rea-agents 6.1.0 → 6.3.0

package/dist/application/javascript/JavaScriptArtifactGraphContext.js

@@ -161,6 +161,15 @@ export const linkElectronRoleToAsset = (context, input) => {
         }),
     });
 };
+/**
+ * Disclose relationships omitted because they resolved to their own source;
+ * the application graph forbids self-referential edges.
+ */
+export const selfReferenceOmissions = (count, noun, owner) => count === 0
+    ? []
+    : [
+        `${String(count)} ${count === 1 ? noun[0] : noun[1]} resolved back to ${owner} itself and ${count === 1 ? "was" : "were"} omitted; application graph edges cannot be self-referential.`,
+    ];
 /** Deterministic key for one recovered module inside a bundle asset. */
 export const moduleLookupKey = (path, moduleKey) => `${path}\0${moduleKey}`;
 /** Deterministic key for one recovered bundler chunk inside a bundle asset. */

package/dist/application/javascript/JavaScriptArtifactGraphDocuments.js

@@ -109,16 +109,16 @@ export const addJavaScriptSourceMapOriginals = (context) => {
                     strategy: "source-map-original",
                     stability: "source-map-exact",
                     source_map_sha256: mapFile.sha256,
-                    original_source: original.source,
+                    original_source: original.reference.source_name,
+                    source_root: original.reference.source_root,
                     source_sha256: original.content_sha256,
                 },
                 observations: [
                     {
-                        label: original.source,
+                        label: original.reference.source_name || null,
+                        source_map_reference: original.reference,
                         properties: {
-                            source: original.source,
                             content_available: original.content !== null,
-                            source_sha256: original.content_sha256,
                         },
                         evidence: artifactObservationEvidence({
                             sha256: mapFile.sha256,
@@ -134,7 +134,10 @@ export const addJavaScriptSourceMapOriginals = (context) => {
                 source_node_id: mapNode.node_id,
                 target_node_id: node.node_id,
                 relation: "contains",
-                properties: { original_source: original.source },
+                properties: {
+                    original_source: original.reference.source_name,
+                    source_root: original.reference.source_root,
+                },
                 evidence: artifactObservationEvidence({
                     sha256: mapFile.sha256,
                     path: mapFile.path,

package/dist/application/javascript/JavaScriptArtifactGraphFindings.js

@@ -1,8 +1,10 @@
-import { addStaticInferenceEdge, artifactLocalIdentity, chunkLookupKey, createElectronRoleNode, javascriptAnalysisCoverage, linkElectronRoleToAsset, moduleLookupKey, resolveArtifactPath, sourceNodeFor, } from "./JavaScriptArtifactGraphContext.js";
+import { createHash } from "node:crypto";
+import { addStaticInferenceEdge, artifactLocalIdentity, chunkLookupKey, createElectronRoleNode, javascriptAnalysisCoverage, linkElectronRoleToAsset, moduleLookupKey, resolveArtifactPath, selfReferenceOmissions, sourceNodeFor, } from "./JavaScriptArtifactGraphContext.js";
 import { astObservationEvidence, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
 import { resolveArtifactPathByContext } from "./JavaScriptArtifactPathResolution.js";
 /** Project imports, workers, roles, endpoints, storage, and source-map links. */
 export const addJavaScriptStaticFindings = (context) => {
+    const omissions = { selfReferences: 0 };
     for (const analyzed of context.analysis.files) {
         const { file, javascript } = analyzed;
         const asset = context.assetNodes.get(file.path);
@@ -10,7 +12,7 @@ export const addJavaScriptStaticFindings = (context) => {
             continue;
         const coverage = javascriptAnalysisCoverage(javascript);
         for (const value of javascript.references)
-            addReference(context, { file, asset, value, coverage });
+            addReference(context, { file, asset, value, coverage }, omissions);
         for (const value of javascript.endpoints)
             addEndpoint(context, { file, asset, value, coverage });
         for (const value of javascript.storage)
@@ -20,8 +22,9 @@ export const addJavaScriptStaticFindings = (context) => {
         for (const value of javascript.source_map_urls)
             addSourceMapEdge(context, { file, asset, value, coverage });
     }
+    return selfReferenceOmissions(omissions.selfReferences, ["static reference", "static references"], "the referencing module");
 };
-const addReference = (context, input) => {
+const addReference = (context, input, omissions) => {
     const source = sourceNodeFor(context, input.file.path, input.value.module_key) ??
         input.asset;
     const resolved = input.value.specifier === null
@@ -70,6 +73,13 @@ const addReference = (context, input) => {
             });
         return;
     }
+    // A reference that resolves to its own source, such as a bundled module
+    // requiring its own key, cannot become an edge: the application graph
+    // forbids self-referential edges and one would fail the whole analysis.
+    if (resolved?.node.node_id === source.node_id) {
+        omissions.selfReferences += 1;
+        return;
+    }
     const target = resolved?.node ??
         unresolvedReferenceNode(context, input.file, input.value, input.coverage);
     addStaticInferenceEdge(context, {
@@ -190,6 +200,9 @@ const addDiscoveredRole = (context, input) => {
     });
 };
 const addSourceMapEdge = (context, input) => {
+    const declaredUrlSha256 = createHash("sha256")
+        .update(input.value.declared_url)
+        .digest("hex");
     const resolvedPath = resolveArtifactPathByContext({
         declaredPath: input.value.declared_url,
         sourcePath: input.file.path,
@@ -198,33 +211,37 @@ const addSourceMapEdge = (context, input) => {
     }).resolved_path;
     const resolvedFile = resolvedPath === null ? undefined : context.filesByPath.get(resolvedPath);
     const resolvedNode = resolvedPath === null ? undefined : context.fileNodes.get(resolvedPath);
-    const target = resolvedFile?.kind === "source-map" && resolvedNode !== undefined
-        ? resolvedNode
-        : context.accumulator.addNode({
-            kind: "source-map",
-            identity: artifactLocalIdentity(input.file.sha256, "unresolved-source-map", input.value.declared_url),
-            observations: [
-                {
-                    label: input.value.declared_url,
-                    properties: {
-                        declared_url: input.value.declared_url,
-                        resolved_path: resolvedPath,
-                        available: false,
-                    },
-                    evidence: staticInferenceEvidence({
-                        sha256: input.file.sha256,
-                        path: input.file.path,
-                        range: input.value.location,
-                        operation: "discover-source-map",
-                        coverage: input.coverage,
-                        confidence: "medium",
-                        limitations: [
+    const isAvailable = resolvedFile?.kind === "source-map" && resolvedNode !== undefined;
+    const target = context.accumulator.addNode({
+        kind: "source-map",
+        identity: isAvailable && resolvedNode !== undefined
+            ? resolvedNode.identity
+            : artifactLocalIdentity(input.file.sha256, "unresolved-source-map", declaredUrlSha256),
+        observations: [
+            {
+                label: "source map reference",
+                properties: {
+                    declared_url: input.value.declared_url,
+                    declared_url_sha256: declaredUrlSha256,
+                    resolved_path: resolvedPath,
+                    available: isAvailable,
+                },
+                evidence: staticInferenceEvidence({
+                    sha256: input.file.sha256,
+                    path: input.file.path,
+                    range: input.value.location,
+                    operation: "discover-source-map",
+                    coverage: input.coverage,
+                    confidence: "medium",
+                    limitations: isAvailable
+                        ? []
+                        : [
                             "The declared source map was not present in the inventoried artifact.",
                         ],
-                    }),
-                },
-            ],
-        });
+                }),
+            },
+        ],
+    });
     addStaticInferenceEdge(context, {
         source: input.asset,
         target,
@@ -233,7 +250,7 @@ const addSourceMapEdge = (context, input) => {
         coverage: input.coverage,
         relation: "maps_to",
         properties: {
-            declared_url: input.value.declared_url,
+            declared_url_sha256: declaredUrlSha256,
             resolved_path: resolvedPath,
         },
     });

package/dist/application/javascript/JavaScriptArtifactGraphStructure.js

@@ -2,7 +2,6 @@ import { completeApplicationCoverage } from "../../domain/javascript/javascriptA
 import { addArtifactContainsEdge, addUnavailableStaticParseScope, artifactFileNodeKind, artifactLocalIdentity, createElectronRoleNode, linkElectronRoleToAsset, } from "./JavaScriptArtifactGraphContext.js";
 import { artifactObservationEvidence, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
 import { resolveArtifactPathByContext } from "./JavaScriptArtifactPathResolution.js";
-export { addJavaScriptBundlerNodes } from "./JavaScriptArtifactGraphBundlers.js";
 /** Create the exact root artifact node from the inventory manifest. */
 export const createJavaScriptArtifactRootNode = (accumulator, snapshot) => {
     const root = snapshot.nodes.find(({ artifact_id: id }) => id === snapshot.manifest.root_artifact_id);

package/dist/application/javascript/JavaScriptArtifactPathResolution.js

@@ -1,6 +1,6 @@
-import { builtinModules } from "node:module";
+import { isBuiltin } from "node:module";
 import { posix } from "node:path";
-import { admitsCanonicalPathSyntax, hasScheme, looksExternal, stripQueryAndFragment, } from "../../domain/artifactPathSyntax.js";
+import { admitsCanonicalPathSyntax, hasScheme, htmlUrlText, looksExternal, percentDecodeUrlPath, stripQueryAndFragment, } from "../../domain/artifactPathSyntax.js";
 const EXTENSIONS = [
     ".js",
     ".cjs",
@@ -11,7 +11,6 @@ const EXTENSIONS = [
     ".html",
     ".node",
 ];
-const NODE_BUILTINS = new Set(builtinModules.map((name) => name.replace(/^node:/u, "")));
 /** Resolve one declaration under its exact syntax/metadata context. */
 export const resolveArtifactPathByContext = (input) => resolvePackagePath(input, new Set());
 const resolvePackagePath = (input, packageChain, mode = "full", exportsTargetUrl = false) => {
@@ -32,12 +31,16 @@ const resolvePackagePath = (input, packageChain, mode = "full", exportsTargetUrl
                 `The exact HTML resource ${confined} was not found among the selected application files.`,
             ],
         });
-    const resolved = mode === "files-and-index"
-        ? (resolveFileCandidates(input, [
-            ...fileCandidates(confined),
-            ...indexCandidates(confined),
-        ]) ?? notFoundCandidate())
-        : resolveCandidate(input, confined, packageChain);
+    // An exports target names one exact file; Node tries no extension or index.
+    const resolved = exportsTargetUrl
+        ? (resolveFileCandidates(input, [confined]) ??
+            exactExportsTargetNotFound(confined))
+        : mode === "files-and-index"
+            ? (resolveFileCandidates(input, [
+                ...fileCandidates(confined),
+                ...indexCandidates(confined),
+            ]) ?? notFoundCandidate())
+            : resolveCandidate(input, confined, packageChain);
     return outcome(input, resolved);
 };
 const rejectDeclaration = (input) => {
@@ -105,9 +108,7 @@ const contextualCandidate = (input, exportsTargetUrl) => {
 };
 const bareModuleCandidate = (input, declared) => {
     const packageName = barePackageName(declared);
-    if (packageName === null ||
-        NODE_BUILTINS.has(packageName) ||
-        declared.startsWith("#"))
+    if (packageName === null || isBuiltin(declared) || declared.startsWith("#"))
         return unresolvedOutcome(input, "external", [
             "The bare specifier is a Node builtin, package import map, or invalid package name.",
         ]);
@@ -148,7 +149,7 @@ const hasContainerCandidate = (files, candidate, containerSha256) => [
             file.container_sha256 === containerSha256));
 });
 const htmlCandidate = (input) => {
-    const declared = stripQueryAndFragment(input.declaredPath);
+    const declared = stripQueryAndFragment(htmlUrlText(input.declaredPath));
     if (looksExternal(declared))
         return unresolvedOutcome(input, "external", [
             "External HTML references are not mapped to local artifact assets.",
@@ -156,15 +157,28 @@ const htmlCandidate = (input) => {
     const rawBase = input.htmlBaseHref;
     const base = rawBase === undefined || rawBase === null
         ? rawBase
-        : stripQueryAndFragment(rawBase);
+        : stripQueryAndFragment(htmlUrlText(rawBase));
     if (base !== undefined && base !== null && looksExternal(base))
         return unresolvedOutcome(input, "external", [
             "The document base href is external, so its script reference is not a local artifact path.",
         ]);
-    if (declared.startsWith("/"))
-        return declared.slice(1);
+    // Removing URL tabs and newlines can join an encoded dot or separator that
+    // the raw declaration split, so admit the parsed URL text again.
+    if (!admitsCanonicalPathSyntax(declared))
+        return unresolvedOutcome(input, "rejected", [
+            "Encoded dot or separator bytes are rejected before artifact path resolution.",
+        ]);
+    const declaredPath = percentDecodeUrlPath(declared);
+    if (declaredPath === null)
+        return unresolvedOutcome(input, "rejected", [
+            "The HTML reference path percent-decodes to NUL or to bytes that are not UTF-8.",
+        ]);
+    if (declaredPath.startsWith("/"))
+        return declaredPath.slice(1);
     if (base === undefined || base === null || base === "")
-        return posix.join(posix.dirname(input.sourcePath), declared);
+        return declaredPath === ""
+            ? input.sourcePath
+            : posix.join(posix.dirname(input.sourcePath), declaredPath);
     // A local base href is a second untrusted path input; apply the same
     // admission rules a declared path gets so it cannot smuggle traversal or
     // separator syntax past canonicalization.
@@ -172,10 +186,27 @@ const htmlCandidate = (input) => {
         return unresolvedOutcome(input, "rejected", [
             "The document base href uses NUL, backslash, or encoded dot and separator bytes that are not admitted for canonical artifact paths.",
         ]);
-    const basePath = base.startsWith("/")
-        ? base.slice(1)
-        : posix.join(posix.dirname(input.sourcePath), base);
-    return posix.join(htmlBaseDirectory(base, basePath), declared);
+    const decodedBase = percentDecodeUrlPath(base);
+    if (decodedBase === null)
+        return unresolvedOutcome(input, "rejected", [
+            "The document base href path percent-decodes to NUL or to bytes that are not UTF-8.",
+        ]);
+    const basePath = decodedBase.startsWith("/")
+        ? decodedBase.slice(1)
+        : posix.join(posix.dirname(input.sourcePath), decodedBase);
+    if (declaredPath === "")
+        return emptyHtmlReference(input, decodedBase, basePath);
+    return posix.join(htmlBaseDirectory(decodedBase, basePath), declaredPath);
+};
+const emptyHtmlReference = (input, base, basePath) => {
+    if (!htmlBaseIsDirectory(base))
+        return basePath;
+    const confined = confineCandidate(input, basePath);
+    if (typeof confined !== "string")
+        return confined;
+    return unresolvedOutcome(input, "not-found", [
+        `The HTML reference resolves to directory ${confined || "."}, not an exact selected application file.`,
+    ]);
 };
 /**
  * The directory a relative HTML reference resolves against. A base path
@@ -183,13 +214,12 @@ const htmlCandidate = (input) => {
  * relative reference resolves against the base URL's directory and those
  * segments are dropped rather than stepped through.
  */
-const htmlBaseDirectory = (base, basePath) => base.endsWith("/") ||
+const htmlBaseIsDirectory = (base) => base.endsWith("/") ||
     base.endsWith("/.") ||
     base.endsWith("/..") ||
     base === "." ||
-    base === ".."
-    ? basePath
-    : posix.dirname(basePath);
+    base === "..";
+const htmlBaseDirectory = (base, basePath) => htmlBaseIsDirectory(base) ? basePath : posix.dirname(basePath);
 const confineCandidate = (input, candidate) => {
     const normalized = posix.normalize(candidate);
     if (normalized === ".." ||
@@ -334,11 +364,20 @@ const packageEntry = (text, moduleKind, useExports) => {
     }
 };
 const packageExport = (value, moduleKind) => {
+    if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+        const keys = Object.keys(value);
+        if (keys.some((key) => key.startsWith(".")) &&
+            keys.some((key) => !key.startsWith(".")))
+            return {
+                status: "rejected",
+                limitation: "The package exports configuration mixes subpath keys and condition keys.",
+            };
+    }
     const root = typeof value === "object" && value !== null && Object.hasOwn(value, ".")
         ? Reflect.get(value, ".")
         : value;
     const flattened = exportTargets(root, packageExportConditions(moduleKind));
-    if (flattened.kind === "invalid")
+    if (flattened.kind === "invalid" || flattened.kind === "invalid-config")
         return { status: "rejected", limitation: flattened.limitation };
     const first = flattened.kind === "unmatched" ? undefined : flattened.values[0];
     return first === undefined
@@ -384,6 +423,9 @@ const exportTargets = (value, conditions) => {
         let invalid = null;
         for (const entry of value) {
             const nested = exportTargets(entry, conditions);
+            // Node's array fallback catches invalid targets, not invalid configuration.
+            if (nested.kind === "invalid-config")
+                return nested;
             if (nested.kind === "invalid") {
                 invalid = nested.limitation;
                 continue;
@@ -400,6 +442,14 @@ const exportTargets = (value, conditions) => {
     }
     if (typeof value !== "object")
         return invalidExportTarget(value, "must be a relative string, object, array, or null");
+    for (const key of Object.keys(value)) {
+        const numeric = Number(key);
+        if (String(numeric) === key && numeric >= 0 && numeric < 0xffff_ffff)
+            return {
+                kind: "invalid-config",
+                limitation: `The package exports configuration contains numeric condition key ${JSON.stringify(key)}.`,
+            };
+    }
     for (const [condition, target] of Object.entries(value)) {
         if (!conditions.has(condition))
             continue;
@@ -413,11 +463,13 @@ const exportTargets = (value, conditions) => {
  * Node selects an exports target by walking the declared keys in order and
  * taking the first whose condition is active for the calling resolver.
  * "default" is always active, and "node" plus "node-addons" are active for the
- * built-in resolver that owns installed-package imports and requires.
+ * built-in resolver that owns installed-package imports and requires. The
+ * supported Node runtimes also activate "module-sync" for both loaders.
  */
 const packageExportConditions = (moduleKind) => new Set([
     "node",
     "node-addons",
+    "module-sync",
     ...(moduleKind === undefined ? [] : [moduleKind]),
     "default",
 ]);
@@ -431,6 +483,13 @@ const notFoundCandidate = () => ({
         "No extension, directory package, or index candidate exists in the inventoried artifact container.",
     ],
 });
+const exactExportsTargetNotFound = (path) => ({
+    resolvedPath: null,
+    status: "not-found",
+    limitations: [
+        `The selected package exports target ${path} does not exist in the inventoried artifact container; exports targets are exact files, so no extension or directory index was tried.`,
+    ],
+});
 const fileUrlPath = (value) => {
     if (!value.startsWith("file://"))
         return undefined;

package/dist/application/javascript/JavaScriptArtifactReconstruction.js

@@ -1,11 +1,13 @@
-import { lstat, realpath } from "node:fs/promises";
+import { constants } from "node:fs";
+import { access, lstat, realpath } from "node:fs/promises";
 import { ArtifactReaderFailure } from "../../artifacts/ArtifactReader.js";
+import { AnalysisAccessDeniedError, AnalysisInputError, AnalysisUnsupportedTargetError, } from "../../domain/analysisErrorCore.js";
 import { createJavaScriptArtifactReader as createReader } from "../../artifacts/javascript/JavaScriptArtifactReader.js";
 import { analyzeAndProjectJavaScriptArtifactFiles } from "./JavaScriptArtifactAnalysis.js";
 import { readJavaScriptArtifactFiles } from "../../artifacts/javascript/JavaScriptArtifactFiles.js";
 import { buildImmutableJavaScriptArtifactGraphSteps } from "./JavaScriptArtifactGraphBuilder.js";
 import { javascriptArtifactReconstructionInputSchema, } from "./JavaScriptArtifactReconstructionInput.js";
-import { scanCanonicalArtifactInventory } from "../../artifacts/inventory/ArtifactInventory.js";
+import { scanCanonicalArtifactInventory } from "../../artifacts/inventory/scanCanonical.js";
 import { summarizeElectronBoundaries } from "./ElectronBoundaryAnalysis.js";
 import { createJavaScriptSemanticGraphProjection } from "./JavaScriptSemanticGraphBuilder.js";
 import { checkpointJavaScriptAnalysis, completeJavaScriptAnalysisSteps, } from "./JavaScriptAnalysisControl.js";
@@ -17,9 +19,12 @@ export const reconstructJavaScriptArtifact = async (rawInput, signal, progress)
     };
     const input = javascriptArtifactReconstructionInputSchema.parse(rawInput);
     abortIfNeeded(signal);
-    const path = await realpath(input.input_path);
+    const path = await resolveSelectedInput(input.input_path);
     const format = await resolveFormat(path, input);
-    const snapshot = await scanCanonicalArtifactInventory(path, { signal });
+    const snapshot = await scanCanonicalArtifactInventory(path, {
+        signal,
+        integrity: { mode: input.integrity_policy },
+    });
     if (snapshot.manifest.root_format !== format)
         throw new ArtifactReaderFailure("format", `Artifact inventory classified ${path} as ${snapshot.manifest.root_format}, not ${format}`);
     const reader = createReader(path, format);
@@ -45,8 +50,8 @@ export const reconstructJavaScriptArtifact = async (rawInput, signal, progress)
         await reportPhase("seal_javascript_application_graph", "Sealing the validated application graph");
         const graph = await completeJavaScriptAnalysisSteps(applicationGraphSteps, signal);
         await reportPhase("build_javascript_semantic_graph", "Binding and validating static semantic relationships");
-        const semanticGraphSteps = semanticProjection.finishImmutableSteps(snapshot.manifest.root_sha256, graph, analysis);
-        await reportPhase("seal_javascript_semantic_graph", "Sealing the validated semantic graph");
+        const semanticGraphSteps = semanticProjection.finishImmutableSteps(snapshot.manifest.root_sha256, graph);
+        await reportPhase("seal_javascript_semantic_graph", "Validating and sealing the semantic graph");
         const semanticGraph = await completeJavaScriptAnalysisSteps(semanticGraphSteps, signal);
         await checkpointJavaScriptAnalysis(signal);
         return {
@@ -55,6 +60,7 @@ export const reconstructJavaScriptArtifact = async (rawInput, signal, progress)
             root_artifact_sha256: snapshot.manifest.root_sha256,
             inventory_manifest_id: snapshot.manifest.manifest_id,
             inventory_graph_sha256: snapshot.manifest.graph_sha256,
+            integrity_contradictions: snapshot.integrity_contradictions,
             graph,
             semantic_graph: semanticGraph,
             electron_summary: summarizeElectronBoundaries(analysis),
@@ -68,7 +74,6 @@ export const reconstructJavaScriptArtifact = async (rawInput, signal, progress)
                 findings: analysis.findings,
                 modules: analysis.modules,
                 parse_failures: analysis.parse_failures,
-                truncated_scopes: analysis.truncated_scopes,
             },
             limitations: analysis.limitations,
         };
@@ -77,6 +82,35 @@ export const reconstructJavaScriptArtifact = async (rawInput, signal, progress)
         await reader.close();
     }
 };
+const OPERATION = "analyze_javascript_application";
+/**
+ * Resolve the caller-selected input. A missing or unreadable selection is a
+ * caller or host-permission failure, not a damaged artifact.
+ */
+const resolveSelectedInput = async (inputPath) => {
+    try {
+        const path = await realpath(inputPath);
+        await access(path, constants.R_OK);
+        return path;
+    }
+    catch (cause) {
+        const code = cause instanceof Error && "code" in cause ? String(cause.code) : "";
+        if (code === "EACCES" || code === "EPERM")
+            throw new AnalysisAccessDeniedError(OPERATION, inputPath, code, {
+                cause,
+            });
+        if (code === "ENOENT" || code === "ENOTDIR")
+            throw new AnalysisInputError(OPERATION, { cause }, [
+                {
+                    path: ["input_path"],
+                    reason: "invalid_value",
+                    message: `No file or directory exists at the selected input path (${code}): ${inputPath}`,
+                },
+            ]);
+        throw cause;
+    }
+};
+/** The selected input's kind, checked against the caller's requested format. */
 const resolveFormat = async (path, input) => {
     const metadata = await lstat(path);
     const observed = metadata.isDirectory()
@@ -85,9 +119,18 @@ const resolveFormat = async (path, input) => {
             ? "asar"
             : undefined;
     if (observed === undefined)
-        throw new ArtifactReaderFailure("format", `JavaScript artifact reconstruction accepts only a directory or .asar file: ${path}`);
+        throw new AnalysisUnsupportedTargetError(OPERATION, input.input_path, "JavaScript application analysis accepts only a directory or an .asar file", {
+            remediationAction: "Select an extracted application directory, an app bundle, or an .asar file such as Contents/Resources/app.asar.",
+        });
     if (input.format !== "auto" && input.format !== observed)
-        throw new ArtifactReaderFailure("format", `Requested ${input.format} input but observed ${observed}: ${path}`);
+        throw new AnalysisInputError(OPERATION, undefined, [
+            {
+                path: ["format"],
+                reason: "invalid_value",
+                message: `Requested ${input.format} input, but the selected input is ${observed === "asar" ? "an .asar file" : "a directory"}: ${input.input_path}`,
+                expected: ["auto", observed],
+            },
+        ]);
     return observed;
 };
 const abortIfNeeded = (signal) => {

package/dist/application/javascript/JavaScriptArtifactReconstructionInput.js

@@ -3,4 +3,5 @@ import { z } from "zod";
 export const javascriptArtifactReconstructionInputSchema = z.strictObject({
     input_path: z.string().min(1),
     format: z.enum(["auto", "asar", "directory"]).default("auto"),
+    integrity_policy: z.enum(["fail", "record-and-continue"]).default("fail"),
 });

package/dist/application/javascript/JavaScriptJsonModules.js

@@ -1,4 +1,4 @@
-import { compareCodePoints } from "../../domain/canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";
 /** Parse one approved JSON module without evaluating JavaScript or resolving imports. */
 export const analyzeJavaScriptJsonModule = (file) => {
     if (!file.text.included)
@@ -26,7 +26,7 @@ export const analyzeJavaScriptJsonModule = (file) => {
         };
     }
     const keys = typeof value === "object" && value !== null && !Array.isArray(value)
-        ? Object.keys(value).sort(compareCodePoints)
+        ? Object.keys(value).sort(compareUnicodeCodePoints)
         : [];
     const retained = keys;
     return {

package/dist/application/javascript/JavaScriptModuleRelationships.js

@@ -1,12 +1,12 @@
 import { posix } from "node:path";
-import { compareCodePoints } from "../../domain/canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";
 import { completeApplicationCoverage, partialApplicationCoverage, } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
-import { semanticCoverageResourceLimits } from "../../domain/javascript/javascriptSemanticCoverage.js";
-import { SEMANTIC_EXPRESSION_DEPTH_LIMIT, SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT, SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT, semanticResourceLimitReason, } from "../../domain/javascript/javascriptSemanticResourceLimits.js";
+import { semanticCoverageResourceLimits, semanticResourceLimitCoverage, } from "../../domain/javascript/javascriptSemanticCoverage.js";
+import { semanticResourceLimitReason } from "../../domain/javascript/javascriptSemanticResourceLimits.js";
 import { addAstContainsEdge, artifactLocalIdentity, } from "./JavaScriptArtifactGraphContext.js";
 import { astObservationEvidence, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
 import { resolveArtifactPathByContext, } from "./JavaScriptArtifactPathResolution.js";
-import { projectJavaScriptExportReturnShapes } from "./JavaScriptReturnShapeProjection.js";
+import { projectJavaScriptExportReturnShapes } from "../../domain/javascript/javascriptExportReturnShapeProjection.js";
 /** Create one path-scoped source-module identity for every analyzed source file. */
 export const addJavaScriptSourceModules = (context) => {
     for (const analyzed of context.analysis.files) {
@@ -17,7 +17,7 @@ export const addJavaScriptSourceModules = (context) => {
             continue;
         const exports = semantic.ir.moduleLinks
             .flatMap(({ exportedName }) => exportedName === null ? [] : [exportedName])
-            .sort(compareCodePoints);
+            .sort(compareUnicodeCodePoints);
         const retainedExports = [...new Set(exports)];
         const source = context.accumulator.addNode({
             kind: "javascript-module",
@@ -264,19 +264,7 @@ const semanticCoverage = (semantic) => {
     const resourceLimits = semanticCoverageResourceLimits(semantic.ir.coverage);
     if (semantic.ir.coverage.status === "complete" && resourceLimits.length === 0)
         return completeApplicationCoverage();
-    return partialApplicationCoverage(resourceLimits.map((resourceLimit) => ({
-        name: `javascript_semantic_${resourceLimit.replaceAll("-", "_")}`,
-        value: resourceLimit === "primitive-candidates"
-            ? SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT
-            : resourceLimit === "primitive-bytes"
-                ? SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT
-                : SEMANTIC_EXPRESSION_DEPTH_LIMIT,
-        unit: resourceLimit === "expression-depth"
-            ? "depth"
-            : resourceLimit === "primitive-bytes"
-                ? "bytes"
-                : "items",
-    })), semantic.ir.coverage.omittedCount);
+    return partialApplicationCoverage(semanticResourceLimitCoverage(resourceLimits), semantic.ir.coverage.omittedCount);
 };
 const moduleFormat = (path, ir) => {
     const extension = posix.extname(path).toLowerCase();

package/dist/application/javascript/JavaScriptRuntimeObservationService.js

@@ -18,11 +18,11 @@ export const observeJavaScriptRuntime = async (provider, input, options = {}) =>
     if (!ready.ok)
         return ready;
     const result = await ready.value.observe(input, options);
+    if (!result.ok)
+        return result;
     if (options.signal?.aborted === true)
         return err(new AnalysisCancelledError("observe_javascript_runtime"));
-    return result.ok
-        ? ok(createJavaScriptRuntimeObservationEvidence("observe_javascript_runtime", input, result.value, ready.value.identity()))
-        : result;
+    return ok(createJavaScriptRuntimeObservationEvidence("observe_javascript_runtime", input, result.value, ready.value.identity()));
 };
 const requireProvider = (provider, operation) => provider === undefined
     ? err(new AnalysisCapabilityUnavailableError("rea-v8-inspector", operation, "V8 Inspector observation provider is not configured"))