rea-agents 6.1.0 → 6.2.0

package/dist/domain/javascript/javascriptSemanticValues.js

@@ -1,11 +1,12 @@
 import * as t from "@babel/types";
+import { semanticSlotAtPath } from "./javascriptSemanticSlots.js";
 import { invalidateSemanticMutationPath } from "./javascriptSemanticMutationValues.js";
 import { resolveSemanticBindingState, } from "./javascriptSemanticState.js";
 import { semanticRequireOrigin } from "./javascriptSemanticRequireOrigin.js";
 import { compareCodePoints } from "../canonicalOrdering.js";
-import { semanticStaticPropertyKey } from "./javascriptAstValues.js";
+import { readExactJavaScriptLiteral, semanticStaticPropertyKey, } from "./javascriptAstValues.js";
 import { semanticAmbiguousProvenance, semanticLocalProvenance, semanticOriginsProvenance, semanticUnresolvedProvenance, uniqueSemanticOrigins, } from "./javascriptSemanticProvenance.js";
-import { MAX_SEMANTIC_PRIMITIVE_CANDIDATES, semanticPrimitiveCandidates as primitiveCandidates, semanticPrimitiveSet as primitiveSet, semanticPrimitiveValue as primitiveValue, } from "./javascriptSemanticPrimitives.js";
+import { semanticPrimitiveCandidates as primitiveCandidates, semanticPrimitiveSet as primitiveSet, } from "./javascriptSemanticPrimitives.js";
 import { SEMANTIC_EXPRESSION_DEPTH_LIMIT, SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT, exceedsSemanticPrimitiveAdditionByteBudget, exceedsSemanticTemplateByteBudget, semanticResourceLimitUnknown, semanticResourceLimitReason, } from "./javascriptSemanticResourceLimits.js";
 const primitiveBindingValuesByState = new WeakMap();
 const primitiveBindingValuesFor = (state) => {
@@ -50,6 +51,16 @@ const evaluateBinding = (binding, context) => {
             status: "unknown",
             reason: `Binding ${binding.name} has no constant initializer.`,
         };
+    if (binding.initializers.some(({ node }) => t.isUpdateExpression(node) ||
+        (t.isAssignmentExpression(node) &&
+            node.operator !== "=" &&
+            node.operator !== "&&=" &&
+            node.operator !== "||=" &&
+            node.operator !== "??=")))
+        return {
+            status: "unknown",
+            reason: `Binding ${binding.name} has a compound or update write.`,
+        };
     if (binding.initializers.length > 1)
         return {
             status: "ambiguous",
@@ -72,7 +83,7 @@ const evaluateBinding = (binding, context) => {
 const evaluateExpression = (node, context) => {
     if (context.expressionDepth > SEMANTIC_EXPRESSION_DEPTH_LIMIT)
         return semanticResourceLimitUnknown("expression-depth");
-    const literal = primitiveValue(node);
+    const literal = readExactJavaScriptLiteral(node);
     if (literal.found)
         return { status: "literal", value: literal.value };
     if (t.isIdentifier(node)) {
@@ -114,9 +125,12 @@ const evaluateTemplate = (node, context) => {
     let candidates = [""];
     for (let index = 0; index < node.quasis.length; index += 1) {
         const quasi = node.quasis[index];
-        // Semantic template evaluation retains its established raw fallback for
-        // synthetic AST inputs; exact atom readers remain cooked-only.
-        const text = quasi?.value.cooked ?? quasi?.value.raw ?? "";
+        const text = quasi?.value.cooked;
+        if (text === undefined || text === null)
+            return {
+                status: "unknown",
+                reason: "Template text has no cooked representation.",
+            };
         if (exceedsSemanticTemplateByteBudget(candidates, [text]))
             return semanticResourceLimitUnknown("primitive-bytes");
         candidates = candidates.map((prefix) => `${prefix}${text}`);
@@ -150,6 +164,7 @@ const evaluateObject = (node, context) => {
         for (const [name] of propertiesByName)
             propertiesByName.set(name, {
                 name,
+                presence: "present",
                 value: {
                     status: "unknown",
                     reason: "A later property may overwrite this value.",
@@ -183,6 +198,7 @@ const evaluateObject = (node, context) => {
         }
         propertiesByName.set(name, {
             name,
+            presence: "present",
             value: t.isObjectProperty(property)
                 ? evaluateExpression(property.value, nestedContext(context))
                 : {
@@ -218,20 +234,27 @@ const evaluateArray = (node, context) => {
             break;
         }
         if (element === null) {
-            unknownItems = true;
-            if (omittedItems !== null)
-                omittedItems += 1;
             items.push({
-                status: "unknown",
-                reason: "Array hole has no primitive value.",
+                name: String(items.length),
+                presence: "absent",
+                value: { status: "unknown", reason: "Array hole has no own value." },
             });
             continue;
         }
-        items.push(evaluateExpression(element, nestedContext(context)));
+        items.push({
+            name: String(items.length),
+            presence: "present",
+            value: evaluateExpression(element, nestedContext(context)),
+        });
     }
     return unknownItems
         ? { status: "array", items, unknownItems: true, omittedItems }
-        : { status: "array", items, unknownItems: false, omittedItems: 0 };
+        : {
+            status: "array",
+            items,
+            unknownItems: false,
+            omittedItems: 0,
+        };
 };
 const evaluateMember = (node, context) => {
     const keys = [];
@@ -290,7 +313,7 @@ const addPrimitiveValues = (leftValue, rightValue) => {
             return rightValue;
         return { status: "unknown", reason: "Non-primitive addition." };
     }
-    if (left.length > MAX_SEMANTIC_PRIMITIVE_CANDIDATES / right.length)
+    if (left.length > SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT / right.length)
         return semanticResourceLimitUnknown("primitive-candidates");
     if (exceedsSemanticPrimitiveAdditionByteBudget(left, right))
         return semanticResourceLimitUnknown("primitive-bytes");
@@ -316,46 +339,16 @@ const evaluateUnary = (node, context) => {
     return { status: "unknown", reason: `Unsupported unary ${node.operator}.` };
 };
 const projectValue = (value, projection) => {
-    let current = value;
-    for (const key of projection) {
-        if (key === null)
-            return {
-                status: "unknown",
-                reason: "Cannot project a dynamic property.",
-            };
-        if (current.status === "object" && typeof key === "string") {
-            const property = current.properties.find(({ name }) => name === key);
-            if (property === undefined)
-                return {
-                    status: current.unknownProperties ? "unknown" : "unknown",
-                    reason: `Object property ${key} was not observed.`,
-                };
-            current = property.value;
-        }
-        else if (current.status === "array") {
-            const index = typeof key === "number" ? key : Number(key);
-            if (!Number.isSafeInteger(index) ||
-                index < 0 ||
-                String(index) !== String(key))
-                return {
-                    status: "unknown",
-                    reason: `Array property ${String(key)} is not a canonical index.`,
-                };
-            const item = current.items[index];
-            if (item === undefined)
-                return {
-                    status: "unknown",
-                    reason: `Array item ${String(key)} missing.`,
-                };
-            current = item;
-        }
-        else
-            return {
-                status: "unknown",
-                reason: `Cannot project ${String(key)} from ${current.status}.`,
-            };
-    }
-    return current;
+    if (projection.includes(null))
+        return { status: "unknown", reason: "Cannot project a dynamic property." };
+    const path = projection.map((key) => String(key));
+    const slot = semanticSlotAtPath(value, path);
+    return slot.presence === "present"
+        ? slot.value
+        : {
+            status: "unknown",
+            reason: `Own property ${path.join("/")} is ${slot.presence}.`,
+        };
 };
 const provenanceForBinding = (binding, context) => {
     if (context.bindings.has(binding.bindingId))

package/dist/domain/javascript/javascriptSourceMapPaths.js

@@ -0,0 +1,104 @@
+import { posix } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { z } from "zod";
+/** Map-scoped source declaration and its path interpretation for matching. */
+export const javascriptSourceMapReferenceSchema = z.strictObject({
+    source_name: z.string(),
+    source_root: z.string().nullable(),
+    map_path: z.string().min(1),
+    resolution: z.discriminatedUnion("kind", [
+        z.strictObject({
+            kind: z.enum(["artifact-relative", "suffix"]),
+            path: z.string().min(1),
+        }),
+        z.strictObject({
+            kind: z.literal("unresolved"),
+            reason: z.string().min(1),
+        }),
+    ]),
+});
+/** Interpret a declaration once at the source-map ingestion boundary. */
+export const resolveJavaScriptSourceMapReference = (sourceName, sourceRoot, mapPath) => {
+    // TraceMap's producer prefixes sourceRoot before resolving the URL reference.
+    const reference = `${sourceRoot ? `${sourceRoot}/` : ""}${sourceName}`;
+    return {
+        source_name: sourceName,
+        source_root: sourceRoot,
+        map_path: mapPath,
+        resolution: resolveJavaScriptSourceMapPath(reference, mapPath),
+    };
+};
+/** Resolve a source-map URL reference without changing its recorded identity. */
+const resolveJavaScriptSourceMapPath = (source, mapPath) => {
+    const portable = source.replaceAll("\\", "/");
+    const windowsPath = /^[a-z]:\//iu.test(portable) || source.startsWith("\\\\");
+    // Preserve parent traversal rather than letting URL resolution clamp at '/'.
+    const anchor = `/${"source/".repeat(portable.split("/").length + 1)}`;
+    const directory = posix.join(anchor, posix.dirname(mapPath.replaceAll("\\", "/")));
+    const base = pathToFileURL(`${directory}/`, { windows: false });
+    const absolute = windowsPath ? windowsFileUrl(source) : URL.parse(source);
+    const resolved = windowsPath ? absolute : URL.parse(source, base);
+    if (resolved === null)
+        return {
+            kind: "unresolved",
+            reason: "Source reference is not a valid URL or filesystem path.",
+        };
+    if (!resolved.pathname.startsWith("/"))
+        return {
+            kind: "unresolved",
+            reason: "Source reference uses a non-hierarchical URL without a file pathname.",
+        };
+    if (resolved.pathname.endsWith("/"))
+        return {
+            kind: "unresolved",
+            reason: "Source reference names a directory rather than a file.",
+        };
+    // Encoded separators must not manufacture a different filesystem hierarchy.
+    if (/%(?:2f|5c)/iu.test(resolved.pathname))
+        return {
+            kind: "unresolved",
+            reason: "Source reference contains an encoded path separator.",
+        };
+    const relative = absolute === null
+        ? !portable.startsWith("/")
+        : absolute.href !== resolved.href;
+    const path = decodedUrlPath(resolved);
+    if (path === null)
+        return {
+            kind: "unresolved",
+            reason: "Source reference has malformed URL encoding or an invalid file URL.",
+        };
+    const value = relative
+        ? posix.relative(anchor, path)
+        : path.replace(/^\/+/, "");
+    if (value === "" || value === ".." || value.startsWith("../"))
+        return {
+            kind: "unresolved",
+            reason: "Source reference resolves outside the inventoried artifact.",
+        };
+    return { path: value, kind: relative ? "artifact-relative" : "suffix" };
+};
+const windowsFileUrl = (path) => {
+    try {
+        return pathToFileURL(path, { windows: true });
+    }
+    catch (cause) {
+        if (cause instanceof TypeError)
+            return null;
+        throw cause;
+    }
+};
+const decodedUrlPath = (url) => {
+    try {
+        if (url.protocol === "file:")
+            return fileURLToPath(url, {
+                windows: url.hostname !== "" && url.hostname !== "localhost",
+            }).replaceAll("\\", "/");
+        return `${url.host}${decodeURIComponent(url.pathname)}`;
+    }
+    catch (cause) {
+        if (cause instanceof URIError || cause instanceof TypeError)
+            return null;
+        throw cause;
+    }
+};

package/dist/domain/javascript/javascriptStaticAnalysisCalls.js

@@ -1,7 +1,8 @@
 import * as t from "@babel/types";
 import { sanitizeEndpointCandidate } from "../browserObservation.js";
 import { addFindingOnce, addLocatedFinding, } from "./javascriptStaticAnalysisFindings.js";
-import { STATIC_ROUTE_CALL_NAMES, argumentValue, calleeName, endpointArgument as endpointArgumentHelper, prefixedArgument, semanticStaticPropertyName, range, rangeForOffsets, sourceSlice, staticPath, staticPathResolutionContext, storageKind, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
+import { STATIC_ROUTE_CALL_NAMES, argumentValue, calleeName, endpointArgument as endpointArgumentHelper, prefixedArgument, range, rangeForOffsets, sourceSlice, staticPath, staticPathResolutionContext, storageKind, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
+import { semanticStaticPropertyName } from "./javascriptAstValues.js";
 /** Inspect one call or new expression for references, endpoints, storage, and roles. */
 export const inspectCall = (source, node, context) => {
     const { accumulator } = context;

package/dist/domain/javascript/javascriptStaticAnalysisHelpers.js

@@ -4,7 +4,6 @@ import { fileURLToPath } from "node:url";
 import * as t from "@babel/types";
 import { readExactJavaScriptLiteral, semanticStaticPropertyName, } from "./javascriptAstValues.js";
 import { compareCodePoints } from "../canonicalOrdering.js";
-export { propertyName, semanticStaticPropertyName, } from "./javascriptAstValues.js";
 /** Explicit result for source text that Babel cannot parse. */
 export const failedJavaScriptStaticAnalysis = () => ({
     parse_status: "failed",

package/dist/domain/javascript/sourceToBundleComparison.js

@@ -1,7 +1,7 @@
 import { compareCodePoints, uniqueSorted } from "../canonicalOrdering.js";
 import { absenceClaimable, canonicalDigest } from "../comparisonSemantics.js";
 import { SOURCE_TO_BUNDLE_SIGNAL_WEIGHTS, sourceToBundleComparisonResultSchema, } from "./sourceToBundleComparisonSchemas.js";
-import { buildSourceToBundleCandidateIndex, candidateIdsForSource, historicalSourceFiles, scoreSourceToBundleCandidate, sourceBearingNodes, } from "./sourceToBundleSignals.js";
+import { buildSourceToBundleCandidateIndex, candidateHasDigest, candidateIdsForSource, historicalSourceFiles, scoreSourceToBundleCandidate, sourceBearingNodes, } from "./sourceToBundleSignals.js";
 /** Compare historical source files to static source-bearing application nodes. */
 export const compareSourceToBundle = (input) => {
     const projection = projectComparison(input);
@@ -63,7 +63,7 @@ const compareMappings = (input, projection) => {
             .map((nodeId) => scoreSourceToBundleCandidate(source, nodeId, projection.index))
             .filter((candidate) => candidate !== null)
             .sort(compareCandidates);
-        const classification = classifyMapping(scored, projection.absenceComplete);
+        const classification = classifyMapping(scored, projection.absenceComplete, (nodeId) => source.sha256 !== null && candidateHasDigest(projection.index, nodeId));
         const semantic = {
             source_path: source.path,
             source_sha256: source.sha256,
@@ -103,7 +103,7 @@ const scoringModel = () => ({
         weight,
     })),
 });
-const classifyMapping = (candidates, absenceComplete) => {
+const classifyMapping = (candidates, absenceComplete, digestComparable) => {
     const exact = candidates.filter((candidate) => hasSignal(candidate, "exact-source-digest"));
     if (exact.length === 1)
         return {
@@ -134,6 +134,15 @@ const classifyMapping = (candidates, absenceComplete) => {
         : pathCandidates.filter(({ score }) => score === topScore);
     if (topPathCandidates.length === 1) {
         const candidate = topPathCandidates[0];
+        if (candidate !== undefined && digestComparable(candidate.current_node_id))
+            return {
+                status: "modified",
+                confidence: candidate.confidence === "high" ? "high" : "medium",
+                currentNodeIds: [candidate.current_node_id],
+                limitations: [
+                    "Location evidence links the source to the current node, but their source digests differ.",
+                ],
+            };
         return {
             status: "unknown",
             confidence: "unknown",

package/dist/domain/javascript/sourceToBundleSignals.js

@@ -39,7 +39,9 @@ export const buildSourceToBundleCandidateIndex = (nodes) => {
         for (const digest of projection.digests)
             addIndexValue(byDigest, digest, projection.node.node_id);
         for (const path of projection.paths) {
-            for (const suffix of pathSuffixes(path.value))
+            for (const suffix of path.allowSuffix
+                ? pathSuffixes(path.value)
+                : [path.value])
                 addIndexValue(byPathSuffix, suffix, projection.node.node_id);
             addIndexValue(byBasename, posix.basename(path.value), projection.node.node_id);
         }
@@ -72,6 +74,8 @@ export const candidateIdsForSource = (source, index) => {
     }
     return output;
 };
+/** Whether an indexed candidate carries any content digest to compare. */
+export const candidateHasDigest = (index, nodeId) => (index.nodes.get(nodeId)?.digests.size ?? 0) > 0;
 /** Score one indexed candidate from explicit, caller-visible signals. */
 export const scoreSourceToBundleCandidate = (source, nodeId, index) => {
     const projection = index.nodes.get(nodeId);
@@ -97,16 +101,26 @@ const projectCurrentNode = (node) => {
     if (node.identity.strategy === "source-map-original") {
         if (node.identity.source_sha256 !== null)
             digests.add(node.identity.source_sha256);
-        addPath(paths, "source-map-original", node.identity.original_source);
     }
     if (node.identity.strategy === "canonical-path")
         addPath(paths, "canonical-path", node.identity.path);
     for (const observation of node.observations) {
-        const sourceDigest = observation.properties.source_sha256;
-        if (typeof sourceDigest === "string" && isDigest(sourceDigest))
-            digests.add(sourceDigest);
-        for (const key of PATH_PROPERTIES)
-            addJsonPath(paths, observation.properties[key]);
+        if (node.identity.strategy === "source-map-original") {
+            const resolution = observation.source_map_reference?.resolution;
+            if (resolution !== undefined && resolution.kind !== "unresolved")
+                paths.push({
+                    kind: "source-map-original",
+                    value: resolution.path,
+                    allowSuffix: resolution.kind === "suffix",
+                });
+        }
+        else {
+            const sourceDigest = observation.properties.source_sha256;
+            if (typeof sourceDigest === "string" && isDigest(sourceDigest))
+                digests.add(sourceDigest);
+            for (const key of PATH_PROPERTIES)
+                addJsonPath(paths, observation.properties[key]);
+        }
     }
     return {
         node,
@@ -128,7 +142,9 @@ const candidateSignals = (source, current) => {
     if (exactPaths.length > 0)
         signals.push(signal("current-path-exact", source.path, exactPaths));
     const suffixPaths = otherPaths
-        .filter(({ value }) => value !== source.path && value.endsWith(`/${source.path}`))
+        .filter(({ value, allowSuffix }) => allowSuffix &&
+        value !== source.path &&
+        value.endsWith(`/${source.path}`))
         .map(({ value }) => value);
     if (suffixPaths.length > 0)
         signals.push(signal("current-path-suffix", source.path, suffixPaths));
@@ -161,7 +177,8 @@ const candidateConfidence = (signals) => {
     return kinds.has("current-path-suffix") ? "medium" : "low";
 };
 const matchingPaths = (sourcePath, currentPaths) => currentPaths
-    .filter(({ value }) => value === sourcePath || value.endsWith(`/${sourcePath}`))
+    .filter(({ value, allowSuffix }) => value === sourcePath ||
+    (allowSuffix && value.endsWith(`/${sourcePath}`)))
     .map(({ value }) => value);
 const addJsonPath = (paths, value) => {
     if (typeof value === "string")
@@ -170,27 +187,38 @@ const addJsonPath = (paths, value) => {
 const addPath = (paths, kind, raw) => {
     const value = normalizeCurrentPath(raw);
     if (value !== null)
-        paths.push({ kind, value });
+        paths.push({ kind, value, allowSuffix: true });
 };
-/** Matches a `scheme://...` URL prefix; bare filesystem paths keep `?`/`#`. */
 const SCHEME_URL = /^[a-z][a-z0-9+.-]*:\/\//iu;
-/** Matches a `scheme://...` URL prefix with any run of slashes, for stripping. */
 const SCHEME_URL_PREFIX = /^[a-z][a-z0-9+.-]*:\/\/+/iu;
 const normalizeCurrentPath = (raw) => {
     const withoutQuery = SCHEME_URL.test(raw)
         ? (raw.split(/[?#]/u, 1)[0] ?? "")
         : raw;
-    const withoutScheme = withoutQuery.replace(SCHEME_URL_PREFIX, "");
-    const parts = withoutScheme
-        .replaceAll("\\", "/")
-        .split("/")
-        .filter((part) => part !== "" && part !== ".");
-    if (parts.length === 0 || parts.includes(".."))
+    const portable = withoutQuery
+        .replace(SCHEME_URL_PREFIX, "")
+        .replaceAll("\\", "/");
+    const parts = [];
+    for (const part of portable.split("/")) {
+        if (part === "" || part === ".")
+            continue;
+        if (part === "..") {
+            if (parts.length === 0)
+                return null;
+            parts.pop();
+        }
+        else
+            parts.push(part);
+    }
+    if (parts.length === 0)
         return null;
     return parts.join("/");
 };
 const uniquePaths = (paths) => [
-    ...new Map(paths.map((path) => [`${path.kind}\0${path.value}`, path])).values(),
+    ...new Map(paths.map((path) => [
+        `${path.kind}\0${path.value}\0${String(path.allowSuffix)}`,
+        path,
+    ])).values(),
 ].sort((left, right) => compareCodePoints(`${left.kind}\0${left.value}`, `${right.kind}\0${right.value}`));
 const pathSuffixes = (path) => {
     const parts = path.split("/");

package/dist/domain/localPath.js

@@ -4,7 +4,7 @@ import { z } from "zod";
 export const localPathStringSchema = z
     .string()
     .min(1)
-    .regex(/^[^\0]*$/u, "Local filesystem paths cannot contain NUL");
+    .regex(/^[^\u0000]*$/u, "Local filesystem paths cannot contain NUL");
 /** True when the value is an absolute filesystem path on the host platform. */
 export const isAbsoluteLocalPath = (value) => isAbsolute(value);
 /** Test lexical containment on the host platform; callers must resolve symlinks first. */

package/dist/domain/managed/managedArtifact.js

@@ -413,7 +413,8 @@ export const managedNativeBoundaryInspectionSchema = z.object({
         requires_artifact_sha256: digestSchema,
         requires_mvid: cliMetadataGuidSchema.nullable(),
     }),
-    cli_native: z.object({
+    cli_native: z
+        .object({
         il_only: z.boolean(),
         requires_32bit: z.boolean(),
         strong_name_signed: z.boolean(),
@@ -421,7 +422,8 @@ export const managedNativeBoundaryInspectionSchema = z.object({
         ready_to_run_signature: z.boolean(),
         managed_native_header_rva: z.number().int().min(0).max(0xffff_ffff),
         managed_native_header_size: z.number().int().min(0).max(0xffff_ffff),
-    }),
+    })
+        .nullable(),
     module_refs: z.array(managedModuleReferenceSchema),
     pinvoke_imports: z.array(managedNativeImportSchema),
     native_implementations: z.array(managedNativeImplementationSchema),
@@ -429,8 +431,8 @@ export const managedNativeBoundaryInspectionSchema = z.object({
         module_ref_count: z.number().int().min(0),
         pinvoke_import_count: z.number().int().min(0),
         native_implementation_count: z.number().int().min(0),
-        ready_to_run: z.boolean(),
-        mixed_mode_or_native_header: z.boolean(),
+        ready_to_run: z.boolean().nullable(),
+        mixed_mode_or_native_header: z.boolean().nullable(),
     }),
     coverage: z.object({
         state: z.enum(["complete", "partial", "unavailable"]),

package/dist/domain/managed/managedMemberComparison.js

@@ -165,18 +165,12 @@ export const managedMemberComparisonResultSchema = z.strictObject({
 });
 /** Compare managed members with constrained exact and structural identities. */
 export const compareManagedMembers = (left, right) => {
-    const leftCoverage = {
-        sourceComplete: left.result.coverage.state === "complete",
-    };
-    const rightCoverage = {
-        sourceComplete: right.result.coverage.state === "complete",
-    };
     const { methodMatches, fieldMatches } = keyMembers(left, right);
     const itemContext = {
         leftEvidenceId: left.evidenceId,
         rightEvidenceId: right.evidenceId,
-        leftComplete: leftCoverage.sourceComplete,
-        rightComplete: rightCoverage.sourceComplete,
+        leftComplete: left.result.metadata.status === "complete",
+        rightComplete: right.result.metadata.status === "complete",
     };
     const methodItems = buildMethodItems(methodMatches, itemContext);
     const fieldItems = buildFieldItems(fieldMatches, itemContext);
@@ -212,4 +206,3 @@ export const compareManagedMembers = (left, right) => {
     };
     return managedMemberComparisonResultSchema.parse(result);
 };
-export { parseManagedMemberEvidence } from "./managedMemberComparisonMatch.js";

package/dist/domain/managed/managedNativeVerification.js

@@ -4,8 +4,6 @@ import { managedNativeBoundaryInspectionSchema, } from "./managedArtifact.js";
 import { parseManagedInspectionEvidence } from "./managedInspectionEvidence.js";
 import { managedNativeVerificationResultSchema, } from "./managedNativeVerificationSchemas.js";
 import { buildVerificationResult, collectNativeSymbols, verifyPinvoke, } from "./managedNativeVerificationMatch.js";
-export { managedNativeVerificationInputSchema, } from "./managedNativeVerificationSchemas.js";
-export { managedNativeVerificationResultSchema };
 const sha256 = (value) => {
     const serialized = canonicalize(value);
     if (serialized === undefined)

package/dist/domain/managed/managedNativeVerificationMatch.js

@@ -71,16 +71,22 @@ const sameSymbolName = (expected, native) => expected ===
         : native.name);
 const normalizeModule = (value) => basename(value)
     .toLowerCase()
-    .replace(/^lib/u, "")
     .replace(/\.(dll|dylib|so|node|exe)$/u, "");
+const nativeModuleIdentities = (value) => {
+    const filename = basename(value).toLowerCase();
+    const stem = normalizeModule(filename);
+    const identities = new Set([stem]);
+    if (/\.(dylib|so)$/u.test(filename) && stem.startsWith("lib"))
+        identities.add(stem.slice("lib".length));
+    return identities;
+};
 const moduleCompatible = (scope, symbol) => {
     if (scope === null)
         return true;
     const expected = normalizeModule(scope);
     return [symbol.module_name, symbol.module_path]
         .filter((value) => value !== null)
-        .map(normalizeModule)
-        .some((value) => value === expected);
+        .some((value) => nativeModuleIdentities(value).has(expected));
 };
 const candidateNames = (managed) => {
     const names = new Set([managed.import_name]);

package/dist/domain/native/binaryLayout.js

@@ -1,11 +1,10 @@
 import { z } from "zod";
+import { CANONICAL_BASE64_PATTERN } from "../stringPatterns.js";
 const unsignedHex = z.string().regex(/^0x(?:0|[1-9a-f][0-9a-f]{0,15})$/);
 const index = z.number().int().nonnegative();
 const scalar = z.union([z.string(), z.number().int()]);
 const range = z.strictObject({ offset: unsignedHex, bytes: unsignedHex });
-const canonicalBase64 = z
-    .string()
-    .regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/][AQgw]==|[A-Za-z0-9+/]{2}[AEIMQUYcgkosw048]=)?$/);
+const canonicalBase64 = z.string().regex(CANONICAL_BASE64_PATTERN);
 const name = z.strictObject({
     display: z.string(),
     bytes_base64: canonicalBase64.nullable(),

package/dist/domain/native/nativeApiBoundary.js

@@ -71,7 +71,7 @@ const inferredJumpTableSchema = z
     dispatch_address: z.string().min(1),
     data_sources: z.array(jumpTableDataSourceSchema),
     mappings: z.array(jumpTableMappingSchema),
-    default_targets: z.array(jumpTableDefaultTargetSchema).default([]),
+    default_targets: z.array(jumpTableDefaultTargetSchema),
     limitations: z.array(z.string()),
 })
     .strict();

package/dist/domain/native/nativeCallObservation.js

@@ -3,11 +3,11 @@ import { localPathStringSchema } from "../localPath.js";
 const hexSchema = z.string().regex(/^0x[0-9a-f]+$/u);
 const nativeString = z
     .string()
-    .regex(/^[^\0]*$/u, "Native launch and breakpoint strings cannot contain NUL");
+    .regex(/^[^\u0000]*$/u, "Native launch and breakpoint strings cannot contain NUL");
 /** Objective-C class names and selectors never contain spaces or brackets. */
 const objcName = nativeString
     .min(1)
-    .regex(/^[^\s[\]]+$/u, "Use the bare name without spaces or brackets");
+    .regex(/^[^\s\x5b\x5d]+$/u, "Use the bare name without spaces or brackets");
 const functionBreakpoint = {
     kind: z.literal("function"),
     name: nativeString
@@ -46,7 +46,9 @@ export const nativeCallObservationInputSchema = z.strictObject({
         .record(z
         .string()
         .min(1)
-        .regex(/^[^=\0]+$/u, "Environment names cannot contain '=' or NUL"), z.string().regex(/^[^\0]*$/u, "Environment values cannot contain NUL"))
+        .regex(/^[^=\u0000]+$/u, "Environment names cannot contain '=' or NUL"), z
+        .string()
+        .regex(/^[^\u0000]*$/u, "Environment values cannot contain NUL"))
         .default({})
         .describe("Overrides on top of the environment REA runs with."),
     working_directory: localPathStringSchema.optional(),

package/dist/domain/native/nativeInstruction.js

@@ -54,6 +54,13 @@ export const nativeInstructionSchema = z.strictObject({
         conditional: z.boolean(),
         computed: z.boolean(),
         direct_destinations: z.array(z.string()),
+        classification_evidence: z
+            .array(z.strictObject({
+            source: z.string().min(1),
+            value: z.string().min(1),
+        }))
+            .optional()
+            .describe("Observed provider facts used to classify flow; older captures or other providers may omit them."),
     }),
     references: z.array(reference),
     limitations: z.array(z.string()),

package/dist/domain/native/recordedCrash.js

@@ -1,11 +1,10 @@
 import { z } from "zod";
+import { CANONICAL_BASE64_PATTERN } from "../stringPatterns.js";
 import { recordedNoteCoverageIssues } from "./recordedCrashNoteCoverage.js";
 const hex = z.string().regex(/^0x(?:0|[1-9a-f][0-9a-f]{0,15})$/);
 const index = z.number().int().nonnegative();
 const signed32 = z.number().int().min(-2147483648).max(2147483647);
-const base64 = z
-    .string()
-    .regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/][AQgw]==|[A-Za-z0-9+/]{2}[AEIMQUYcgkosw048]=)?$/);
+const base64 = z.string().regex(CANONICAL_BASE64_PATTERN);
 const range = z.strictObject({ offset: hex, bytes: hex });
 const diagnostics = z.strictObject({
     stdout: z.string(),