rea-agents 6.0.0 → 6.2.0

package/dist/domain/browserScenarioCapture.js

@@ -1,7 +1,6 @@
 import { z } from "zod";
 import { browserNetworkContentSelectionValuesSchema } from "./browserNetworkEvidence.js";
 import { browserScenarioCompletenessSchema, browserScenarioEventSchema, browserScenarioStepSchema, } from "./browserScenarioCaptureValues.js";
-export { classifyBrowserScenarioCompleteness, browserScenarioEventSchema, browserScenarioStepSchema, browserStepArtifactsSchema, } from "./browserScenarioCaptureValues.js";
 /** Step-indexed browser scenario observation. */
 export const browserScenarioCaptureSchema = z
     .strictObject({
@@ -16,7 +15,7 @@ export const browserScenarioCaptureSchema = z
         start_origin: z.string().min(1),
         action_count: z.number().int().min(1),
         secret_references: z.array(z.string().min(1)),
-        network_content: browserNetworkContentSelectionValuesSchema.optional(),
+        network_content: browserNetworkContentSelectionValuesSchema,
     }),
     duration_ms: z.number().int().min(0),
     steps: z.array(browserScenarioStepSchema).min(1),

package/dist/domain/browserScenarioDiff.js

@@ -1,8 +1,6 @@
-import {} from "./browserScenarioCapture.js";
 import { actionState, artifactEvidenceState, captured, eventEvidenceState, eventsFor, networkContentCoverageReason, screenshotProjection, } from "./browserScenarioDiffEvidence.js";
 import { browserScenarioDiffSchema, } from "./browserScenarioDiffValues.js";
 import { commitBrowserScenarioNormalization, digestNormalizedScenarioValue, } from "./browserScenarioNormalization.js";
-export { browserScenarioDiffSchema, compareBrowserScenariosInputSchema, } from "./browserScenarioDiffValues.js";
 /** Compare scenario steps by stable step ID and apply only committed literal rules. */
 export const compareBrowserScenarios = (input) => {
     const normalization = commitBrowserScenarioNormalization(input.normalization);

package/dist/domain/browserScenarioDiffEvidence.js

@@ -54,18 +54,6 @@ export const eventsFor = (capture, stepIndex) => {
 export const networkContentCoverageReason = (before, after) => {
     const left = before.scenario.network_content;
     const right = after.scenario.network_content;
-    if (left === undefined || right === undefined) {
-        const events = [...before.events.items, ...after.events.items];
-        if (events.some((event) => event.kind === "network-content") ||
-            ((left === undefined) !== (right === undefined) &&
-                events.some((event) => event.kind === "request" ||
-                    event.kind === "response" ||
-                    event.kind === "request-failed" ||
-                    event.kind === "request-finished" ||
-                    event.kind === "request-unfinished")))
-            return "Network content selection is unknown in a legacy capture; capture both sides with matching content selection.";
-        return undefined;
-    }
     return left.request_body !== right.request_body ||
         left.response_body !== right.response_body ||
         left.header_values !== right.header_values

package/dist/domain/browserScenarioDiffValues.js

@@ -62,8 +62,8 @@ const normalizationInputSchema = z
 });
 /** Input for step-aligned comparison of two browser scenario captures. */
 export const compareBrowserScenariosInputSchema = z.strictObject({
-    before_scenario: browserScenarioCaptureSchema.describe("Earlier complete capture_browser_scenario result."),
-    after_scenario: browserScenarioCaptureSchema.describe("Later complete capture_browser_scenario result."),
+    before_scenario: browserScenarioCaptureSchema.describe("Earlier complete normalized_result from capture_browser_scenario."),
+    after_scenario: browserScenarioCaptureSchema.describe("Later complete normalized_result from capture_browser_scenario."),
     normalization: normalizationInputSchema
         .default({ rules: [] })
         .describe("Exact-literal rules committed in the comparison result."),

package/dist/domain/browserScenarioValues.js

@@ -1,15 +1,10 @@
 import { z } from "zod";
-import { isAbsoluteLocalPath } from "./localPath.js";
+import { IDENTIFIER_PATTERN } from "./stringPatterns.js";
+import { isAbsoluteLocalPath, localPathStringSchema } from "./localPath.js";
 import { browserNetworkContentSelectionSchema } from "./browserNetworkEvidence.js";
 import { browserEndpointSchema, browserOriginSchema, } from "./browserObservation.js";
-export const scenarioIdentifierSchema = z
-    .string()
-    .regex(/^[A-Za-z][A-Za-z0-9._-]*$/u);
-const browserExecutablePathSchema = z
-    .string()
-    .trim()
-    .min(1)
-    .refine(isAbsoluteLocalPath, {
+export const scenarioIdentifierSchema = z.string().regex(IDENTIFIER_PATTERN);
+const browserExecutablePathSchema = localPathStringSchema.refine(isAbsoluteLocalPath, {
     message: "executable_path must be an absolute local filesystem path (for example /opt/chromium/chrome or C:\\chromium\\chrome.exe)",
 });
 const browserScenarioBaseUrlSchema = z
@@ -88,7 +83,7 @@ export const browserScenarioEnvironmentSchema = z
     timezone: z
         .string()
         .min(1)
-        .regex(/^[A-Za-z0-9_+-]+(?:\/[A-Za-z0-9_+-]+)*$/u)
+        .regex(/^[A-Za-z0-9_+\x2d]+(?:\x2f[A-Za-z0-9_+\x2d]+)*$/u)
         .default("UTC"),
     color_scheme: z.enum(["light", "dark", "no-preference"]).default("light"),
     reduced_motion: z.enum(["reduce", "no-preference"]).default("reduce"),

package/dist/domain/bundleComparison.js

@@ -4,6 +4,7 @@ import { parseEvidenceBundle, serializeEvidenceBundle, } from "./evidenceBundle.
 import { digestSchema } from "./../domain/digests.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 import { comparisonStatusSchema } from "./comparisonStatus.js";
+import { localPathStringSchema } from "./localPath.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const classificationSchema = z.enum([
     "added",
@@ -15,8 +16,8 @@ const classificationSchema = z.enum([
 ]);
 /** Strict input for canonical Evidence bundle comparison. */
 export const bundleComparisonInputSchema = z.strictObject({
-    left_bundle_path: z.string().min(1),
-    right_bundle_path: z.string().min(1),
+    left_bundle_path: localPathStringSchema,
+    right_bundle_path: localPathStringSchema,
     record_pairs: z
         .array(z.object({
         left_evidence_id: evidenceIdSchema,

package/dist/domain/callPath.js

@@ -1,6 +1,5 @@
 import { callPathInputSchema, callPathResultSchema, parseCallPathAddress, } from "./callPathSchemas.js";
 import { parseFunctionEvidence, } from "./functionDossierEvidence.js";
-export { callPathInputSchema, callPathResultSchema };
 /** Minimal directed caller-to-callee adjacency for call-path search. */
 class CallGraph {
     successors = new Map();
@@ -112,8 +111,8 @@ const parseSnapshots = (groups) => {
     const snapshots = new Map();
     for (const group of groups) {
         const snapshot = parseFunctionEvidence(group);
-        const address = normalizeAddress(snapshot.procedure.address);
-        for (const callee of snapshot.collections.callees.items)
+        const address = normalizeAddress(snapshot.dossier.procedure.address);
+        for (const callee of snapshot.dossier.callees)
             normalizeAddress(callee.address);
         if (snapshots.has(address))
             throw new TypeError(`Duplicate function Evidence for ${address}`);
@@ -131,9 +130,9 @@ const assertCompatible = (snapshots) => {
             snapshot.subject.format !== first.subject.format ||
             snapshot.subject.architecture !== first.subject.architecture)
             throw new TypeError("Call-path Evidence mixes artifact subjects");
-        if (snapshot.provider.id !== first.provider.id ||
-            snapshot.provider.name !== first.provider.name ||
-            snapshot.provider.version !== first.provider.version)
+        if (snapshot.evidence.provider.id !== first.evidence.provider.id ||
+            snapshot.evidence.provider.name !== first.evidence.provider.name ||
+            snapshot.evidence.provider.version !== first.evidence.provider.version)
             throw new TypeError("Call-path Evidence mixes providers");
     }
 };
@@ -141,7 +140,7 @@ const createGraph = (snapshots) => {
     const graph = new CallGraph();
     for (const [address, snapshot] of snapshots) {
         graph.mergeNode(address);
-        for (const callee of snapshot.collections.callees.items) {
+        for (const callee of snapshot.dossier.callees) {
             const calleeAddress = normalizeAddress(callee.address);
             graph.mergeNode(calleeAddress);
             graph.mergeDirectedEdge(address, calleeAddress);
@@ -249,7 +248,7 @@ const citePath = (addresses, snapshots) => {
             (index > 0 ? snapshots.get(addresses[index - 1] ?? "") : undefined);
         return {
             address,
-            name: snapshot?.procedure.name ?? null,
+            name: snapshot?.dossier.procedure.name ?? null,
             evidence_links: snapshotLinks(supporting),
         };
     });
@@ -267,7 +266,7 @@ const citePath = (addresses, snapshots) => {
 const snapshotLinks = (snapshot) => {
     if (snapshot === undefined)
         throw new TypeError("Every call-path claim requires supporting Evidence");
-    return snapshot.evidence.map(({ evidence_id }) => evidence_id);
+    return [snapshot.evidence.evidence_id];
 };
 const uniqueEvidence = (snapshots) => [
     ...new Set([...snapshots].flatMap((snapshot) => snapshotLinks(snapshot))),

package/dist/domain/callPathSchemas.js

@@ -4,10 +4,10 @@ import { evidenceSchema } from "./evidence.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 const addressSchema = z
     .string()
-    .regex(/^(?:(?:[A-Za-z0-9._~-]|%[0-9A-F]{2})+:)?0x(?:0|[1-9a-f][0-9a-f]*)$/u);
+    .regex(/^(?:(?:[A-Za-z0-9._~\x2d]|%[0-9A-F]{2})+:)?0x(?:0|[1-9a-f][0-9a-f]*)$/u);
 const inputAddressSchema = z
     .string()
-    .regex(/^(?:(?:[A-Za-z0-9._~-]|%[0-9a-fA-F]{2})+:)?0[xX][0-9a-fA-F]+$/u)
+    .regex(/^(?:(?:[A-Za-z0-9._~\x2d]|%[0-9a-fA-F]{2})+:)?0[xX][0-9a-fA-F]+$/u)
     .transform((address) => {
     const separator = address.lastIndexOf(":") + 1;
     const space = address

package/dist/domain/canonicalJsonDigestSteps.js

@@ -0,0 +1,133 @@
+import { createHash } from "node:crypto";
+/** Hash owned, validated JSON in bounded steps without a document-sized string. */
+export function* canonicalJsonDigestSteps(value) {
+    const hash = createHash("sha256");
+    const ancestors = new Set();
+    const stack = [{ kind: "value", value }];
+    let buffered = "";
+    let flushed = false;
+    const emit = (part) => {
+        buffered += part;
+        if (buffered.length >= 8192) {
+            hash.update(buffered);
+            buffered = "";
+            flushed = true;
+        }
+    };
+    try {
+        while (stack.length > 0) {
+            if (flushed) {
+                flushed = false;
+                yield;
+            }
+            const frame = stack.pop();
+            if (frame === undefined)
+                break;
+            if (frame.kind === "separator") {
+                emit(":");
+                continue;
+            }
+            if (frame.kind === "string") {
+                if (frame.index === frame.value.length) {
+                    emit('"');
+                    continue;
+                }
+                let end = Math.min(frame.index + 8192, frame.value.length);
+                const last = frame.value.charCodeAt(end - 1);
+                const next = frame.value.charCodeAt(end);
+                if (end < frame.value.length &&
+                    last >= 0xd800 &&
+                    last <= 0xdbff &&
+                    next >= 0xdc00 &&
+                    next <= 0xdfff)
+                    end -= 1;
+                emit(JSON.stringify(frame.value.slice(frame.index, end)).slice(1, -1));
+                frame.index = end;
+                stack.push(frame);
+                continue;
+            }
+            if (frame.kind === "array") {
+                if (frame.index === frame.length) {
+                    emit("]");
+                    ancestors.delete(frame.value);
+                    continue;
+                }
+                const item = frame.value[frame.index];
+                if (item === undefined)
+                    throw new TypeError("Canonical JSON digest requires dense JSON arrays");
+                if (frame.index++ > 0)
+                    emit(",");
+                stack.push(frame, { kind: "value", value: item });
+                continue;
+            }
+            if (frame.kind === "object") {
+                if (frame.index === frame.keys.length) {
+                    emit("}");
+                    ancestors.delete(frame.value);
+                    continue;
+                }
+                const key = frame.keys[frame.index++];
+                if (key === undefined)
+                    throw new TypeError("Canonical JSON object changed during hashing");
+                const item = frame.value[key];
+                if (item === undefined)
+                    continue;
+                if (frame.written++ > 0)
+                    emit(",");
+                if (key.length > 8192) {
+                    emit('"');
+                    stack.push(frame, { kind: "value", value: item }, { kind: "separator" }, { kind: "string", value: key, index: 0 });
+                    continue;
+                }
+                emit(JSON.stringify(key));
+                emit(":");
+                stack.push(frame, { kind: "value", value: item });
+                continue;
+            }
+            const item = frame.value;
+            if (typeof item === "string" && item.length > 8192) {
+                emit('"');
+                stack.push({ kind: "string", value: item, index: 0 });
+            }
+            else if (item === null || typeof item !== "object") {
+                if (typeof item === "number" && !Number.isFinite(item))
+                    throw new Error(Number.isNaN(item)
+                        ? "NaN is not allowed"
+                        : "Infinity is not allowed");
+                emit(JSON.stringify(item));
+            }
+            else {
+                if (ancestors.has(item))
+                    throw new Error("Circular reference detected");
+                ancestors.add(item);
+                if (Array.isArray(item)) {
+                    emit("[");
+                    stack.push({
+                        kind: "array",
+                        value: item,
+                        length: item.length,
+                        index: 0,
+                    });
+                }
+                else {
+                    emit("{");
+                    stack.push({
+                        kind: "object",
+                        value: item,
+                        keys: Object.keys(item).sort(),
+                        index: 0,
+                        written: 0,
+                    });
+                }
+            }
+        }
+        if (buffered !== "")
+            hash.update(buffered);
+        return hash.digest("hex");
+    }
+    finally {
+        stack.length = 0;
+        ancestors.clear();
+        buffered = "";
+    }
+}

package/dist/domain/canonicalOrdering.js

@@ -1,11 +1,15 @@
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 /**
  * Canonical code-point ordering shared across domain and application layers.
  *
- * Compares strings by Unicode code point (`<`/`>`) so graph ordering,
- * fingerprints, and deterministic tie-breaks stay stable regardless of
- * locale. Prefer this over `String.prototype.localeCompare`, which is
- * locale-dependent.
+ * Compares strings by Unicode code point so graph ordering, fingerprints, and
+ * deterministic tie-breaks stay stable regardless of locale. Prefer this over
+ * `String.prototype.localeCompare`, which is locale-dependent.
+ *
+ * Ordering by code point differs from ordering by UTF-16 code unit for astral
+ * code points (above U+FFFF), whose lead surrogate is numerically below the
+ * BMP tail U+E000-U+FFFF.
  */
-export const compareCodePoints = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+export const compareCodePoints = (left, right) => compareUnicodeCodePoints(left, right);
 /** Deduplicate and sort strings with canonical code-point ordering. */
 export const uniqueSorted = (values) => [...new Set(values)].sort(compareCodePoints);

package/dist/domain/changedBehavior.js

@@ -1,15 +1,16 @@
 import { z } from "zod";
 import { artifactComparisonResultSchema } from "./artifactComparison.js";
 import { uniqueSorted } from "./canonicalOrdering.js";
+import { comparisonSourceEvidenceIds } from "./comparisonSourceEvidence.js";
 import { evidenceSchema, parseEvidence } from "./evidence.js";
-import { functionComparisonResultSchema } from "./functionComparison.js";
+import { functionComparisonResultSchema } from "./functionComparisonSchemas.js";
 import { PROCESS_PROVIDER, isProcessEvidenceProvider, } from "./process/processEvidenceProvider.js";
-import { comparisonStatusSchema, deriveProcessComparisonStatus, PROCESS_COMPARISON_DIMENSIONS, processCaptureComparisonSchema, } from "./process/processCapture.js";
+import { comparisonStatusSchema, deriveProcessComparisonStatus, PROCESS_COMPARISON_DIMENSIONS, processCaptureComparisonSchema, } from "./process/processComparison.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 /** Input for aggregating existing comparison Evidence. */
 export const changedBehaviorInputSchema = z.strictObject({
-    comparisons: z.array(evidenceSchema).default([]),
+    comparisons: z.array(evidenceSchema).min(1),
 });
 const findingSchema = z.object({
     scope: z.enum(["runtime", "protocol", "resource", "static_candidate"]),
@@ -22,7 +23,7 @@ const findingSchema = z.object({
     ]),
     status: comparisonStatusSchema,
     source_comparison_id: evidenceIdSchema,
-    evidence_links: z.array(evidenceIdSchema).min(3),
+    evidence_links: z.array(evidenceIdSchema).min(2),
     limitations: z.array(z.string()),
 });
 /** Truthful aggregate: runtime observations remain separate from static candidates. */
@@ -43,7 +44,7 @@ export const changedBehaviorResultSchema = z
     findings: z.object({
         items: z.array(findingSchema),
     }),
-    evidence_links: z.array(evidenceIdSchema).min(3),
+    evidence_links: z.array(evidenceIdSchema).min(2),
     limitations: z.array(z.string()),
 })
     .superRefine((result, context) => {
@@ -141,9 +142,8 @@ const parseComparisonEvidence = (input) => {
         evidence.authority !== "analyst-inference" ||
         evidence.subject !== null)
         throw new TypeError("Comparison Evidence operation, predicate, and provider disagree");
-    if (evidence.evidence_links.length < 2)
-        throw new TypeError("Comparison Evidence must cite both source observations");
-    assertUnique(evidence.evidence_links, "source Evidence links");
+    if (!comparisonSourceEvidenceIds(evidence).every((id) => evidence.evidence_links.includes(id)))
+        throw new TypeError("Comparison Evidence must cite both selected source observations");
     parseResult(evidence);
     return evidence;
 };
@@ -209,7 +209,7 @@ const functionFindings = (evidence) => {
                 dimension: dimension.dimension,
                 scope: "static_candidate",
                 status: dimension.status,
-                classification: dimension.status === "unknown" || dimension.status === "truncated"
+                classification: dimension.status === "unknown"
                     ? "unresolved_branch"
                     : dimension.conclusion_kind,
                 limitations: dimension.limitations,

package/dist/domain/comparisonSourceEvidence.js

@@ -0,0 +1,40 @@
+import { z } from "zod";
+import { uniqueSorted } from "./canonicalOrdering.js";
+import { prefixedDigestSchema } from "./digests.js";
+const evidenceIdSchema = prefixedDigestSchema("ev");
+const sideParametersSchema = z.object({
+    left_evidence_id: evidenceIdSchema.optional(),
+    right_evidence_id: evidenceIdSchema.optional(),
+    left_evidence_ids: z.array(evidenceIdSchema).min(1).optional(),
+    right_evidence_ids: z.array(evidenceIdSchema).min(1).optional(),
+});
+/** Resolve each selected side and validate aliases and duplicates within that role. */
+export const comparisonSourceEvidenceSides = (evidence) => {
+    const parameters = sideParametersSchema.parse(evidence.parameters);
+    if ((parameters.left_evidence_id === undefined) !==
+        (parameters.right_evidence_id === undefined) ||
+        (parameters.left_evidence_ids === undefined) !==
+            (parameters.right_evidence_ids === undefined))
+        throw new TypeError("Comparison Evidence source representation omitted one side");
+    const side = (single, multiple) => {
+        if (single !== undefined &&
+            multiple !== undefined &&
+            (multiple.length !== 1 || multiple[0] !== single))
+            throw new TypeError("Comparison Evidence source representations disagree");
+        const selected = single === undefined ? (multiple ?? []) : [single];
+        if (selected.length === 0)
+            throw new TypeError("Comparison Evidence omitted its source parameters");
+        if (new Set(selected).size !== selected.length)
+            throw new TypeError("Comparison Evidence repeats a source within one side");
+        return selected;
+    };
+    return {
+        left: side(parameters.left_evidence_id, parameters.left_evidence_ids),
+        right: side(parameters.right_evidence_id, parameters.right_evidence_ids),
+    };
+};
+/** Resolve the source closure without counting observations shared by both roles twice. */
+export const comparisonSourceEvidenceIds = (evidence) => {
+    const sides = comparisonSourceEvidenceSides(evidence);
+    return uniqueSorted([...sides.left, ...sides.right]);
+};

package/dist/domain/completionLedgerGeneration.js

@@ -1,10 +1,11 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
+import { IDENTIFIER_PATTERN } from "./stringPatterns.js";
 import { createEvidenceCompletionLedger, evidenceCompletionRecordSchema, } from "./evidenceCompletionLedger.js";
 import { digestSchema } from "./../domain/digests.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
-const identifierSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9._-]*$/u);
+const identifierSchema = z.string().regex(IDENTIFIER_PATTERN);
 const identitySchema = z.strictObject({
     id: identifierSchema,
     version: z.string().min(1),

package/dist/domain/configurationErrors.js

@@ -1,7 +1,12 @@
-import { AnalysisError } from "./analysisErrorBase.js";
+import { AnalysisError, } from "./analysisErrorBase.js";
 /** Runtime configuration could not be parsed safely. */
 export class ConfigurationError extends AnalysisError {
     _tag = "ConfigurationError";
+    settings;
+    constructor(message, options) {
+        super(message, options);
+        this.settings = (options?.settings ?? []).map(({ setting, constraint }) => ({ setting, constraint }));
+    }
 }
 /** No app or binary session exists for an analysis request. */
 export class NoBinaryOpenError extends AnalysisError {
@@ -16,10 +21,17 @@ export class BinaryTargetError extends AnalysisError {
     reason;
     _tag = "BinaryTargetError";
     constraint;
+    /** The OS read-permission code of the cause, when the host denied access. */
+    systemCode;
     constructor(path, reason, options) {
         super(`Cannot open artifact: ${reason}`, options);
         this.path = path;
         this.reason = reason;
         this.constraint = options?.constraint;
+        this.systemCode = readPermissionCode(options?.cause);
     }
 }
+const readPermissionCode = (cause) => {
+    const code = cause instanceof Error ? Reflect.get(cause, "code") : undefined;
+    return code === "EACCES" || code === "EPERM" ? code : undefined;
+};

package/dist/domain/conformancePackage.js

@@ -1,12 +1,13 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
-import { evidenceEnvelopeSchema } from "./evidence.js";
+import { IDENTIFIER_PATTERN } from "./stringPatterns.js";
+import { evidenceSchema } from "./evidence.js";
 import { evidenceBundleSchema } from "./evidenceBundle.js";
 import { err, ok } from "./result.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 const conformancePackageIdSchema = prefixedDigestSchema("cp");
-const scenarioIdSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9._-]*$/u);
+const scenarioIdSchema = z.string().regex(IDENTIFIER_PATTERN);
 const scenarioManifestSchema = z.strictObject({
     scenario_id: scenarioIdSchema,
     name: z.string().min(1),
@@ -45,7 +46,7 @@ const shimPlanSchema = z.strictObject({
 const expectedEvidenceSchema = z.strictObject({
     scenario_id: scenarioIdSchema,
     /** Expected evidence envelopes. */
-    envelopes: z.array(evidenceEnvelopeSchema),
+    envelopes: z.array(evidenceSchema),
     /** Expected evidence bundle. */
     bundle: evidenceBundleSchema.nullable(),
     /** Required dimensions that must be present in the evidence. */