rea-agents 6.1.0 → 6.2.0

package/dist/domain/artifactOperationError.js

@@ -1,4 +1,4 @@
-import { AnalysisError } from "./analysisErrorBase.js";
+import { AnalysisError, } from "./analysisErrorBase.js";
 /** Artifact inventory or extraction failed a typed safety boundary. */
 export class ArtifactOperationError extends AnalysisError {
     operation;
@@ -8,10 +8,10 @@ export class ArtifactOperationError extends AnalysisError {
     _tag = "ArtifactOperationError";
     constructor(operation, reason, artifactDetails, 
     /** The specific constraint that failed, such as the colliding path. */
-    detail) {
+    detail, options) {
         super(artifactDetails === undefined
             ? `Artifact ${operation} failed: ${reason}`
-            : `Artifact ${operation} failed: ${reason} at ${artifactDetails.logicalPath} (declared_sha256=${artifactDetails.declaredSha256 ?? "unavailable"}, calculated_sha256=${artifactDetails.calculatedSha256 ?? "unavailable"}, unpacked=${String(artifactDetails.unpacked)})`);
+            : `Artifact ${operation} failed: ${reason} at ${artifactDetails.logicalPath} (declared_sha256=${artifactDetails.declaredSha256 ?? "unavailable"}, calculated_sha256=${artifactDetails.calculatedSha256 ?? "unavailable"}, unpacked=${String(artifactDetails.unpacked)})`, options);
         this.operation = operation;
         this.reason = reason;
         this.artifactDetails = artifactDetails;

package/dist/domain/artifactPartialObservation.js

@@ -0,0 +1 @@
+export {};

package/dist/domain/artifactPathSyntax.js

@@ -24,3 +24,52 @@ export const stripQueryAndFragment = (value) => value.split("#", 1)[0]?.split("?
 export const admitsCanonicalPathSyntax = (value) => !value.includes("\0") &&
     !value.includes("\\") &&
     !/%(?:2e|2f|5c)/iu.test(value);
+/** C0 controls and space, which the URL parser strips around its input. */
+const isUrlTrimmed = (code) => code <= 0x20;
+/**
+ * The URL text a browser parses from an HTML URL attribute: HTML strips
+ * surrounding ASCII whitespace, and the URL parser strips surrounding C0
+ * controls and spaces and removes every tab and newline.
+ */
+export const htmlUrlText = (value) => {
+    let start = 0;
+    let end = value.length;
+    while (start < end && isUrlTrimmed(value.charCodeAt(start)))
+        start += 1;
+    while (end > start && isUrlTrimmed(value.charCodeAt(end - 1)))
+        end -= 1;
+    return value.slice(start, end).replace(/[\t\n\r]/gu, "");
+};
+const UTF8 = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+const UTF8_ENCODER = new TextEncoder();
+/**
+ * Percent-decode a URL path as the URL standard does: valid `%XX` sequences
+ * become bytes and any other `%` stays literal. Returns null when the bytes
+ * are not UTF-8 or include NUL, because no canonical artifact path can match
+ * them. Callers refuse encoded dot and separator bytes before decoding.
+ */
+export const percentDecodeUrlPath = (value) => {
+    if (!/%[0-9a-f]{2}/iu.test(value))
+        return value;
+    const bytes = [];
+    for (let index = 0; index < value.length;) {
+        const escape = value.slice(index, index + 3);
+        if (/^%[0-9a-f]{2}$/iu.test(escape)) {
+            bytes.push(Number.parseInt(escape.slice(1), 16));
+            index += 3;
+            continue;
+        }
+        const character = String.fromCodePoint(value.codePointAt(index) ?? 0);
+        bytes.push(...UTF8_ENCODER.encode(character));
+        index += character.length;
+    }
+    try {
+        const decoded = UTF8.decode(new Uint8Array(bytes));
+        return decoded.includes("\0") ? null : decoded;
+    }
+    catch (cause) {
+        // Invalid UTF-8 cannot name an inventoried path.
+        void cause;
+        return null;
+    }
+};

package/dist/domain/binaryTarget.js

@@ -7,32 +7,38 @@ import { mzWindowsHeaderOffset, parseDosMzHeader } from "./dosMz.js";
 export const parseExecutableHeader = (bytes, hostArchitecture, fileSize = bytes.length) => {
     if (bytes.length >= 4 &&
         bytes.subarray(0, 4).equals(Buffer.from([0x7f, 0x45, 0x4c, 0x46])))
-        return parseElf(bytes);
+        return parseElf(bytes, fileSize);
     if (bytes.length >= 2 && bytes[0] === 0x4d && bytes[1] === 0x5a)
         return parseMz(bytes, fileSize);
     if (bytes.length < 8)
         return err("truncated or unsupported binary header");
     const magic = bytes.readUInt32BE(0);
     if ([0xfeedface, 0xfeedfacf, 0xcefaedfe, 0xcffaedfe].includes(magic))
-        return parseThinMachO(bytes, magic);
+        return parseThinMachO(bytes, magic, fileSize);
     if ([0xcafebabe, 0xbebafeca, 0xcafebabf, 0xbfbafeca].includes(magic))
-        return parseFatMachO(bytes, magic, hostArchitecture);
+        return parseFatMachO(bytes, magic, hostArchitecture, fileSize);
     return err("unsupported binary format");
 };
-const parseThinMachO = (bytes, magic) => {
-    if (bytes.length < 8)
-        return err("truncated Mach-O header");
+const parseThinMachO = (bytes, magic, fileSize) => {
+    const is64 = magic === 0xfeedfacf || magic === 0xcffaedfe;
+    const headerSize = is64 ? 32 : 28;
+    if (bytes.length < headerSize)
+        return err(`truncated Mach-O header: a ${is64 ? 64 : 32}-bit header needs ${headerSize} bytes; the file has ${fileSize}`);
     const little = magic === 0xcefaedfe || magic === 0xcffaedfe;
-    const architecture = machArchitecture(little ? bytes.readUInt32LE(4) : bytes.readUInt32BE(4));
+    const read = (offset) => little ? bytes.readUInt32LE(offset) : bytes.readUInt32BE(offset);
+    const architecture = machArchitecture(read(4));
     if (architecture === undefined)
         return err("unsupported Mach-O architecture");
+    const commandBytes = read(20);
+    if (headerSize + commandBytes > fileSize)
+        return err(`truncated Mach-O load commands: the header declares ${commandBytes} bytes after its ${headerSize}-byte header; the file has ${fileSize}`);
     return ok({
         format: "mach-o",
         architecture,
         availableArchitectures: [architecture],
     });
 };
-const parseFatMachO = (bytes, magic, host) => {
+const parseFatMachO = (bytes, magic, host, fileSize) => {
     const little = magic === 0xbebafeca || magic === 0xbfbafeca;
     const is64 = magic === 0xcafebabf || magic === 0xbfbafeca;
     if (bytes.length < 8)
@@ -43,10 +49,24 @@ const parseFatMachO = (bytes, magic, host) => {
     if (count === 0 || count > 128 || bytes.length < 8 + count * entrySize)
         return err("truncated or invalid FAT architecture table");
     const architectures = [];
+    const sliceEnds = new Map();
     for (let index = 0; index < count; index += 1) {
-        const architecture = machArchitecture(read(8 + index * entrySize));
-        if (architecture !== undefined && !architectures.includes(architecture))
-            architectures.push(architecture);
+        const entry = 8 + index * entrySize;
+        const architecture = machArchitecture(read(entry));
+        if (architecture === undefined || architectures.includes(architecture))
+            continue;
+        architectures.push(architecture);
+        const offset = is64
+            ? little
+                ? bytes.readBigUInt64LE(entry + 8)
+                : bytes.readBigUInt64BE(entry + 8)
+            : BigInt(read(entry + 8));
+        const size = is64
+            ? little
+                ? bytes.readBigUInt64LE(entry + 16)
+                : bytes.readBigUInt64BE(entry + 16)
+            : BigInt(read(entry + 12));
+        sliceEnds.set(architecture, offset + size);
     }
     const preferred = host === "arm64"
         ? "arm64"
@@ -59,20 +79,26 @@ const parseFatMachO = (bytes, magic, host) => {
                     : undefined;
     if (preferred === undefined || !architectures.includes(preferred))
         return err(`FAT binary has no host-compatible ${host} architecture`);
+    const sliceEnd = sliceEnds.get(preferred) ?? 0n;
+    if (sliceEnd > BigInt(fileSize))
+        return err(`truncated FAT slice: the ${preferred} slice ends at byte ${sliceEnd}; the file has ${fileSize}`);
     return ok({
         format: "mach-o",
         architecture: preferred,
         availableArchitectures: architectures,
     });
 };
-const parseElf = (bytes) => {
-    if (bytes.length < 20)
+const parseElf = (bytes, fileSize) => {
+    if (bytes.length < 6)
         return err("truncated ELF header");
     if (bytes[4] !== 1 && bytes[4] !== 2)
         return err("unsupported ELF class");
     const little = bytes[5] === 1;
     if (!little && bytes[5] !== 2)
         return err("unsupported ELF endianness");
+    const headerSize = bytes[4] === 1 ? 52 : 64;
+    if (bytes.length < headerSize)
+        return err(`truncated ELF header: an ELF${bytes[4] === 1 ? 32 : 64} header needs ${headerSize} bytes; the file has ${fileSize}`);
     const machine = little ? bytes.readUInt16LE(18) : bytes.readUInt16BE(18);
     const architecture = elfArchitecture(machine);
     if (architecture === undefined)

package/dist/domain/browserCaptureComparison.js

@@ -1,41 +1,14 @@
 import { z } from "zod";
-import { browserScenarioDiffSchema, compareBrowserScenarios, compareBrowserScenariosInputSchema, } from "./browserScenarioDiff.js";
-import { compareWebCaptures, captureSnapshotSchema, webCaptureDiffSchema, } from "./webCaptureDiff.js";
-/** Caller-visible object schema for passive and scenario capture comparisons. */
-export const browserCaptureComparisonInputSchema = z
-    .strictObject({
-    before: captureSnapshotSchema
-        .optional()
-        .describe("Earlier passive web-page capture."),
-    after: captureSnapshotSchema
-        .optional()
-        .describe("Later passive web-page capture."),
-    before_scenario: compareBrowserScenariosInputSchema.shape.before_scenario
-        .optional()
-        .describe("Earlier browser scenario capture."),
-    after_scenario: compareBrowserScenariosInputSchema.shape.after_scenario
-        .optional()
-        .describe("Later browser scenario capture."),
-    normalization: compareBrowserScenariosInputSchema.shape.normalization
-        .unwrap()
-        .optional()
-        .describe("Exact-literal normalization policy."),
-})
-    .superRefine((input, context) => {
-    const passive = input.before !== undefined && input.after !== undefined;
-    const scenario = input.before_scenario !== undefined && input.after_scenario !== undefined;
-    const passiveFieldsPresent = input.before !== undefined || input.after !== undefined;
-    const scenarioFieldsPresent = input.before_scenario !== undefined ||
-        input.after_scenario !== undefined ||
-        input.normalization !== undefined;
-    if (passive && !scenarioFieldsPresent)
-        return;
-    if (scenario && !passiveFieldsPresent)
-        return;
-    context.addIssue({
-        code: "custom",
-        message: "Provide before and after passive captures, or before_scenario, after_scenario, and normalization; do not mix comparison types.",
-    });
+import { compareBrowserScenarios } from "./browserScenarioDiff.js";
+import { compareWebCaptures } from "./webCaptureDiff.js";
+import { browserScenarioDiffSchema, compareBrowserScenariosInputSchema, } from "./browserScenarioDiffValues.js";
+import { compareWebCapturesInputSchema, webCaptureDiffSchema, } from "./webCaptureDiffSchemas.js";
+/** Mutually exclusive passive and scenario capture comparison inputs. */
+export const browserCaptureComparisonInputSchema = z.union([compareWebCapturesInputSchema, compareBrowserScenariosInputSchema], {
+    // Standard Schema clients expose the union message, not its branch errors.
+    error: (issue) => issue.code === "invalid_union"
+        ? z.prettifyError(new z.ZodError(issue.errors.flat()))
+        : undefined,
 });
 /** Result from passive page or browser scenario comparison. */
 export const browserCaptureComparisonSchema = z.union([
@@ -43,15 +16,6 @@ export const browserCaptureComparisonSchema = z.union([
     webCaptureDiffSchema,
 ]);
 /** Dispatch a parsed capture comparison to its pure domain comparator. */
-export const compareBrowserCaptures = (input) => isScenarioComparison(input)
-    ? compareBrowserScenarios({
-        ...input,
-        normalization: input.normalization ?? { rules: [] },
-    })
-    : compareWebCaptures(toPassiveComparison(input));
-const isScenarioComparison = (input) => input.before_scenario !== undefined && input.after_scenario !== undefined;
-const toPassiveComparison = (input) => {
-    if (input.before === undefined || input.after === undefined)
-        throw new Error("Validated passive comparison is missing a capture");
-    return { before: input.before, after: input.after };
-};
+export const compareBrowserCaptures = (input) => "before_scenario" in input
+    ? compareBrowserScenarios(input)
+    : compareWebCaptures(input);

package/dist/domain/browserNetworkEvidence.js

@@ -1,13 +1,19 @@
 import { createHash } from "node:crypto";
 import { z } from "zod";
-/** Caller-selected network content; omission retains metadata alone. */
+/** Resolved network content selection recorded by a capture. */
 export const browserNetworkContentSelectionValuesSchema = z.strictObject({
+    request_body: z.boolean(),
+    response_body: z.boolean(),
+    header_values: z.boolean(),
+});
+/** Caller omission selects metadata alone; individual content facets remain optional. */
+export const browserNetworkContentSelectionSchema = browserNetworkContentSelectionValuesSchema
+    .extend({
     request_body: z.boolean().default(false),
     response_body: z.boolean().default(false),
     header_values: z.boolean().default(false),
-});
-/** Input omission selects metadata without defaulting legacy capture coverage. */
-export const browserNetworkContentSelectionSchema = browserNetworkContentSelectionValuesSchema.default({
+})
+    .default({
     request_body: false,
     response_body: false,
     header_values: false,

package/dist/domain/browserObservation.js

@@ -1,5 +1,4 @@
 import { z } from "zod";
-export { browserTargetListSchema, webPageInspectionSchema, } from "./browserObservationSchemas.js";
 const parseExactOrigin = (value) => {
     let url;
     try {

package/dist/domain/browserObservationSchemas.js

@@ -81,9 +81,20 @@ const browserScriptSchema = z.object({
     frame_id: z.string().nullable().default(null),
     url: z.string(),
     origin: z.string().nullable(),
-    cdp_hash: z.string(),
-    length: z.number().int().min(0),
-    is_module: z.boolean(),
+    cdp_hash: z
+        .string()
+        .nullable()
+        .describe("Producer-reported script hash; null when unavailable."),
+    length: z
+        .number()
+        .int()
+        .min(0)
+        .nullable()
+        .describe("Producer-reported script length; null when unavailable."),
+    is_module: z
+        .boolean()
+        .nullable()
+        .describe("Producer-reported module classification; null when unavailable."),
     language: z.string().nullable(),
     source_map_url: z.string().nullable(),
     resource_reconciliation: browserResourceReconciliationSchema,

package/dist/domain/browserScenario.js

@@ -1,6 +1,5 @@
 import { z } from "zod";
 import { browserScenarioActionSchema, browserScenarioBrowserSchema, browserScenarioCaptureSchema, browserScenarioEnvironmentSchema, browserScenarioSecretSchema, browserScenarioStorageSchema, browserScenarioUrlSchema, } from "./browserScenarioValues.js";
-export {} from "./browserScenarioValues.js";
 export const browserScenarioInputSchema = z.strictObject({
     browser: browserScenarioBrowserSchema.describe("Required launch/connect selection. Launch uses the selected executable and an owned temporary profile; connect uses one loopback CDP endpoint and target."),
     start_url: browserScenarioUrlSchema.describe("Required initial HTTP(S) URL. Query values must be declared separately as public literals or secret references."),

package/dist/domain/browserScenarioCapture.js

@@ -1,7 +1,6 @@
 import { z } from "zod";
 import { browserNetworkContentSelectionValuesSchema } from "./browserNetworkEvidence.js";
 import { browserScenarioCompletenessSchema, browserScenarioEventSchema, browserScenarioStepSchema, } from "./browserScenarioCaptureValues.js";
-export { classifyBrowserScenarioCompleteness, browserScenarioEventSchema, browserScenarioStepSchema, browserStepArtifactsSchema, } from "./browserScenarioCaptureValues.js";
 /** Step-indexed browser scenario observation. */
 export const browserScenarioCaptureSchema = z
     .strictObject({
@@ -16,7 +15,7 @@ export const browserScenarioCaptureSchema = z
         start_origin: z.string().min(1),
         action_count: z.number().int().min(1),
         secret_references: z.array(z.string().min(1)),
-        network_content: browserNetworkContentSelectionValuesSchema.optional(),
+        network_content: browserNetworkContentSelectionValuesSchema,
     }),
     duration_ms: z.number().int().min(0),
     steps: z.array(browserScenarioStepSchema).min(1),

package/dist/domain/browserScenarioDiff.js

@@ -1,8 +1,6 @@
-import {} from "./browserScenarioCapture.js";
 import { actionState, artifactEvidenceState, captured, eventEvidenceState, eventsFor, networkContentCoverageReason, screenshotProjection, } from "./browserScenarioDiffEvidence.js";
 import { browserScenarioDiffSchema, } from "./browserScenarioDiffValues.js";
 import { commitBrowserScenarioNormalization, digestNormalizedScenarioValue, } from "./browserScenarioNormalization.js";
-export { browserScenarioDiffSchema, compareBrowserScenariosInputSchema, } from "./browserScenarioDiffValues.js";
 /** Compare scenario steps by stable step ID and apply only committed literal rules. */
 export const compareBrowserScenarios = (input) => {
     const normalization = commitBrowserScenarioNormalization(input.normalization);

package/dist/domain/browserScenarioDiffEvidence.js

@@ -54,18 +54,6 @@ export const eventsFor = (capture, stepIndex) => {
 export const networkContentCoverageReason = (before, after) => {
     const left = before.scenario.network_content;
     const right = after.scenario.network_content;
-    if (left === undefined || right === undefined) {
-        const events = [...before.events.items, ...after.events.items];
-        if (events.some((event) => event.kind === "network-content") ||
-            ((left === undefined) !== (right === undefined) &&
-                events.some((event) => event.kind === "request" ||
-                    event.kind === "response" ||
-                    event.kind === "request-failed" ||
-                    event.kind === "request-finished" ||
-                    event.kind === "request-unfinished")))
-            return "Network content selection is unknown in a legacy capture; capture both sides with matching content selection.";
-        return undefined;
-    }
     return left.request_body !== right.request_body ||
         left.response_body !== right.response_body ||
         left.header_values !== right.header_values

package/dist/domain/browserScenarioDiffValues.js

@@ -62,8 +62,8 @@ const normalizationInputSchema = z
 });
 /** Input for step-aligned comparison of two browser scenario captures. */
 export const compareBrowserScenariosInputSchema = z.strictObject({
-    before_scenario: browserScenarioCaptureSchema.describe("Earlier complete capture_browser_scenario result."),
-    after_scenario: browserScenarioCaptureSchema.describe("Later complete capture_browser_scenario result."),
+    before_scenario: browserScenarioCaptureSchema.describe("Earlier complete normalized_result from capture_browser_scenario."),
+    after_scenario: browserScenarioCaptureSchema.describe("Later complete normalized_result from capture_browser_scenario."),
     normalization: normalizationInputSchema
         .default({ rules: [] })
         .describe("Exact-literal rules committed in the comparison result."),

package/dist/domain/browserScenarioValues.js

@@ -1,10 +1,9 @@
 import { z } from "zod";
+import { IDENTIFIER_PATTERN } from "./stringPatterns.js";
 import { isAbsoluteLocalPath, localPathStringSchema } from "./localPath.js";
 import { browserNetworkContentSelectionSchema } from "./browserNetworkEvidence.js";
 import { browserEndpointSchema, browserOriginSchema, } from "./browserObservation.js";
-export const scenarioIdentifierSchema = z
-    .string()
-    .regex(/^[A-Za-z][A-Za-z0-9._-]*$/u);
+export const scenarioIdentifierSchema = z.string().regex(IDENTIFIER_PATTERN);
 const browserExecutablePathSchema = localPathStringSchema.refine(isAbsoluteLocalPath, {
     message: "executable_path must be an absolute local filesystem path (for example /opt/chromium/chrome or C:\\chromium\\chrome.exe)",
 });
@@ -84,7 +83,7 @@ export const browserScenarioEnvironmentSchema = z
     timezone: z
         .string()
         .min(1)
-        .regex(/^[A-Za-z0-9_+-]+(?:\/[A-Za-z0-9_+-]+)*$/u)
+        .regex(/^[A-Za-z0-9_+\x2d]+(?:\x2f[A-Za-z0-9_+\x2d]+)*$/u)
         .default("UTC"),
     color_scheme: z.enum(["light", "dark", "no-preference"]).default("light"),
     reduced_motion: z.enum(["reduce", "no-preference"]).default("reduce"),

package/dist/domain/callPath.js

@@ -1,6 +1,5 @@
 import { callPathInputSchema, callPathResultSchema, parseCallPathAddress, } from "./callPathSchemas.js";
 import { parseFunctionEvidence, } from "./functionDossierEvidence.js";
-export { callPathInputSchema, callPathResultSchema };
 /** Minimal directed caller-to-callee adjacency for call-path search. */
 class CallGraph {
     successors = new Map();
@@ -112,8 +111,8 @@ const parseSnapshots = (groups) => {
     const snapshots = new Map();
     for (const group of groups) {
         const snapshot = parseFunctionEvidence(group);
-        const address = normalizeAddress(snapshot.procedure.address);
-        for (const callee of snapshot.collections.callees.items)
+        const address = normalizeAddress(snapshot.dossier.procedure.address);
+        for (const callee of snapshot.dossier.callees)
             normalizeAddress(callee.address);
         if (snapshots.has(address))
             throw new TypeError(`Duplicate function Evidence for ${address}`);
@@ -131,9 +130,9 @@ const assertCompatible = (snapshots) => {
             snapshot.subject.format !== first.subject.format ||
             snapshot.subject.architecture !== first.subject.architecture)
             throw new TypeError("Call-path Evidence mixes artifact subjects");
-        if (snapshot.provider.id !== first.provider.id ||
-            snapshot.provider.name !== first.provider.name ||
-            snapshot.provider.version !== first.provider.version)
+        if (snapshot.evidence.provider.id !== first.evidence.provider.id ||
+            snapshot.evidence.provider.name !== first.evidence.provider.name ||
+            snapshot.evidence.provider.version !== first.evidence.provider.version)
             throw new TypeError("Call-path Evidence mixes providers");
     }
 };
@@ -141,7 +140,7 @@ const createGraph = (snapshots) => {
     const graph = new CallGraph();
     for (const [address, snapshot] of snapshots) {
         graph.mergeNode(address);
-        for (const callee of snapshot.collections.callees.items) {
+        for (const callee of snapshot.dossier.callees) {
             const calleeAddress = normalizeAddress(callee.address);
             graph.mergeNode(calleeAddress);
             graph.mergeDirectedEdge(address, calleeAddress);
@@ -249,7 +248,7 @@ const citePath = (addresses, snapshots) => {
             (index > 0 ? snapshots.get(addresses[index - 1] ?? "") : undefined);
         return {
             address,
-            name: snapshot?.procedure.name ?? null,
+            name: snapshot?.dossier.procedure.name ?? null,
             evidence_links: snapshotLinks(supporting),
         };
     });
@@ -267,7 +266,7 @@ const citePath = (addresses, snapshots) => {
 const snapshotLinks = (snapshot) => {
     if (snapshot === undefined)
         throw new TypeError("Every call-path claim requires supporting Evidence");
-    return snapshot.evidence.map(({ evidence_id }) => evidence_id);
+    return [snapshot.evidence.evidence_id];
 };
 const uniqueEvidence = (snapshots) => [
     ...new Set([...snapshots].flatMap((snapshot) => snapshotLinks(snapshot))),

package/dist/domain/callPathSchemas.js

@@ -4,10 +4,10 @@ import { evidenceSchema } from "./evidence.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 const addressSchema = z
     .string()
-    .regex(/^(?:(?:[A-Za-z0-9._~-]|%[0-9A-F]{2})+:)?0x(?:0|[1-9a-f][0-9a-f]*)$/u);
+    .regex(/^(?:(?:[A-Za-z0-9._~\x2d]|%[0-9A-F]{2})+:)?0x(?:0|[1-9a-f][0-9a-f]*)$/u);
 const inputAddressSchema = z
     .string()
-    .regex(/^(?:(?:[A-Za-z0-9._~-]|%[0-9a-fA-F]{2})+:)?0[xX][0-9a-fA-F]+$/u)
+    .regex(/^(?:(?:[A-Za-z0-9._~\x2d]|%[0-9a-fA-F]{2})+:)?0[xX][0-9a-fA-F]+$/u)
     .transform((address) => {
     const separator = address.lastIndexOf(":") + 1;
     const space = address

package/dist/domain/changedBehavior.js

@@ -3,9 +3,9 @@ import { artifactComparisonResultSchema } from "./artifactComparison.js";
 import { uniqueSorted } from "./canonicalOrdering.js";
 import { comparisonSourceEvidenceIds } from "./comparisonSourceEvidence.js";
 import { evidenceSchema, parseEvidence } from "./evidence.js";
-import { functionComparisonResultSchema } from "./functionComparison.js";
+import { functionComparisonResultSchema } from "./functionComparisonSchemas.js";
 import { PROCESS_PROVIDER, isProcessEvidenceProvider, } from "./process/processEvidenceProvider.js";
-import { comparisonStatusSchema, deriveProcessComparisonStatus, PROCESS_COMPARISON_DIMENSIONS, processCaptureComparisonSchema, } from "./process/processCapture.js";
+import { comparisonStatusSchema, deriveProcessComparisonStatus, PROCESS_COMPARISON_DIMENSIONS, processCaptureComparisonSchema, } from "./process/processComparison.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 /** Input for aggregating existing comparison Evidence. */
@@ -209,7 +209,7 @@ const functionFindings = (evidence) => {
                 dimension: dimension.dimension,
                 scope: "static_candidate",
                 status: dimension.status,
-                classification: dimension.status === "unknown" || dimension.status === "truncated"
+                classification: dimension.status === "unknown"
                     ? "unresolved_branch"
                     : dimension.conclusion_kind,
                 limitations: dimension.limitations,

package/dist/domain/completionLedgerGeneration.js

@@ -1,10 +1,11 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
+import { IDENTIFIER_PATTERN } from "./stringPatterns.js";
 import { createEvidenceCompletionLedger, evidenceCompletionRecordSchema, } from "./evidenceCompletionLedger.js";
 import { digestSchema } from "./../domain/digests.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
-const identifierSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9._-]*$/u);
+const identifierSchema = z.string().regex(IDENTIFIER_PATTERN);
 const identitySchema = z.strictObject({
     id: identifierSchema,
     version: z.string().min(1),

package/dist/domain/configurationErrors.js

@@ -2,6 +2,11 @@ import { AnalysisError, } from "./analysisErrorBase.js";
 /** Runtime configuration could not be parsed safely. */
 export class ConfigurationError extends AnalysisError {
     _tag = "ConfigurationError";
+    settings;
+    constructor(message, options) {
+        super(message, options);
+        this.settings = (options?.settings ?? []).map(({ setting, constraint }) => ({ setting, constraint }));
+    }
 }
 /** No app or binary session exists for an analysis request. */
 export class NoBinaryOpenError extends AnalysisError {
@@ -16,10 +21,17 @@ export class BinaryTargetError extends AnalysisError {
     reason;
     _tag = "BinaryTargetError";
     constraint;
+    /** The OS read-permission code of the cause, when the host denied access. */
+    systemCode;
     constructor(path, reason, options) {
         super(`Cannot open artifact: ${reason}`, options);
         this.path = path;
         this.reason = reason;
         this.constraint = options?.constraint;
+        this.systemCode = readPermissionCode(options?.cause);
     }
 }
+const readPermissionCode = (cause) => {
+    const code = cause instanceof Error ? Reflect.get(cause, "code") : undefined;
+    return code === "EACCES" || code === "EPERM" ? code : undefined;
+};

package/dist/domain/conformancePackage.js

@@ -1,12 +1,13 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
-import { evidenceEnvelopeSchema } from "./evidence.js";
+import { IDENTIFIER_PATTERN } from "./stringPatterns.js";
+import { evidenceSchema } from "./evidence.js";
 import { evidenceBundleSchema } from "./evidenceBundle.js";
 import { err, ok } from "./result.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 const conformancePackageIdSchema = prefixedDigestSchema("cp");
-const scenarioIdSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9._-]*$/u);
+const scenarioIdSchema = z.string().regex(IDENTIFIER_PATTERN);
 const scenarioManifestSchema = z.strictObject({
     scenario_id: scenarioIdSchema,
     name: z.string().min(1),
@@ -45,7 +46,7 @@ const shimPlanSchema = z.strictObject({
 const expectedEvidenceSchema = z.strictObject({
     scenario_id: scenarioIdSchema,
     /** Expected evidence envelopes. */
-    envelopes: z.array(evidenceEnvelopeSchema),
+    envelopes: z.array(evidenceSchema),
     /** Expected evidence bundle. */
     bundle: evidenceBundleSchema.nullable(),
     /** Required dimensions that must be present in the evidence. */