rea-agents 5.0.0 → 6.1.0

package/dist/domain/javascript/javascriptStaticAnalysisHelpers.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { posix } from "node:path";
 import { fileURLToPath } from "node:url";
 import * as t from "@babel/types";
-import { semanticStaticPropertyName } from "./javascriptAstValues.js";
+import { readExactJavaScriptLiteral, semanticStaticPropertyName, } from "./javascriptAstValues.js";
 import { compareCodePoints } from "../canonicalOrdering.js";
 export { propertyName, semanticStaticPropertyName, } from "./javascriptAstValues.js";
 /** Explicit result for source text that Babel cannot parse. */
@@ -118,10 +118,8 @@ export const staticPathResolutionContext = (node) => isFilesystemPathExpression(
 const staticPathAt = (node) => {
     if (t.isStringLiteral(node))
         return node.value;
-    if (t.isTemplateLiteral(node) && node.expressions.length === 0) {
-        const value = node.quasis[0]?.value.cooked ?? node.quasis[0]?.value.raw;
-        return value;
-    }
+    if (t.isTemplateLiteral(node) && node.expressions.length === 0)
+        return stringValue(node);
     if (t.isBinaryExpression(node, { operator: "+" })) {
         const left = staticPathAt(node.left);
         const right = staticPathAt(node.right);
@@ -347,23 +345,34 @@ const BROWSING_CONTEXT_KEYWORDS = new Set([
  * methods' case; extension methods such as WebDAV `PROPFIND` are
  * conventionally uppercase tokens.
  */
-const xhrOpenUrl = (name, methodNode, urlNode) => {
+const xhrOpenUrl = (name, methodNode, urlNode, receiverFact) => {
     const url = stringValue(urlNode);
     if (url === undefined)
         return undefined;
+    // A lexical fact is stronger than the receiver's spelling. In particular,
+    // browser Window and Document globals overload `open` with URL/content APIs.
+    if (receiverFact === "window")
+        return undefined;
     const method = stringValue(methodNode);
     // IndexedDB and Cache Storage `open` take a name and a version, so a
     // receiver spelled as storage needs a standard HTTP method literal.
-    const storage = storageKind(name) !== undefined;
+    const storage = receiverFact === "local-indexed-db" ||
+        receiverFact === "local-cache-storage" ||
+        receiverFact === "indexed-db" ||
+        receiverFact === "cache-storage" ||
+        storageKind(name) !== undefined;
     if (method === undefined)
         return storage ||
-            WINDOW_OPEN_CALL.test(name) ||
+            (receiverFact === undefined && WINDOW_OPEN_CALL.test(name)) ||
             FS_OPEN_FLAGS.has(url) ||
             BROWSING_CONTEXT_KEYWORDS.has(url.toLowerCase())
             ? undefined
             : url;
     return XHR_METHODS.has(method.toUpperCase()) ||
-        (!storage && /^[A-Z][A-Z-]*$/u.test(method))
+        ((!storage ||
+            receiverFact === "local-indexed-db" ||
+            receiverFact === "local-cache-storage") &&
+            /^[A-Z][A-Z-]*$/u.test(method))
         ? url
         : undefined;
 };
@@ -396,11 +405,13 @@ const isKeyedCollectionReceiver = (callee) => {
     return property === "headers" || property === "searchParams";
 };
 /** Select the literal URL argument for recognized network callees. */
-export const endpointArgument = (name, args, callee) => {
+export const endpointArgument = (name, args, callee, receiverFact) => {
+    if (receiverFact === "window")
+        return undefined;
     if (name === "fetch" || name.endsWith(".fetch") || name === "WebSocket")
         return stringValue(args[0]);
     if (name.endsWith(".open"))
-        return xhrOpenUrl(name, args[0], args[1]);
+        return xhrOpenUrl(name, args[0], args[1], receiverFact);
     const method = ["get", "post", "put", "patch", "delete", "request"].find((candidate) => name === candidate || name.endsWith(`.${candidate}`));
     if (method !== undefined) {
         const value = stringValue(args[0]);
@@ -462,11 +473,12 @@ const memberPropertyName = (node) => node.computed &&
  * literal without substitutions denotes the same exact string.
  */
 export const stringValue = (node) => {
-    if (t.isStringLiteral(node))
-        return node.value;
-    if (t.isTemplateLiteral(node) && node.expressions.length === 0)
-        return node.quasis[0]?.value.cooked ?? undefined;
-    return undefined;
+    if (node === null || node === undefined)
+        return undefined;
+    const literal = readExactJavaScriptLiteral(node);
+    return literal.found && typeof literal.value === "string"
+        ? literal.value
+        : undefined;
 };
 /** Return a string or numeric argument literal. */
 export const argumentValue = (node) => t.isNumericLiteral(node) ? String(node.value) : stringValue(node);

package/dist/domain/javascript/javascriptStaticAnalysisState.js

@@ -1,5 +1,6 @@
+import { JavaScriptModuleRangeIndex } from "./javascriptStaticAnalysisFindings.js";
 /** Create isolated mutable state for one source analysis. */
-export const createJavaScriptAnalysisAccumulator = () => ({
+export const createJavaScriptAnalysisAccumulator = (sourceLength) => ({
     references: [],
     endpoints: [],
     storage: [],
@@ -12,7 +13,7 @@ export const createJavaScriptAnalysisAccumulator = () => ({
     senderValidations: [],
     utilityProcesses: [],
     nativeAddonBindings: [],
-    modules: [],
+    moduleRangeIndex: new JavaScriptModuleRangeIndex(sourceLength),
     seen: new Set(),
     visitedNodes: 0,
     unknownFindings: 0,

package/dist/domain/jsonSerialization.js

@@ -0,0 +1,109 @@
+/** Encode ordinary JSON as bounded string parts without a document-sized allocation. */
+export function* jsonParts(value, pretty = false) {
+    yield* encodeValue(value, pretty, 0, new Set(), false);
+}
+/** Encode validated JSON with canonical key ordering without allocating the whole document. */
+export function* canonicalJsonParts(value) {
+    yield* encodeValue(value, false, 0, new Set(), true);
+}
+/** Buffer JSON parts while preserving complete UTF-16 surrogate pairs. */
+export function* bufferedJsonParts(parts) {
+    let buffer = "";
+    for (const part of parts) {
+        if (buffer.length + part.length > 64 * 1024 && buffer !== "") {
+            yield buffer;
+            buffer = "";
+        }
+        buffer += part;
+    }
+    if (buffer !== "")
+        yield buffer;
+}
+function* encodeString(value) {
+    if (value.length <= 8192) {
+        yield JSON.stringify(value);
+        return;
+    }
+    yield '"';
+    for (let start = 0; start < value.length;) {
+        let end = Math.min(start + 8192, value.length);
+        const last = value.charCodeAt(end - 1);
+        const next = value.charCodeAt(end);
+        // Keep a surrogate pair in the same JSON.stringify and UTF-8 write.
+        if (end < value.length &&
+            last >= 0xd800 &&
+            last <= 0xdbff &&
+            next >= 0xdc00 &&
+            next <= 0xdfff)
+            end -= 1;
+        yield JSON.stringify(value.slice(start, end)).slice(1, -1);
+        start = end;
+    }
+    yield '"';
+}
+function* encodeValue(value, pretty, depth, ancestors, canonical) {
+    if (typeof value === "string") {
+        yield* encodeString(value);
+        return;
+    }
+    if (value === null || typeof value === "boolean") {
+        yield value === null ? "null" : String(value);
+        return;
+    }
+    if (typeof value === "number" && Number.isFinite(value)) {
+        yield String(value);
+        return;
+    }
+    if (typeof value !== "object" || value === null)
+        throw new TypeError("JSON output requires ordinary JSON values");
+    if (ancestors.has(value))
+        throw new TypeError("JSON output contains a circular reference");
+    if (!Array.isArray(value) &&
+        Object.prototype.toString.call(value) !== "[object Object]")
+        throw new TypeError("JSON output requires ordinary JSON objects");
+    ancestors.add(value);
+    try {
+        const array = Array.isArray(value);
+        const keys = array ? undefined : Object.keys(value);
+        if (canonical)
+            keys?.sort();
+        const count = array ? value.length : (keys?.length ?? 0);
+        let written = 0;
+        yield array ? "[" : "{";
+        for (let index = 0; index < count; index += 1) {
+            let item;
+            let key;
+            if (array) {
+                item = value[index];
+            }
+            else {
+                key = keys?.[index];
+                if (key === undefined)
+                    throw new TypeError("JSON object changed during serialization");
+                item = Reflect.get(value, key);
+                // Incur's filter can select inherited methods. Match native JSON's
+                // omission without eagerly reading the rest of a bounded result.
+                if (item === undefined ||
+                    typeof item === "function" ||
+                    typeof item === "symbol")
+                    continue;
+            }
+            if (written > 0)
+                yield ",";
+            if (pretty)
+                yield `\n${"  ".repeat(depth + 1)}`;
+            if (key !== undefined) {
+                yield* encodeString(key);
+                yield pretty ? ": " : ":";
+            }
+            yield* encodeValue(item, pretty, depth + 1, ancestors, canonical);
+            written += 1;
+        }
+        if (pretty && written > 0)
+            yield `\n${"  ".repeat(depth)}`;
+        yield array ? "]" : "}";
+    }
+    finally {
+        ancestors.delete(value);
+    }
+}

package/dist/domain/jsonValue.js

@@ -1,5 +1,93 @@
 import { z } from "zod";
-/** JSON-safe value shared by domain, application, and adapter boundaries. */
-export const jsonValueSchema = z.json();
+import { isImmutableJsonSnapshot } from "./immutableJson.js";
+/** Maximum JSON nesting accepted before recursive result cloning. */
+export const MAX_JSON_DEPTH = 1000;
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const recordShape = z.record(z.string(), z.unknown());
+const immutableValidation = new WeakMap();
+/** Validate JSON meaning and nesting without cloning a trusted immutable value. */
+export const jsonValueValidationIssue = (root) => {
+    const steps = jsonValueValidationSteps(root);
+    for (;;) {
+        const step = steps.next();
+        if (step.done)
+            return step.value;
+    }
+};
+/** Validate JSON in bounded steps; cache only authenticated immutable roots. */
+export function* jsonValueValidationSteps(root) {
+    const immutable = typeof root === "object" && root !== null && isImmutableJsonSnapshot(root)
+        ? root
+        : undefined;
+    if (immutable !== undefined && immutableValidation.has(immutable))
+        return immutableValidation.get(immutable);
+    const finish = (issue) => {
+        if (immutable !== undefined)
+            immutableValidation.set(immutable, issue);
+        return issue;
+    };
+    const pending = [
+        { value: root, depth: 0 },
+    ];
+    let examined = 0;
+    while (pending.length > 0) {
+        if (examined++ === 4096) {
+            examined = 0;
+            yield;
+        }
+        const item = pending.pop();
+        if (item === undefined)
+            break;
+        if (item.depth > MAX_JSON_DEPTH)
+            return finish(`JSON value exceeds maximum nesting depth of ${MAX_JSON_DEPTH}`);
+        const value = item.value;
+        if (value === null ||
+            typeof value === "string" ||
+            typeof value === "boolean")
+            continue;
+        if (typeof value === "number") {
+            if (!Number.isFinite(value))
+                return finish("JSON numbers must be finite");
+        }
+        else if (Array.isArray(value)) {
+            for (const child of value)
+                pending.push({ value: child, depth: item.depth + 1 });
+        }
+        else if (isRecord(value) && recordShape.safeParse(value).success) {
+            // Inspect every own member, including keys Zod's record parser skips.
+            for (const child of Object.values(value))
+                pending.push({ value: child, depth: item.depth + 1 });
+        }
+        else
+            return finish("Invalid JSON value");
+    }
+    return finish(undefined);
+}
+const preserveJsonValue = (value) => {
+    if (Array.isArray(value))
+        return value.map(preserveJsonValue);
+    if (value !== null && typeof value === "object")
+        return Object.fromEntries(Object.entries(value).map(([key, child]) => [
+            key,
+            preserveJsonValue(child),
+        ]));
+    return value;
+};
+const validatedJsonValue = z.custom((value) => jsonValueValidationIssue(value) === undefined, {
+    error: (issue) => jsonValueValidationIssue(issue.input) ?? "Invalid JSON value",
+});
+// Keep both stages nonrecursive in public and Standard Schema projections.
+validatedJsonValue._zod.toJSONSchema = () => ({});
+/** Parse bounded JSON and retain all own data members without prototype setters. */
+export const jsonValueSchema = z
+    .unknown()
+    .nonoptional()
+    .pipe(validatedJsonValue)
+    .transform(preserveJsonValue);
+jsonValueSchema._zod.toJSONSchema = () => ({});
+const objectValidation = z.custom(isRecord, "Expected JSON object");
+const objectProjection = () => ({ type: "object", additionalProperties: {} });
+objectValidation._zod.toJSONSchema = objectProjection;
 /** JSON object boundary for caller-visible parameter maps. */
-export const jsonObjectSchema = z.record(z.string(), jsonValueSchema);
+export const jsonObjectSchema = jsonValueSchema.pipe(objectValidation);
+jsonObjectSchema._zod.toJSONSchema = objectProjection;

package/dist/domain/localPath.js

@@ -1,4 +1,12 @@
 import { isAbsolute, relative, sep } from "node:path";
+import { z } from "zod";
+/** Preserve selected filesystem names while rejecting OS-invalid NUL bytes. */
+export const localPathStringSchema = z
+    .string()
+    .min(1)
+    .regex(/^[^\0]*$/u, "Local filesystem paths cannot contain NUL");
+/** True when the value is an absolute filesystem path on the host platform. */
+export const isAbsoluteLocalPath = (value) => isAbsolute(value);
 /** Test lexical containment on the host platform; callers must resolve symlinks first. */
 export const isPathWithinRoot = (root, path) => {
     const value = relative(root, path);

package/dist/domain/managed/managedApplicationGraph.js

@@ -1,13 +1,14 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
-import { evidenceSchema, parseEvidence } from "../evidence.js";
+import { evidenceSchema } from "../evidence.js";
 import { createJavaScriptApplicationGraph, javascriptApplicationGraphSchema, } from "../javascript/javascriptApplicationGraph.js";
 import { managedArtifactInspectionSchema, managedMemberInspectionSchema, managedNativeBoundaryInspectionSchema, } from "./managedArtifact.js";
 import { assessManagedGraphOmissions, managedGraphEvidenceCoverage, managedGraphResultCoverage, } from "./managedApplicationGraphCoverage.js";
 import { addArtifactNode, addArtifactIdentityNodes, addBoundaryNodes, addMemberNodes, } from "./managedApplicationGraphNodes.js";
 import { digestSchema } from "../digests.js";
 import { prefixedDigestSchema } from "../digests.js";
+import { parseManagedInspectionEvidence } from "./managedInspectionEvidence.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const textSchema = z.string().min(1);
 /** Authenticated managed Evidence records projected into the application graph. */
@@ -121,20 +122,14 @@ export const projectManagedApplicationGraph = (input) => {
 const parseManagedInputs = (input) => ({
     artifact: input.managed_artifact === undefined
         ? null
-        : parseManagedEvidence(input.managed_artifact, "inspect_managed_artifact", managedArtifactInspectionSchema),
+        : parseManagedInspectionEvidence(input.managed_artifact, "inspect_managed_artifact", managedArtifactInspectionSchema),
     members: input.managed_members === undefined
         ? null
-        : parseManagedEvidence(input.managed_members, "inspect_managed_members", managedMemberInspectionSchema),
+        : parseManagedInspectionEvidence(input.managed_members, "inspect_managed_members", managedMemberInspectionSchema),
     boundaries: input.managed_native_boundaries === undefined
         ? null
-        : parseManagedEvidence(input.managed_native_boundaries, "inspect_managed_native_boundaries", managedNativeBoundaryInspectionSchema),
+        : parseManagedInspectionEvidence(input.managed_native_boundaries, "inspect_managed_native_boundaries", managedNativeBoundaryInspectionSchema),
 });
-const parseManagedEvidence = (rawEvidence, operation, schema) => {
-    const evidence = parseEvidence(rawEvidence);
-    if (evidence.operation !== operation)
-        throw new TypeError(`Evidence operation is not ${operation}`);
-    return { evidence, result: schema.parse(evidence.normalized_result) };
-};
 const chooseArtifact = (parsed) => {
     const result = parsed.artifact?.result ??
         parsed.members?.result ??
@@ -164,6 +159,11 @@ const projectionLimitations = (parsed, omissions) => [
             "Managed member Evidence was not supplied; type, method, and field nodes are absent.",
         ]
         : []),
+    ...(parsed.artifact === null
+        ? [
+            "Managed artifact Evidence was not supplied; assembly identity observations are absent.",
+        ]
+        : []),
     ...(parsed.boundaries === null
         ? [
             "Managed native-boundary Evidence was not supplied; P/Invoke and native-implementation nodes are absent.",

package/dist/domain/managed/managedInspectionEvidence.js

@@ -0,0 +1,16 @@
+import { parseEvidence } from "../evidence.js";
+/**
+ * Parse managed inspection Evidence and bind its artifact to any available subject.
+ * A null subject remains valid and means there is no digest to cross-check.
+ */
+export const parseManagedInspectionEvidence = (rawEvidence, operation, schema) => {
+    const evidence = parseEvidence(rawEvidence);
+    if (evidence.operation !== operation)
+        throw new TypeError(`Evidence operation is not ${operation}`);
+    const result = schema.parse(evidence.normalized_result);
+    const artifactSha256 = result.artifact.sha256;
+    const subjectSha256 = evidence.subject?.digest.sha256;
+    if (subjectSha256 !== undefined && artifactSha256 !== subjectSha256)
+        throw new TypeError(`Managed Evidence ${operation} (${evidence.evidence_id}) subject SHA-256 ${subjectSha256} does not match normalized artifact SHA-256 ${artifactSha256}`);
+    return { evidence, result };
+};

package/dist/domain/managed/managedMemberComparisonMatch.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
-import { parseEvidence } from "../evidence.js";
 import { managedMemberInspectionSchema, } from "./managedArtifact.js";
+import { parseManagedInspectionEvidence } from "./managedInspectionEvidence.js";
 export const sha256 = (value) => {
     const serialized = canonicalize(value);
     if (serialized === undefined)
@@ -10,9 +10,7 @@ export const sha256 = (value) => {
 };
 const keyMethod = (item) => ({
     item,
-    exactKey: item.signature.parse_status === "decoded" &&
-        item.body.status === "present" &&
-        item.body.normalized_il_sha256 !== null
+    exactKey: item.body.status === "present" && item.body.normalized_il_sha256 !== null
         ? stableKey([
             "method-exact",
             item.signature.raw_sha256,
@@ -173,11 +171,9 @@ export const keyMembers = (left, right) => ({
     fieldMatches: matchFields(left.result.fields.map(keyField), right.result.fields.map(keyField)),
 });
 export const parseManagedMemberEvidence = (evidence) => {
-    const parsed = parseEvidence(evidence);
-    if (parsed.operation !== "inspect_managed_members")
-        throw new TypeError("Evidence operation is not inspect_managed_members");
+    const parsed = parseManagedInspectionEvidence(evidence, "inspect_managed_members", managedMemberInspectionSchema);
     return {
-        evidenceId: parsed.evidence_id,
-        result: managedMemberInspectionSchema.parse(parsed.normalized_result),
+        evidenceId: parsed.evidence.evidence_id,
+        result: parsed.result,
     };
 };

package/dist/domain/managed/managedNativeVerification.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
-import { parseEvidence } from "../evidence.js";
 import { managedNativeBoundaryInspectionSchema, } from "./managedArtifact.js";
+import { parseManagedInspectionEvidence } from "./managedInspectionEvidence.js";
 import { managedNativeVerificationResultSchema, } from "./managedNativeVerificationSchemas.js";
 import { buildVerificationResult, collectNativeSymbols, verifyPinvoke, } from "./managedNativeVerificationMatch.js";
 export { managedNativeVerificationInputSchema, } from "./managedNativeVerificationSchemas.js";
@@ -12,16 +12,10 @@ const sha256 = (value) => {
         throw new TypeError("Managed/native verification canonicalization failed");
     return createHash("sha256").update(serialized).digest("hex");
 };
-const managedBoundaryFromInput = (input) => {
-    const managedEvidence = parseEvidence(input.managed_boundaries);
-    if (managedEvidence.operation !== "inspect_managed_native_boundaries")
-        throw new TypeError("Evidence operation is not inspect_managed_native_boundaries");
-    return managedNativeBoundaryInspectionSchema.parse(managedEvidence.normalized_result);
-};
+const parseManagedBoundary = (input) => parseManagedInspectionEvidence(input.managed_boundaries, "inspect_managed_native_boundaries", managedNativeBoundaryInspectionSchema);
 /** Verify managed P/Invoke declarations against authenticated native Evidence. */
 export const verifyManagedNativeBoundaries = (input) => {
-    const managed = managedBoundaryFromInput(input);
-    const managedEvidence = parseEvidence(input.managed_boundaries);
+    const { evidence: managedEvidence, result: managed } = parseManagedBoundary(input);
     const native = collectNativeSymbols(input.native_observations);
     const verifiedPinvokes = managed.pinvoke_imports.map((item) => verifyPinvoke({
         item,