemanticNode = (outer, inner) => outer.start !== null &&
-    outer.start !== undefined &&
-    outer.end !== null &&
-    outer.end !== undefined &&
-    inner.start !== null &&
-    inner.start !== undefined &&
-    inner.end !== null &&
-    inner.end !== undefined &&
-    outer.start <= inner.start &&
-    outer.end >= inner.end;

package/dist/domain/javascript/javascriptSemanticDataEffects.js

@@ -3,7 +3,7 @@ import { semanticBuiltinNamespacePath } from "./javascriptSemanticProvenance.js"
 import { compareCodePoints } from "../canonicalOrdering.js";
 import { semanticStaticPropertyKey, semanticStaticPropertyName, } from "./javascriptSemanticProjection.js";
 import { resolveSemanticBindingState, semanticResolutionBlocked, } from "./javascriptSemanticState.js";
-import { builtinDataEffectMethod as builtinMethod, containsSemanticNode as containsNode, dataEffectArgumentBindingId as argumentBindingId, dataEffectLiteralString as literalString, dataEffectMemberCallee as memberCallee, dataEffectMemberObject as memberObject, dataEffectPrimitive as primitiveValue, isSemanticProcessObject as isProcessObject, outerDataEffectBinding as outerAssignedBinding, assignedSemanticResultBindings, semanticProjectedBindingFacts, traverseDataEffects as traverseWithContext, } from "./javascriptSemanticDataEffectHelpers.js";
+import { builtinDataEffectMethod as builtinMethod, dataEffectArgumentBindingId as argumentBindingId, dataEffectLiteralString as literalString, dataEffectMemberCallee as memberCallee, dataEffectMemberObject as memberObject, dataEffectPrimitive as primitiveValue, isSemanticProcessObject as isProcessObject, outerDataEffectBinding as outerAssignedBinding, assignedSemanticResultBindings, semanticProjectedBindingFacts, traverseDataEffects as traverseWithContext, } from "./javascriptSemanticDataEffectHelpers.js";
 import { range } from "./javascriptStaticAnalysisHelpers.js";
 /** Recover configuration, request, and boundary candidates from inert syntax. */
 export const collectJavaScriptSemanticDataEffects = (program, state, callables) => {
@@ -80,20 +80,37 @@ const processConfigurationMember = (node, state) => {
         return null;
     // `process.env[""]` names an exact (empty) key; only a dynamic key is unknown.
     const key = semanticStaticPropertyKey(node.property, node.computed);
+    if (family === "argv" && key !== null && !isArrayIndexKey(key))
+        return null;
     return {
         kind: family === "env" ? "environment" : "argv",
         key,
         resolution: key === null ? "partial" : "complete",
     };
 };
+const isArrayIndexKey = (key) => {
+    if (!/^(?:0|[1-9][0-9]*)$/u.test(key))
+        return false;
+    const index = Number(key);
+    return Number.isSafeInteger(index) && index < 2 ** 32 - 1;
+};
 const collectDefaults = (program, context, configurations) => {
     const output = [];
+    const configurationsByNode = new Map(configurations.map((candidate) => [candidate.node, candidate]));
     traverseWithContext(program, context, (node) => {
         if (!t.isLogicalExpression(node) ||
             (node.operator !== "??" && node.operator !== "||"))
             return;
-        const sources = configurations.filter(({ node: source }) => containsNode(node.left, source));
-        if (sources.length !== 1 || sources[0] === undefined)
+        let source = node.left;
+        while (t.isParenthesizedExpression(source) ||
+            t.isTSAsExpression(source) ||
+            t.isTSTypeAssertion(source) ||
+            t.isTypeCastExpression(source) ||
+            t.isTSSatisfiesExpression(source) ||
+            t.isTSNonNullExpression(source))
+            source = source.expression;
+        const candidate = configurationsByNode.get(source);
+        if (candidate === undefined)
             return;
         output.push({
             configId: `config:default:${String(node.start ?? -1)}:${String(node.end ?? -1)}`,
@@ -101,8 +118,8 @@ const collectDefaults = (program, context, configurations) => {
             location: range(node.right),
             ownerCallableId: context.callableStack.at(-1) ?? null,
             resultBindingId: outerAssignedBinding(node, context),
-            key: sources[0].operation.key,
-            sourceConfigId: sources[0].operation.configId,
+            key: candidate.operation.key,
+            sourceConfigId: candidate.operation.configId,
             value: primitiveValue(node.right),
             resolution: primitiveValue(node.right) === null ? "partial" : "complete",
         });

package/dist/domain/javascript/javascriptSemanticGraph.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { canonicalDigest, canonicalJson } from "../comparisonSemantics.js";
 import { compareCodePoints, uniqueSorted } from "../canonicalOrdering.js";
+import { freezeOwnedJsonSnapshotSteps } from "../immutableJson.js";
 import { JAVASCRIPT_SEMANTIC_RELATION_FAMILIES, JAVASCRIPT_SEMANTIC_RELATION_FAMILY, javaScriptSemanticFingerprintInputSchema, javaScriptSemanticFingerprintSchema, javaScriptSemanticGraphInputSchema, javaScriptSemanticGraphRecordSchema, javaScriptSemanticNodeInputSchema, javaScriptSemanticNodeSchema, javaScriptSemanticRelationInputSchema, javaScriptSemanticRelationSchema, javaScriptSemanticUnknownInputSchema, javaScriptSemanticUnknownSchema, } from "./javascriptSemanticGraphSchemas.js";
 const normalizeEvidence = (evidence) => ({
     ...evidence,
@@ -11,7 +12,8 @@ const normalizeEvidence = (evidence) => ({
     limitations: uniqueSorted(evidence.limitations),
     evidence_ids: uniqueSorted(evidence.evidence_ids),
 });
-const nodeId = (node) => `jsrg_node_${canonicalDigest({ kind: node.kind, identity: node.identity }, "JavaScript semantic graph")}`;
+/** Derive a semantic node ID from its kind and exact artifact identity. */
+export const javaScriptSemanticNodeId = (node) => `jsrg_node_${canonicalDigest({ kind: node.kind, identity: node.identity }, "JavaScript semantic graph")}`;
 /** Normalize one semantic entity and derive its artifact-version identifier. */
 export const createJavaScriptSemanticGraphNode = (input) => {
     const parsed = javaScriptSemanticNodeInputSchema.parse(input);
@@ -26,7 +28,7 @@ export const createJavaScriptSemanticGraphNode = (input) => {
     };
     return javaScriptSemanticNodeSchema.parse({
         ...semantic,
-        node_id: nodeId(semantic),
+        node_id: javaScriptSemanticNodeId(semantic),
     });
 };
 /** Normalize one semantic relationship and derive its exact identifier. */
@@ -157,7 +159,7 @@ const checkCanonicalOrder = (graph, context) => {
 };
 const checkNodes = (graph, nodes, context) => {
     for (const [index, node] of graph.nodes.entries()) {
-        if (node.node_id !== nodeId(node))
+        if (node.node_id !== javaScriptSemanticNodeId(node))
             context.addIssue({
                 code: "custom",
                 path: ["nodes", index, "node_id"],
@@ -295,7 +297,7 @@ const checkFingerprints = (graph, nodes, context) => {
             });
     }
 };
-const checkGraph = (graph, context) => {
+const checkGraphContent = (graph, context) => {
     checkCanonicalOrder(graph, context);
     const nodes = new Map(graph.nodes.map((node) => [node.node_id, node]));
     checkNodes(graph, nodes, context);
@@ -311,6 +313,9 @@ const checkGraph = (graph, context) => {
             path: ["limitations"],
             message: "Non-complete graph coverage requires a limitation",
         });
+};
+const checkGraph = (graph, context) => {
+    checkGraphContent(graph, context);
     const { graph_id: identifier, ...semantic } = graph;
     if (identifier !==
         "jsrg_" + canonicalDigest(semantic, "JavaScript semantic graph"))
@@ -344,8 +349,32 @@ export const createJavaScriptSemanticGraph = (input) => {
         },
         limitations: uniqueSorted(parsed.limitations),
     };
-    return javaScriptSemanticGraphSchema.parse({
+    // The input schema already cloned and validated every field. Validate the
+    // normalized relationships in place, then derive the only added field. The
+    // public schema still verifies arbitrary records and their commitments.
+    const record = {
         ...semantic,
         graph_id: `jsrg_${canonicalDigest(semantic, "JavaScript semantic graph")}`,
+    };
+    const issues = [];
+    checkGraphContent(record, {
+        addIssue: (issue) => {
+            issues.push(issue);
+        },
     });
+    if (issues.length > 0)
+        throw new z.ZodError(issues);
+    return record;
 };
+const validatedImmutableSemanticGraphs = new WeakSet();
+/** Clone and validate synchronously, then return steps to seal the owned graph. */
+export const createImmutableJavaScriptSemanticGraphSteps = (input) => sealValidatedSemanticGraphSteps(createJavaScriptSemanticGraph(input));
+function* sealValidatedSemanticGraphSteps(graph) {
+    yield* freezeOwnedJsonSnapshotSteps(graph);
+    validatedImmutableSemanticGraphs.add(graph);
+    return graph;
+}
+/** Recognize the exact completely sealed graph produced by the owned factory. */
+export const isValidatedImmutableJavaScriptSemanticGraph = (value) => typeof value === "object" &&
+    value !== null &&
+    validatedImmutableSemanticGraphs.has(value);

package/dist/domain/javascript/javascriptSemanticGraphSchemas.js

@@ -221,6 +221,7 @@ export const JAVASCRIPT_SEMANTIC_UNKNOWN_REASONS = [
     "eval-or-generated-code",
     "incomplete-module",
     "missing-source",
+    "resource-limit",
     "unsupported-syntax",
 ];
 /** One unresolved semantic frontier before its ID is derived. */