rea-agents 6.0.0 → 6.2.0

package/dist/domain/javascript/javascriptStaticAnalysisBundler.js

@@ -104,13 +104,15 @@ const recoverBundlerModule = (source, property, accumulator) => {
     const exportsValue = collectJavaScriptExports(factory);
     const requireName = factoryRequireName(factory);
     const asyncChunks = collectBundlerAsyncChunkKeys(factory, requireName);
-    if (typeof factory.start === "number" && typeof factory.end === "number")
-        accumulator.modules.push({
+    if (typeof factory.start === "number" && typeof factory.end === "number") {
+        const moduleRange = {
             start: factory.start,
             end: factory.end,
             key,
             requireName,
-        });
+        };
+        accumulator.moduleRangeIndex.add(moduleRange);
+    }
     return {
         module: {
             module_key: key,

package/dist/domain/javascript/javascriptStaticAnalysisCalls.js

@@ -1,13 +1,14 @@
 import * as t from "@babel/types";
 import { sanitizeEndpointCandidate } from "../browserObservation.js";
-import { addFindingOnce, addLocatedFinding, moduleAtOffset, } from "./javascriptStaticAnalysisFindings.js";
-import { STATIC_ROUTE_CALL_NAMES, argumentValue, calleeName, endpointArgument as endpointArgumentHelper, prefixedArgument, semanticStaticPropertyName, range, rangeForOffsets, sourceSlice, staticPath, staticPathResolutionContext, storageKind, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
+import { addFindingOnce, addLocatedFinding, } from "./javascriptStaticAnalysisFindings.js";
+import { STATIC_ROUTE_CALL_NAMES, argumentValue, calleeName, endpointArgument as endpointArgumentHelper, prefixedArgument, range, rangeForOffsets, sourceSlice, staticPath, staticPathResolutionContext, storageKind, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
+import { semanticStaticPropertyName } from "./javascriptAstValues.js";
 /** Inspect one call or new expression for references, endpoints, storage, and roles. */
 export const inspectCall = (source, node, context) => {
     const { accumulator } = context;
     const name = calleeName(node.callee);
     const first = stringValue(node.arguments[0]);
-    const module = moduleAtOffset(node.start, context.accumulator.modules);
+    const module = context.accumulator.moduleRangeIndex.find(node.start);
     const moduleRequireName = module?.requireName ?? null;
     const requireCall = requireCallSpecifier(node, name, moduleRequireName);
     if (requireCall !== null)
@@ -103,7 +104,8 @@ const inspectEndpointCall = (node, name, first, context) => {
             value: first,
             mechanism: `call:${name}`,
         });
-    const endpoint = endpointArgumentHelper(name, node.arguments, node.callee);
+    const receiverFact = context.openReceiverFacts?.get(node.start ?? -1);
+    const endpoint = endpointArgumentHelper(name, node.arguments, node.callee, receiverFact);
     if (endpoint !== undefined)
         addEndpoint(context, {
             node,
@@ -143,7 +145,16 @@ export const inspectRoleProperty = (node, context) => {
     });
 };
 const inspectStorageCall = (node, name, first, context) => {
-    const storage = storageKind(name);
+    const receiverFact = context.openReceiverFacts?.get(node.start ?? -1);
+    const storage = receiverFact === "local" ||
+        receiverFact === "local-indexed-db" ||
+        receiverFact === "local-cache-storage"
+        ? undefined
+        : receiverFact === "indexed-db"
+            ? "indexed-db"
+            : receiverFact === "cache-storage"
+                ? "cache-storage"
+                : storageKind(name);
     if (storage === undefined)
         return;
     addLocatedFinding(context, {

package/dist/domain/javascript/javascriptStaticAnalysisFindings.js

@@ -1,3 +1,68 @@
+/** Incremental point lookup preserving insertion-order precedence for overlaps. */
+export class JavaScriptModuleRangeIndex {
+    root = {};
+    end;
+    nextOrder = 0;
+    /** Create an empty offset index bounded by the analyzed source length. */
+    constructor(sourceLength) {
+        this.end = Math.max(1, sourceLength + 1);
+    }
+    /** Add a module range in the same discovery order used by the analysis pass. */
+    add(range) {
+        const indexed = { order: this.nextOrder, range };
+        this.nextOrder += 1;
+        const start = Math.max(0, range.start);
+        const end = Math.min(this.end, range.end + 1);
+        if (start < end)
+            this.insert(this.root, 0, this.end, start, end, indexed);
+    }
+    /** Return the first discovered inclusive range containing an offset. */
+    find(offset) {
+        if (offset === null ||
+            offset === undefined ||
+            !Number.isSafeInteger(offset) ||
+            offset < 0 ||
+            offset >= this.end)
+            return undefined;
+        let node = this.root;
+        let low = 0;
+        let high = this.end;
+        let best;
+        while (node !== undefined) {
+            if (node.best !== undefined &&
+                (best === undefined || node.best.order < best.order))
+                best = node.best;
+            if (high - low <= 1)
+                break;
+            const middle = low + Math.floor((high - low) / 2);
+            if (offset < middle) {
+                node = node.left;
+                high = middle;
+            }
+            else {
+                node = node.right;
+                low = middle;
+            }
+        }
+        return best?.range;
+    }
+    insert(node, low, high, queryLow, queryHigh, value) {
+        if (queryLow <= low && high <= queryHigh) {
+            if (node.best === undefined || value.order < node.best.order)
+                node.best = value;
+            return;
+        }
+        const middle = low + Math.floor((high - low) / 2);
+        if (queryLow < middle) {
+            node.left ??= {};
+            this.insert(node.left, low, middle, queryLow, queryHigh, value);
+        }
+        if (queryHigh > middle) {
+            node.right ??= {};
+            this.insert(node.right, middle, high, queryLow, queryHigh, value);
+        }
+    }
+}
 /** Add one module-attributable finding once per source location. */
 export const addLocatedFinding = (context, input) => addFindingOnce(context.accumulator, `${input.key}\0${String(input.node.start)}`, () => input.collection.push({
     offset: input.node.start ?? -1,
@@ -13,11 +78,5 @@ export const addFindingOnce = (accumulator, key, add) => {
 /** Attach recovered bundle-module ownership to findings after traversal. */
 export const finalizeLocatedFindings = (values, modules) => values.map(({ offset, value }) => ({
     ...value,
-    module_key: moduleAtOffset(offset, modules)?.key ?? null,
+    module_key: modules.find(offset)?.key ?? null,
 }));
-/** Locate the recovered bundle factory containing one exact source offset. */
-export const moduleAtOffset = (offset, modules) => {
-    if (offset === null || offset === undefined)
-        return undefined;
-    return modules.find(({ start, end }) => offset >= start && offset <= end);
-};

package/dist/domain/javascript/javascriptStaticAnalysisHelpers.js

@@ -2,9 +2,8 @@ import { createHash } from "node:crypto";
 import { posix } from "node:path";
 import { fileURLToPath } from "node:url";
 import * as t from "@babel/types";
-import { semanticStaticPropertyName } from "./javascriptAstValues.js";
+import { readExactJavaScriptLiteral, semanticStaticPropertyName, } from "./javascriptAstValues.js";
 import { compareCodePoints } from "../canonicalOrdering.js";
-export { propertyName, semanticStaticPropertyName, } from "./javascriptAstValues.js";
 /** Explicit result for source text that Babel cannot parse. */
 export const failedJavaScriptStaticAnalysis = () => ({
     parse_status: "failed",
@@ -118,10 +117,8 @@ export const staticPathResolutionContext = (node) => isFilesystemPathExpression(
 const staticPathAt = (node) => {
     if (t.isStringLiteral(node))
         return node.value;
-    if (t.isTemplateLiteral(node) && node.expressions.length === 0) {
-        const value = node.quasis[0]?.value.cooked ?? node.quasis[0]?.value.raw;
-        return value;
-    }
+    if (t.isTemplateLiteral(node) && node.expressions.length === 0)
+        return stringValue(node);
     if (t.isBinaryExpression(node, { operator: "+" })) {
         const left = staticPathAt(node.left);
         const right = staticPathAt(node.right);
@@ -347,23 +344,34 @@ const BROWSING_CONTEXT_KEYWORDS = new Set([
  * methods' case; extension methods such as WebDAV `PROPFIND` are
  * conventionally uppercase tokens.
  */
-const xhrOpenUrl = (name, methodNode, urlNode) => {
+const xhrOpenUrl = (name, methodNode, urlNode, receiverFact) => {
     const url = stringValue(urlNode);
     if (url === undefined)
         return undefined;
+    // A lexical fact is stronger than the receiver's spelling. In particular,
+    // browser Window and Document globals overload `open` with URL/content APIs.
+    if (receiverFact === "window")
+        return undefined;
     const method = stringValue(methodNode);
     // IndexedDB and Cache Storage `open` take a name and a version, so a
     // receiver spelled as storage needs a standard HTTP method literal.
-    const storage = storageKind(name) !== undefined;
+    const storage = receiverFact === "local-indexed-db" ||
+        receiverFact === "local-cache-storage" ||
+        receiverFact === "indexed-db" ||
+        receiverFact === "cache-storage" ||
+        storageKind(name) !== undefined;
     if (method === undefined)
         return storage ||
-            WINDOW_OPEN_CALL.test(name) ||
+            (receiverFact === undefined && WINDOW_OPEN_CALL.test(name)) ||
             FS_OPEN_FLAGS.has(url) ||
             BROWSING_CONTEXT_KEYWORDS.has(url.toLowerCase())
             ? undefined
             : url;
     return XHR_METHODS.has(method.toUpperCase()) ||
-        (!storage && /^[A-Z][A-Z-]*$/u.test(method))
+        ((!storage ||
+            receiverFact === "local-indexed-db" ||
+            receiverFact === "local-cache-storage") &&
+            /^[A-Z][A-Z-]*$/u.test(method))
         ? url
         : undefined;
 };
@@ -396,11 +404,13 @@ const isKeyedCollectionReceiver = (callee) => {
     return property === "headers" || property === "searchParams";
 };
 /** Select the literal URL argument for recognized network callees. */
-export const endpointArgument = (name, args, callee) => {
+export const endpointArgument = (name, args, callee, receiverFact) => {
+    if (receiverFact === "window")
+        return undefined;
     if (name === "fetch" || name.endsWith(".fetch") || name === "WebSocket")
         return stringValue(args[0]);
     if (name.endsWith(".open"))
-        return xhrOpenUrl(name, args[0], args[1]);
+        return xhrOpenUrl(name, args[0], args[1], receiverFact);
     const method = ["get", "post", "put", "patch", "delete", "request"].find((candidate) => name === candidate || name.endsWith(`.${candidate}`));
     if (method !== undefined) {
         const value = stringValue(args[0]);
@@ -462,11 +472,12 @@ const memberPropertyName = (node) => node.computed &&
  * literal without substitutions denotes the same exact string.
  */
 export const stringValue = (node) => {
-    if (t.isStringLiteral(node))
-        return node.value;
-    if (t.isTemplateLiteral(node) && node.expressions.length === 0)
-        return node.quasis[0]?.value.cooked ?? undefined;
-    return undefined;
+    if (node === null || node === undefined)
+        return undefined;
+    const literal = readExactJavaScriptLiteral(node);
+    return literal.found && typeof literal.value === "string"
+        ? literal.value
+        : undefined;
 };
 /** Return a string or numeric argument literal. */
 export const argumentValue = (node) => t.isNumericLiteral(node) ? String(node.value) : stringValue(node);

package/dist/domain/javascript/javascriptStaticAnalysisState.js

@@ -1,5 +1,6 @@
+import { JavaScriptModuleRangeIndex } from "./javascriptStaticAnalysisFindings.js";
 /** Create isolated mutable state for one source analysis. */
-export const createJavaScriptAnalysisAccumulator = () => ({
+export const createJavaScriptAnalysisAccumulator = (sourceLength) => ({
     references: [],
     endpoints: [],
     storage: [],
@@ -12,7 +13,7 @@ export const createJavaScriptAnalysisAccumulator = () => ({
     senderValidations: [],
     utilityProcesses: [],
     nativeAddonBindings: [],
-    modules: [],
+    moduleRangeIndex: new JavaScriptModuleRangeIndex(sourceLength),
     seen: new Set(),
     visitedNodes: 0,
     unknownFindings: 0,

package/dist/domain/javascript/sourceToBundleComparison.js

@@ -1,7 +1,7 @@
 import { compareCodePoints, uniqueSorted } from "../canonicalOrdering.js";
 import { absenceClaimable, canonicalDigest } from "../comparisonSemantics.js";
 import { SOURCE_TO_BUNDLE_SIGNAL_WEIGHTS, sourceToBundleComparisonResultSchema, } from "./sourceToBundleComparisonSchemas.js";
-import { buildSourceToBundleCandidateIndex, candidateIdsForSource, historicalSourceFiles, scoreSourceToBundleCandidate, sourceBearingNodes, } from "./sourceToBundleSignals.js";
+import { buildSourceToBundleCandidateIndex, candidateHasDigest, candidateIdsForSource, historicalSourceFiles, scoreSourceToBundleCandidate, sourceBearingNodes, } from "./sourceToBundleSignals.js";
 /** Compare historical source files to static source-bearing application nodes. */
 export const compareSourceToBundle = (input) => {
     const projection = projectComparison(input);
@@ -63,7 +63,7 @@ const compareMappings = (input, projection) => {
             .map((nodeId) => scoreSourceToBundleCandidate(source, nodeId, projection.index))
             .filter((candidate) => candidate !== null)
             .sort(compareCandidates);
-        const classification = classifyMapping(scored, projection.absenceComplete);
+        const classification = classifyMapping(scored, projection.absenceComplete, (nodeId) => source.sha256 !== null && candidateHasDigest(projection.index, nodeId));
         const semantic = {
             source_path: source.path,
             source_sha256: source.sha256,
@@ -103,7 +103,7 @@ const scoringModel = () => ({
         weight,
     })),
 });
-const classifyMapping = (candidates, absenceComplete) => {
+const classifyMapping = (candidates, absenceComplete, digestComparable) => {
     const exact = candidates.filter((candidate) => hasSignal(candidate, "exact-source-digest"));
     if (exact.length === 1)
         return {
@@ -134,6 +134,15 @@ const classifyMapping = (candidates, absenceComplete) => {
         : pathCandidates.filter(({ score }) => score === topScore);
     if (topPathCandidates.length === 1) {
         const candidate = topPathCandidates[0];
+        if (candidate !== undefined && digestComparable(candidate.current_node_id))
+            return {
+                status: "modified",
+                confidence: candidate.confidence === "high" ? "high" : "medium",
+                currentNodeIds: [candidate.current_node_id],
+                limitations: [
+                    "Location evidence links the source to the current node, but their source digests differ.",
+                ],
+            };
         return {
             status: "unknown",
             confidence: "unknown",

package/dist/domain/javascript/sourceToBundleSignals.js

@@ -39,7 +39,9 @@ export const buildSourceToBundleCandidateIndex = (nodes) => {
         for (const digest of projection.digests)
             addIndexValue(byDigest, digest, projection.node.node_id);
         for (const path of projection.paths) {
-            for (const suffix of pathSuffixes(path.value))
+            for (const suffix of path.allowSuffix
+                ? pathSuffixes(path.value)
+                : [path.value])
                 addIndexValue(byPathSuffix, suffix, projection.node.node_id);
             addIndexValue(byBasename, posix.basename(path.value), projection.node.node_id);
         }
@@ -72,6 +74,8 @@ export const candidateIdsForSource = (source, index) => {
     }
     return output;
 };
+/** Whether an indexed candidate carries any content digest to compare. */
+export const candidateHasDigest = (index, nodeId) => (index.nodes.get(nodeId)?.digests.size ?? 0) > 0;
 /** Score one indexed candidate from explicit, caller-visible signals. */
 export const scoreSourceToBundleCandidate = (source, nodeId, index) => {
     const projection = index.nodes.get(nodeId);
@@ -97,16 +101,26 @@ const projectCurrentNode = (node) => {
     if (node.identity.strategy === "source-map-original") {
         if (node.identity.source_sha256 !== null)
             digests.add(node.identity.source_sha256);
-        addPath(paths, "source-map-original", node.identity.original_source);
     }
     if (node.identity.strategy === "canonical-path")
         addPath(paths, "canonical-path", node.identity.path);
     for (const observation of node.observations) {
-        const sourceDigest = observation.properties.source_sha256;
-        if (typeof sourceDigest === "string" && isDigest(sourceDigest))
-            digests.add(sourceDigest);
-        for (const key of PATH_PROPERTIES)
-            addJsonPath(paths, observation.properties[key]);
+        if (node.identity.strategy === "source-map-original") {
+            const resolution = observation.source_map_reference?.resolution;
+            if (resolution !== undefined && resolution.kind !== "unresolved")
+                paths.push({
+                    kind: "source-map-original",
+                    value: resolution.path,
+                    allowSuffix: resolution.kind === "suffix",
+                });
+        }
+        else {
+            const sourceDigest = observation.properties.source_sha256;
+            if (typeof sourceDigest === "string" && isDigest(sourceDigest))
+                digests.add(sourceDigest);
+            for (const key of PATH_PROPERTIES)
+                addJsonPath(paths, observation.properties[key]);
+        }
     }
     return {
         node,
@@ -128,7 +142,9 @@ const candidateSignals = (source, current) => {
     if (exactPaths.length > 0)
         signals.push(signal("current-path-exact", source.path, exactPaths));
     const suffixPaths = otherPaths
-        .filter(({ value }) => value !== source.path && value.endsWith(`/${source.path}`))
+        .filter(({ value, allowSuffix }) => allowSuffix &&
+        value !== source.path &&
+        value.endsWith(`/${source.path}`))
         .map(({ value }) => value);
     if (suffixPaths.length > 0)
         signals.push(signal("current-path-suffix", source.path, suffixPaths));
@@ -161,7 +177,8 @@ const candidateConfidence = (signals) => {
     return kinds.has("current-path-suffix") ? "medium" : "low";
 };
 const matchingPaths = (sourcePath, currentPaths) => currentPaths
-    .filter(({ value }) => value === sourcePath || value.endsWith(`/${sourcePath}`))
+    .filter(({ value, allowSuffix }) => value === sourcePath ||
+    (allowSuffix && value.endsWith(`/${sourcePath}`)))
     .map(({ value }) => value);
 const addJsonPath = (paths, value) => {
     if (typeof value === "string")
@@ -170,27 +187,38 @@ const addJsonPath = (paths, value) => {
 const addPath = (paths, kind, raw) => {
     const value = normalizeCurrentPath(raw);
     if (value !== null)
-        paths.push({ kind, value });
+        paths.push({ kind, value, allowSuffix: true });
 };
-/** Matches a `scheme://...` URL prefix; bare filesystem paths keep `?`/`#`. */
 const SCHEME_URL = /^[a-z][a-z0-9+.-]*:\/\//iu;
-/** Matches a `scheme://...` URL prefix with any run of slashes, for stripping. */
 const SCHEME_URL_PREFIX = /^[a-z][a-z0-9+.-]*:\/\/+/iu;
 const normalizeCurrentPath = (raw) => {
     const withoutQuery = SCHEME_URL.test(raw)
         ? (raw.split(/[?#]/u, 1)[0] ?? "")
         : raw;
-    const withoutScheme = withoutQuery.replace(SCHEME_URL_PREFIX, "");
-    const parts = withoutScheme
-        .replaceAll("\\", "/")
-        .split("/")
-        .filter((part) => part !== "" && part !== ".");
-    if (parts.length === 0 || parts.includes(".."))
+    const portable = withoutQuery
+        .replace(SCHEME_URL_PREFIX, "")
+        .replaceAll("\\", "/");
+    const parts = [];
+    for (const part of portable.split("/")) {
+        if (part === "" || part === ".")
+            continue;
+        if (part === "..") {
+            if (parts.length === 0)
+                return null;
+            parts.pop();
+        }
+        else
+            parts.push(part);
+    }
+    if (parts.length === 0)
         return null;
     return parts.join("/");
 };
 const uniquePaths = (paths) => [
-    ...new Map(paths.map((path) => [`${path.kind}\0${path.value}`, path])).values(),
+    ...new Map(paths.map((path) => [
+        `${path.kind}\0${path.value}\0${String(path.allowSuffix)}`,
+        path,
+    ])).values(),
 ].sort((left, right) => compareCodePoints(`${left.kind}\0${left.value}`, `${right.kind}\0${right.value}`));
 const pathSuffixes = (path) => {
     const parts = path.split("/");

package/dist/domain/jsonSerialization.js

@@ -0,0 +1,109 @@
+/** Encode ordinary JSON as bounded string parts without a document-sized allocation. */
+export function* jsonParts(value, pretty = false) {
+    yield* encodeValue(value, pretty, 0, new Set(), false);
+}
+/** Encode validated JSON with canonical key ordering without allocating the whole document. */
+export function* canonicalJsonParts(value) {
+    yield* encodeValue(value, false, 0, new Set(), true);
+}
+/** Buffer JSON parts while preserving complete UTF-16 surrogate pairs. */
+export function* bufferedJsonParts(parts) {
+    let buffer = "";
+    for (const part of parts) {
+        if (buffer.length + part.length > 64 * 1024 && buffer !== "") {
+            yield buffer;
+            buffer = "";
+        }
+        buffer += part;
+    }
+    if (buffer !== "")
+        yield buffer;
+}
+function* encodeString(value) {
+    if (value.length <= 8192) {
+        yield JSON.stringify(value);
+        return;
+    }
+    yield '"';
+    for (let start = 0; start < value.length;) {
+        let end = Math.min(start + 8192, value.length);
+        const last = value.charCodeAt(end - 1);
+        const next = value.charCodeAt(end);
+        // Keep a surrogate pair in the same JSON.stringify and UTF-8 write.
+        if (end < value.length &&
+            last >= 0xd800 &&
+            last <= 0xdbff &&
+            next >= 0xdc00 &&
+            next <= 0xdfff)
+            end -= 1;
+        yield JSON.stringify(value.slice(start, end)).slice(1, -1);
+        start = end;
+    }
+    yield '"';
+}
+function* encodeValue(value, pretty, depth, ancestors, canonical) {
+    if (typeof value === "string") {
+        yield* encodeString(value);
+        return;
+    }
+    if (value === null || typeof value === "boolean") {
+        yield value === null ? "null" : String(value);
+        return;
+    }
+    if (typeof value === "number" && Number.isFinite(value)) {
+        yield String(value);
+        return;
+    }
+    if (typeof value !== "object" || value === null)
+        throw new TypeError("JSON output requires ordinary JSON values");
+    if (ancestors.has(value))
+        throw new TypeError("JSON output contains a circular reference");
+    if (!Array.isArray(value) &&
+        Object.prototype.toString.call(value) !== "[object Object]")
+        throw new TypeError("JSON output requires ordinary JSON objects");
+    ancestors.add(value);
+    try {
+        const array = Array.isArray(value);
+        const keys = array ? undefined : Object.keys(value);
+        if (canonical)
+            keys?.sort();
+        const count = array ? value.length : (keys?.length ?? 0);
+        let written = 0;
+        yield array ? "[" : "{";
+        for (let index = 0; index < count; index += 1) {
+            let item;
+            let key;
+            if (array) {
+                item = value[index];
+            }
+            else {
+                key = keys?.[index];
+                if (key === undefined)
+                    throw new TypeError("JSON object changed during serialization");
+                item = Reflect.get(value, key);
+                // Incur's filter can select inherited methods. Match native JSON's
+                // omission without eagerly reading the rest of a bounded result.
+                if (item === undefined ||
+                    typeof item === "function" ||
+                    typeof item === "symbol")
+                    continue;
+            }
+            if (written > 0)
+                yield ",";
+            if (pretty)
+                yield `\n${"  ".repeat(depth + 1)}`;
+            if (key !== undefined) {
+                yield* encodeString(key);
+                yield pretty ? ": " : ":";
+            }
+            yield* encodeValue(item, pretty, depth + 1, ancestors, canonical);
+            written += 1;
+        }
+        if (pretty && written > 0)
+            yield `\n${"  ".repeat(depth)}`;
+        yield array ? "]" : "}";
+    }
+    finally {
+        ancestors.delete(value);
+    }
+}

package/dist/domain/jsonValue.js

@@ -1,9 +1,93 @@
 import { z } from "zod";
-/** JSON-safe value shared by domain, application, and adapter boundaries. */
-export const jsonValueSchema = z.json();
-// Every JSON value satisfies `{}`. Advertise that instead of Zod's
-// self-referential `$defs` projection, which MCP clients and model APIs that
-// reject recursive JSON Schemas refuse. Runtime parsing still admits only JSON.
+import { isImmutableJsonSnapshot } from "./immutableJson.js";
+/** Maximum JSON nesting accepted before recursive result cloning. */
+export const MAX_JSON_DEPTH = 1000;
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const recordShape = z.record(z.string(), z.unknown());
+const immutableValidation = new WeakMap();
+/** Validate JSON meaning and nesting without cloning a trusted immutable value. */
+export const jsonValueValidationIssue = (root) => {
+    const steps = jsonValueValidationSteps(root);
+    for (;;) {
+        const step = steps.next();
+        if (step.done)
+            return step.value;
+    }
+};
+/** Validate JSON in bounded steps; cache only authenticated immutable roots. */
+export function* jsonValueValidationSteps(root) {
+    const immutable = typeof root === "object" && root !== null && isImmutableJsonSnapshot(root)
+        ? root
+        : undefined;
+    if (immutable !== undefined && immutableValidation.has(immutable))
+        return immutableValidation.get(immutable);
+    const finish = (issue) => {
+        if (immutable !== undefined)
+            immutableValidation.set(immutable, issue);
+        return issue;
+    };
+    const pending = [
+        { value: root, depth: 0 },
+    ];
+    let examined = 0;
+    while (pending.length > 0) {
+        if (examined++ === 4096) {
+            examined = 0;
+            yield;
+        }
+        const item = pending.pop();
+        if (item === undefined)
+            break;
+        if (item.depth > MAX_JSON_DEPTH)
+            return finish(`JSON value exceeds maximum nesting depth of ${MAX_JSON_DEPTH}`);
+        const value = item.value;
+        if (value === null ||
+            typeof value === "string" ||
+            typeof value === "boolean")
+            continue;
+        if (typeof value === "number") {
+            if (!Number.isFinite(value))
+                return finish("JSON numbers must be finite");
+        }
+        else if (Array.isArray(value)) {
+            for (const child of value)
+                pending.push({ value: child, depth: item.depth + 1 });
+        }
+        else if (isRecord(value) && recordShape.safeParse(value).success) {
+            // Inspect every own member, including keys Zod's record parser skips.
+            for (const child of Object.values(value))
+                pending.push({ value: child, depth: item.depth + 1 });
+        }
+        else
+            return finish("Invalid JSON value");
+    }
+    return finish(undefined);
+}
+const preserveJsonValue = (value) => {
+    if (Array.isArray(value))
+        return value.map(preserveJsonValue);
+    if (value !== null && typeof value === "object")
+        return Object.fromEntries(Object.entries(value).map(([key, child]) => [
+            key,
+            preserveJsonValue(child),
+        ]));
+    return value;
+};
+const validatedJsonValue = z.custom((value) => jsonValueValidationIssue(value) === undefined, {
+    error: (issue) => jsonValueValidationIssue(issue.input) ?? "Invalid JSON value",
+});
+// Keep both stages nonrecursive in public and Standard Schema projections.
+validatedJsonValue._zod.toJSONSchema = () => ({});
+/** Parse bounded JSON and retain all own data members without prototype setters. */
+export const jsonValueSchema = z
+    .unknown()
+    .nonoptional()
+    .pipe(validatedJsonValue)
+    .transform(preserveJsonValue);
 jsonValueSchema._zod.toJSONSchema = () => ({});
+const objectValidation = z.custom(isRecord, "Expected JSON object");
+const objectProjection = () => ({ type: "object", additionalProperties: {} });
+objectValidation._zod.toJSONSchema = objectProjection;
 /** JSON object boundary for caller-visible parameter maps. */
-export const jsonObjectSchema = z.record(z.string(), jsonValueSchema);
+export const jsonObjectSchema = jsonValueSchema.pipe(objectValidation);
+jsonObjectSchema._zod.toJSONSchema = objectProjection;

package/dist/domain/localPath.js

@@ -1,4 +1,10 @@
 import { isAbsolute, relative, sep } from "node:path";
+import { z } from "zod";
+/** Preserve selected filesystem names while rejecting OS-invalid NUL bytes. */
+export const localPathStringSchema = z
+    .string()
+    .min(1)
+    .regex(/^[^\u0000]*$/u, "Local filesystem paths cannot contain NUL");
 /** True when the value is an absolute filesystem path on the host platform. */
 export const isAbsoluteLocalPath = (value) => isAbsolute(value);
 /** Test lexical containment on the host platform; callers must resolve symlinks first. */