rea-agents 6.1.0 → 6.3.0

package/dist/domain/localPath.js

@@ -1,12 +1,18 @@
 import { isAbsolute, relative, sep } from "node:path";
 import { z } from "zod";
-/** Preserve selected filesystem names while rejecting OS-invalid NUL bytes. */
+/**
+ * Preserve selected filesystem names while rejecting OS-invalid NUL bytes.
+ *
+ * The pattern spells NUL as `\x00` rather than `\u0000`. Both accept exactly the
+ * same strings. The hex form also avoids the short `\0` spelling rejected by
+ * strict schema consumers. A client can reject its entire tool request when
+ * one advertised pattern cannot compile. See `offsetDateTimeSchema` for the
+ * same hex-escape convention.
+ */
 export const localPathStringSchema = z
     .string()
     .min(1)
-    .regex(/^[^\0]*$/u, "Local filesystem paths cannot contain NUL");
-/** True when the value is an absolute filesystem path on the host platform. */
-export const isAbsoluteLocalPath = (value) => isAbsolute(value);
+    .regex(/^[^\x00]*$/u, "Local filesystem paths cannot contain NUL");
 /** Test lexical containment on the host platform; callers must resolve symlinks first. */
 export const isPathWithinRoot = (root, path) => {
     const value = relative(root, path);

package/dist/domain/managed/managedApplicationGraph.js

@@ -82,8 +82,8 @@ export const projectManagedApplicationGraph = (input) => {
     };
     const artifactNode = addArtifactNode(state);
     addArtifactIdentityNodes(state, artifactNode, parsed);
-    const memberCounts = addMemberNodes(state, artifactNode, parsed);
-    const boundaryCounts = addBoundaryNodes(state, artifactNode, parsed);
+    addMemberNodes(state, artifactNode, parsed);
+    addBoundaryNodes(state, artifactNode, parsed);
     const omissions = omittedCounts(parsed);
     const limitations = projectionLimitations(parsed, omissions);
     const graph = createJavaScriptApplicationGraph({
@@ -104,10 +104,13 @@ export const projectManagedApplicationGraph = (input) => {
         summary: {
             graph_nodes: graph.nodes.length,
             graph_edges: graph.edges.length,
-            assemblies: parsed.artifact?.result.assembly === null ? 0 : 1,
-            modules: parsed.artifact?.result.module === null ? 0 : 1,
-            ...memberCounts,
-            ...boundaryCounts,
+            assemblies: countNodes(graph.nodes, "managed-assembly"),
+            modules: countNodes(graph.nodes, "managed-module"),
+            types: countNodes(graph.nodes, "managed-type"),
+            methods: countNodes(graph.nodes, "managed-method"),
+            fields: countNodes(graph.nodes, "managed-field"),
+            pinvoke_imports: countNodes(graph.nodes, "managed-pinvoke-import"),
+            native_implementations: countNodes(graph.nodes, "managed-native-implementation"),
         },
         graph,
         coverage: managedGraphResultCoverage(omissions),
@@ -119,6 +122,7 @@ export const projectManagedApplicationGraph = (input) => {
         projection_id: `magp_${sha256(withoutId)}`,
     });
 };
+const countNodes = (nodes, kind) => nodes.filter((node) => node.kind === kind).length;
 const parseManagedInputs = (input) => ({
     artifact: input.managed_artifact === undefined
         ? null

package/dist/domain/managed/managedApplicationGraphNodes.js

@@ -2,7 +2,6 @@ import { basename } from "node:path";
 import { createJavaScriptApplicationEdge, createJavaScriptApplicationNode, } from "../javascript/javascriptApplicationGraph.js";
 import { managedSourceCoverage } from "./managedApplicationGraphCoverage.js";
 import {} from "./managedArtifact.js";
-import { moduleCoverageState } from "./managedApplicationGraphNodeCoverage.js";
 /** Add the root managed artifact node to the graph state. */
 export const addArtifactNode = (state) => {
     const node = createJavaScriptApplicationNode({
@@ -19,7 +18,7 @@ export const addArtifactNode = (state) => {
                     format: "pe",
                     source: "managed-application-graph",
                 },
-                evidence: managedEvidence(state, "project-managed-artifact"),
+                evidence: projectedManagedEvidence(state, "project-managed-artifact"),
             },
         ],
     });
@@ -28,36 +27,36 @@ export const addArtifactNode = (state) => {
 };
 /** Add managed assembly and module identity nodes for the artifact. */
 export const addArtifactIdentityNodes = (state, artifactNode, parsed) => {
-    const artifact = parsed.artifact?.result;
-    const artifactCoverage = managedSourceCoverage(parsed.artifact?.result.coverage.state ?? "complete");
-    if (artifact?.assembly !== undefined && artifact.assembly !== null) {
+    const artifactInput = parsed.artifact;
+    if (artifactInput !== null && artifactInput.result.assembly !== null) {
+        const assemblyFacts = artifactInput.result.assembly;
+        const artifactEvidence = sourceManagedEvidence(state, artifactInput.evidence, artifactInput.result.coverage.state);
         const assembly = createJavaScriptApplicationNode({
             kind: "managed-assembly",
-            identity: artifactLocalIdentity(state.artifactSha256, "managed-assembly", artifact.assembly.token),
+            identity: artifactLocalIdentity(state.artifactSha256, "managed-assembly", assemblyFacts.token),
             observations: [
                 {
-                    label: artifact.assembly.name,
+                    label: assemblyFacts.name,
                     properties: {
-                        name: artifact.assembly.name,
-                        version: artifact.assembly.version,
-                        culture: artifact.assembly.culture,
-                        public_key_kind: artifact.assembly.public_key.kind,
+                        name: assemblyFacts.name,
+                        version: assemblyFacts.version,
+                        culture: assemblyFacts.culture,
+                        public_key_kind: assemblyFacts.public_key.kind,
                     },
-                    evidence: managedEvidence(state, "inspect_managed_artifact", artifactCoverage),
+                    evidence: artifactEvidence,
                 },
             ],
         });
         state.nodes.push(assembly);
         addContainsEdge(state, artifactNode, assembly, {
             kind: "declares-managed-assembly",
-            coverage: artifactCoverage,
+            coverage: artifactEvidence.coverage,
         });
     }
-    const module = artifact?.module ??
-        parsed.members?.result.module ??
-        parsed.boundaries?.result.module;
-    if (module !== undefined && module !== null) {
-        const moduleCoverage = managedSourceCoverage(moduleCoverageState(parsed));
+    const moduleSource = selectModuleSource(parsed);
+    if (moduleSource !== null) {
+        const { module } = moduleSource;
+        const moduleEvidence = sourceManagedEvidence(state, moduleSource.evidence, moduleSource.coverageState);
         const moduleNode = createJavaScriptApplicationNode({
             kind: "managed-module",
             identity: artifactLocalIdentity(state.artifactSha256, "managed-module", module.mvid ?? module.token),
@@ -70,28 +69,51 @@ export const addArtifactIdentityNodes = (state, artifactNode, parsed) => {
                         generation: module.generation,
                         token: module.token,
                     },
-                    evidence: managedEvidence(state, "inspect_managed_artifact", moduleCoverage),
+                    evidence: moduleEvidence,
                 },
             ],
         });
         state.nodes.push(moduleNode);
         addContainsEdge(state, artifactNode, moduleNode, {
             kind: "declares-managed-module",
-            coverage: moduleCoverage,
+            coverage: moduleEvidence.coverage,
         });
     }
 };
+const selectModuleSource = (parsed) => {
+    if (parsed.artifact?.result.module != null)
+        return {
+            module: parsed.artifact.result.module,
+            evidence: parsed.artifact.evidence,
+            coverageState: parsed.artifact.result.coverage.state,
+        };
+    if (parsed.members?.result.module != null)
+        return {
+            module: parsed.members.result.module,
+            evidence: parsed.members.evidence,
+            coverageState: parsed.members.result.coverage.state,
+        };
+    if (parsed.boundaries?.result.module != null)
+        return {
+            module: parsed.boundaries.result.module,
+            evidence: parsed.boundaries.evidence,
+            coverageState: parsed.boundaries.result.coverage.state,
+        };
+    return null;
+};
 /** Add managed type, method, and field nodes from member evidence. */
 export const addMemberNodes = (state, artifactNode, parsed) => {
-    const members = parsed.members?.result;
-    if (members === undefined)
-        return { types: 0, methods: 0, fields: 0 };
+    const memberInput = parsed.members;
+    if (memberInput === null)
+        return;
+    const members = memberInput.result;
     const { types, methods, fields } = members;
     const typeCoverage = managedSourceCoverage(members.coverage.state);
     const methodCoverage = managedSourceCoverage(members.coverage.state);
     const fieldCoverage = managedSourceCoverage(members.coverage.state);
+    const sourceEvidence = sourceManagedEvidence(state, memberInput.evidence, members.coverage.state);
     for (const type of types) {
-        const node = typeNode(state, type, typeCoverage);
+        const node = typeNode(state, type, sourceEvidence);
         state.nodes.push(node);
         state.typeNodes.set(type.token, node);
         addContainsEdge(state, artifactNode, node, {
@@ -100,7 +122,7 @@ export const addMemberNodes = (state, artifactNode, parsed) => {
         });
     }
     for (const method of methods) {
-        const node = methodNode(state, method, methodCoverage);
+        const node = methodNode(state, method, sourceEvidence);
         state.nodes.push(node);
         state.methodNodes.set(method.token, node);
         const owner = method.declaring_type_token === null
@@ -112,7 +134,7 @@ export const addMemberNodes = (state, artifactNode, parsed) => {
         });
     }
     for (const field of fields) {
-        const node = fieldNode(state, field, fieldCoverage);
+        const node = fieldNode(state, field, sourceEvidence);
         state.nodes.push(node);
         state.fieldNodes.set(field.token, node);
         const owner = field.declaring_type_token === null
@@ -123,14 +145,9 @@ export const addMemberNodes = (state, artifactNode, parsed) => {
             coverage: fieldCoverage,
         });
     }
-    return {
-        types: types.length,
-        methods: methods.length,
-        fields: fields.length,
-    };
 };
 /** Build a managed type application node. */
-const typeNode = (state, type, coverage) => createJavaScriptApplicationNode({
+const typeNode = (state, type, evidence) => createJavaScriptApplicationNode({
     kind: "managed-type",
     identity: artifactLocalIdentity(state.artifactSha256, "managed-type-token", type.token),
     observations: [
@@ -144,12 +161,12 @@ const typeNode = (state, type, coverage) => createJavaScriptApplicationNode({
                 flags: type.flags,
                 extends_token: type.extends_token,
             },
-            evidence: managedEvidence(state, "inspect_managed_members", coverage),
+            evidence,
         },
     ],
 });
 /** Build a managed method application node. */
-const methodNode = (state, method, coverage) => createJavaScriptApplicationNode({
+const methodNode = (state, method, evidence) => createJavaScriptApplicationNode({
     kind: "managed-method",
     identity: artifactLocalIdentity(state.artifactSha256, "managed-method-token", method.token),
     observations: [
@@ -169,12 +186,12 @@ const methodNode = (state, method, coverage) => createJavaScriptApplicationNode(
                 normalized_il_sha256: method.body.normalized_il_sha256,
                 il_size: method.body.il_size,
             },
-            evidence: managedEvidence(state, "inspect_managed_members", coverage),
+            evidence,
         },
     ],
 });
 /** Build a managed field application node. */
-const fieldNode = (state, field, coverage) => createJavaScriptApplicationNode({
+const fieldNode = (state, field, evidence) => createJavaScriptApplicationNode({
     kind: "managed-field",
     identity: artifactLocalIdentity(state.artifactSha256, "managed-field-token", field.token),
     observations: [
@@ -191,24 +208,30 @@ const fieldNode = (state, field, coverage) => createJavaScriptApplicationNode({
                 signature_sha256: field.signature.raw_sha256,
                 signature_status: field.signature.parse_status,
             },
-            evidence: managedEvidence(state, "inspect_managed_members", coverage),
+            evidence,
         },
     ],
 });
 /** Add P/Invoke import and native implementation boundary nodes. */
 export const addBoundaryNodes = (state, artifactNode, parsed) => {
-    const boundaries = parsed.boundaries?.result;
-    if (boundaries === undefined)
-        return { pinvoke_imports: 0, native_implementations: 0 };
+    const boundaryInput = parsed.boundaries;
+    if (boundaryInput === null)
+        return;
+    const boundaries = boundaryInput.result;
     const { pinvoke_imports: pinvokes, native_implementations: implementations } = boundaries;
     const pinvokeCoverage = managedSourceCoverage(boundaries.coverage.state);
     const implementationCoverage = managedSourceCoverage(boundaries.coverage.state);
+    const sourceEvidence = sourceManagedEvidence(state, boundaryInput.evidence, boundaries.coverage.state);
     for (const pinvoke of pinvokes) {
-        const node = pinvokeNode(state, pinvoke, pinvokeCoverage);
+        const node = pinvokeNode(state, pinvoke, sourceEvidence);
         state.nodes.push(node);
-        const owner = pinvoke.member_token === null
-            ? artifactNode
-            : (state.methodNodes.get(pinvoke.member_token) ?? artifactNode);
+        const method = pinvoke.member_token === null
+            ? undefined
+            : state.methodNodes.get(pinvoke.member_token);
+        const memberEvidence = method === undefined || parsed.members === null
+            ? undefined
+            : parsed.members.evidence;
+        const owner = method ?? artifactNode;
         state.edges.push(createJavaScriptApplicationEdge({
             source_node_id: owner.node_id,
             target_node_id: node.node_id,
@@ -218,11 +241,11 @@ export const addBoundaryNodes = (state, artifactNode, parsed) => {
                 import_name: pinvoke.import_name,
                 import_scope_name: pinvoke.import_scope_name,
             },
-            evidence: managedEvidence(state, "inspect_managed_native_boundaries", pinvokeCoverage),
+            evidence: pinvokeAssociationEvidence(state, boundaryInput.evidence, pinvokeCoverage, memberEvidence),
         }));
     }
     for (const implementation of implementations) {
-        const node = nativeImplementationNode(state, implementation, implementationCoverage);
+        const node = nativeImplementationNode(state, implementation, sourceEvidence);
         state.nodes.push(node);
         const owner = state.methodNodes.get(implementation.token) ?? artifactNode;
         addContainsEdge(state, owner, node, {
@@ -230,13 +253,9 @@ export const addBoundaryNodes = (state, artifactNode, parsed) => {
             coverage: implementationCoverage,
         });
     }
-    return {
-        pinvoke_imports: pinvokes.length,
-        native_implementations: implementations.length,
-    };
 };
 /** Build a managed P/Invoke import application node. */
-const pinvokeNode = (state, pinvoke, coverage) => createJavaScriptApplicationNode({
+const pinvokeNode = (state, pinvoke, evidence) => createJavaScriptApplicationNode({
     kind: "managed-pinvoke-import",
     identity: artifactLocalIdentity(state.artifactSha256, "managed-pinvoke-token", pinvoke.token),
     observations: [
@@ -252,12 +271,12 @@ const pinvokeNode = (state, pinvoke, coverage) => createJavaScriptApplicationNod
                 call_convention: pinvoke.call_convention,
                 verification: pinvoke.verification,
             },
-            evidence: managedEvidence(state, "inspect_managed_native_boundaries", coverage),
+            evidence,
         },
     ],
 });
 /** Build a managed native implementation application node. */
-const nativeImplementationNode = (state, implementation, coverage) => createJavaScriptApplicationNode({
+const nativeImplementationNode = (state, implementation, evidence) => createJavaScriptApplicationNode({
     kind: "managed-native-implementation",
     identity: artifactLocalIdentity(state.artifactSha256, "managed-native-implementation-token", implementation.token),
     observations: [
@@ -273,7 +292,7 @@ const nativeImplementationNode = (state, implementation, coverage) => createJava
                 boundary_kind: implementation.boundary_kind,
                 body_interpretation: implementation.body_interpretation,
             },
-            evidence: managedEvidence(state, "inspect_managed_native_boundaries", coverage),
+            evidence,
         },
     ],
 });
@@ -284,7 +303,7 @@ const addContainsEdge = (state, source, target, options) => {
         target_node_id: target.node_id,
         relation: "contains",
         properties: { kind: options.kind },
-        evidence: managedEvidence(state, "project-managed-contains", options.coverage),
+        evidence: projectedManagedEvidence(state, "project-managed-contains", options.coverage),
     }));
 };
 /** Build an artifact-local key identity for a managed graph entity. */
@@ -296,7 +315,13 @@ const artifactLocalIdentity = (artifactSha256, namespace, key) => ({
     key,
 });
 /** Build managed static-analysis evidence for a graph observation. */
-const managedEvidence = (state, operation, coverage = managedSourceCoverage("complete")) => ({
+const sourceManagedEvidence = (state, source, coverageState) => createManagedEvidence(state, source.operation, managedSourceCoverage(coverageState), [source.evidence_id]);
+const projectedManagedEvidence = (state, operation, coverage = managedSourceCoverage("complete")) => createManagedEvidence(state, operation, coverage, state.evidenceLinks);
+const pinvokeAssociationEvidence = (state, boundaryEvidence, coverage, memberEvidence) => createManagedEvidence(state, boundaryEvidence.operation, coverage, [
+    boundaryEvidence.evidence_id,
+    ...(memberEvidence === undefined ? [] : [memberEvidence.evidence_id]),
+]);
+const createManagedEvidence = (state, operation, coverage, evidenceIds) => ({
     authority: "managed-static-analysis",
     state: "observed",
     confidence: "exact",
@@ -324,7 +349,7 @@ const managedEvidence = (state, operation, coverage = managedSourceCoverage("com
         : [
             "The source managed Evidence slice is incomplete; unreturned or unavailable items remain unobserved.",
         ],
-    evidence_ids: state.evidenceLinks,
+    evidence_ids: [...evidenceIds],
 });
 /** Sanitize an artifact path into a managed graph location. */
 const graphArtifactPath = (path) => {

package/dist/domain/managed/managedArtifact.js

@@ -413,7 +413,8 @@ export const managedNativeBoundaryInspectionSchema = z.object({
         requires_artifact_sha256: digestSchema,
         requires_mvid: cliMetadataGuidSchema.nullable(),
     }),
-    cli_native: z.object({
+    cli_native: z
+        .object({
         il_only: z.boolean(),
         requires_32bit: z.boolean(),
         strong_name_signed: z.boolean(),
@@ -421,7 +422,8 @@ export const managedNativeBoundaryInspectionSchema = z.object({
         ready_to_run_signature: z.boolean(),
         managed_native_header_rva: z.number().int().min(0).max(0xffff_ffff),
         managed_native_header_size: z.number().int().min(0).max(0xffff_ffff),
-    }),
+    })
+        .nullable(),
     module_refs: z.array(managedModuleReferenceSchema),
     pinvoke_imports: z.array(managedNativeImportSchema),
     native_implementations: z.array(managedNativeImplementationSchema),
@@ -429,8 +431,8 @@ export const managedNativeBoundaryInspectionSchema = z.object({
         module_ref_count: z.number().int().min(0),
         pinvoke_import_count: z.number().int().min(0),
         native_implementation_count: z.number().int().min(0),
-        ready_to_run: z.boolean(),
-        mixed_mode_or_native_header: z.boolean(),
+        ready_to_run: z.boolean().nullable(),
+        mixed_mode_or_native_header: z.boolean().nullable(),
     }),
     coverage: z.object({
         state: z.enum(["complete", "partial", "unavailable"]),

package/dist/domain/managed/managedMemberComparison.js

@@ -165,18 +165,12 @@ export const managedMemberComparisonResultSchema = z.strictObject({
 });
 /** Compare managed members with constrained exact and structural identities. */
 export const compareManagedMembers = (left, right) => {
-    const leftCoverage = {
-        sourceComplete: left.result.coverage.state === "complete",
-    };
-    const rightCoverage = {
-        sourceComplete: right.result.coverage.state === "complete",
-    };
     const { methodMatches, fieldMatches } = keyMembers(left, right);
     const itemContext = {
         leftEvidenceId: left.evidenceId,
         rightEvidenceId: right.evidenceId,
-        leftComplete: leftCoverage.sourceComplete,
-        rightComplete: rightCoverage.sourceComplete,
+        leftComplete: left.result.metadata.status === "complete",
+        rightComplete: right.result.metadata.status === "complete",
     };
     const methodItems = buildMethodItems(methodMatches, itemContext);
     const fieldItems = buildFieldItems(fieldMatches, itemContext);
@@ -212,4 +206,3 @@ export const compareManagedMembers = (left, right) => {
     };
     return managedMemberComparisonResultSchema.parse(result);
 };
-export { parseManagedMemberEvidence } from "./managedMemberComparisonMatch.js";

package/dist/domain/managed/managedMemberComparisonMatch.js

@@ -11,21 +11,21 @@ export const sha256 = (value) => {
 const keyMethod = (item) => ({
     item,
     exactKey: item.body.status === "present" && item.body.normalized_il_sha256 !== null
-        ? stableKey([
+        ? sha256([
             "method-exact",
             item.signature.raw_sha256,
             item.body.normalized_il_sha256,
         ])
         : null,
     // The raw blob is the exact signature; decoding only feeds shape keys.
-    signatureKey: stableKey([
+    signatureKey: sha256([
         "method-signature",
         item.declaring_type,
         item.name,
         item.signature.raw_sha256,
     ]),
     structuralKey: item.signature.parse_status === "decoded" && item.body.status === "present"
-        ? stableKey([
+        ? sha256([
             "method-structural",
             item.signature.kind,
             item.signature.calling_convention,
@@ -56,24 +56,23 @@ const keyMethod = (item) => ({
 const keyField = (item) => ({
     item,
     exactKey: item.signature.parse_status === "decoded"
-        ? stableKey(["field-exact", item.signature.raw_sha256])
+        ? sha256(["field-exact", item.signature.raw_sha256])
         : null,
     // Only an undecoded field reaches this round: a decoded field with the
     // same raw signature already met its counterpart in the exact round.
-    signatureKey: stableKey([
+    signatureKey: sha256([
         "field-signature",
         item.declaring_type,
         item.name,
         item.signature.raw_sha256,
     ]),
-    structuralKey: stableKey([
+    structuralKey: sha256([
         "field-structural",
         item.signature.kind,
         item.signature.field_type,
         item.flags,
     ]),
 });
-const stableKey = (value) => sha256(value);
 const matchMethods = (left, right) => matchByKeys({
     left,
     right,

package/dist/domain/managed/managedNativeVerification.js

@@ -4,8 +4,6 @@ import { managedNativeBoundaryInspectionSchema, } from "./managedArtifact.js";
 import { parseManagedInspectionEvidence } from "./managedInspectionEvidence.js";
 import { managedNativeVerificationResultSchema, } from "./managedNativeVerificationSchemas.js";
 import { buildVerificationResult, collectNativeSymbols, verifyPinvoke, } from "./managedNativeVerificationMatch.js";
-export { managedNativeVerificationInputSchema, } from "./managedNativeVerificationSchemas.js";
-export { managedNativeVerificationResultSchema };
 const sha256 = (value) => {
     const serialized = canonicalize(value);
     if (serialized === undefined)

package/dist/domain/managed/managedNativeVerificationMatch.js

@@ -71,16 +71,22 @@ const sameSymbolName = (expected, native) => expected ===
         : native.name);
 const normalizeModule = (value) => basename(value)
     .toLowerCase()
-    .replace(/^lib/u, "")
     .replace(/\.(dll|dylib|so|node|exe)$/u, "");
+const nativeModuleIdentities = (value) => {
+    const filename = basename(value).toLowerCase();
+    const stem = normalizeModule(filename);
+    const identities = new Set([stem]);
+    if (/\.(dylib|so)$/u.test(filename) && stem.startsWith("lib"))
+        identities.add(stem.slice("lib".length));
+    return identities;
+};
 const moduleCompatible = (scope, symbol) => {
     if (scope === null)
         return true;
     const expected = normalizeModule(scope);
     return [symbol.module_name, symbol.module_path]
         .filter((value) => value !== null)
-        .map(normalizeModule)
-        .some((value) => value === expected);
+        .some((value) => nativeModuleIdentities(value).has(expected));
 };
 const candidateNames = (managed) => {
     const names = new Set([managed.import_name]);

package/dist/domain/native/binaryLayout.js

@@ -1,11 +1,10 @@
 import { z } from "zod";
+import { CANONICAL_BASE64_PATTERN } from "../stringPatterns.js";
 const unsignedHex = z.string().regex(/^0x(?:0|[1-9a-f][0-9a-f]{0,15})$/);
 const index = z.number().int().nonnegative();
 const scalar = z.union([z.string(), z.number().int()]);
 const range = z.strictObject({ offset: unsignedHex, bytes: unsignedHex });
-const canonicalBase64 = z
-    .string()
-    .regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/][AQgw]==|[A-Za-z0-9+/]{2}[AEIMQUYcgkosw048]=)?$/);
+const canonicalBase64 = z.string().regex(CANONICAL_BASE64_PATTERN);
 const name = z.strictObject({
     display: z.string(),
     bytes_base64: canonicalBase64.nullable(),

package/dist/domain/native/nativeApiBoundary.js

@@ -71,7 +71,7 @@ const inferredJumpTableSchema = z
     dispatch_address: z.string().min(1),
     data_sources: z.array(jumpTableDataSourceSchema),
     mappings: z.array(jumpTableMappingSchema),
-    default_targets: z.array(jumpTableDefaultTargetSchema).default([]),
+    default_targets: z.array(jumpTableDefaultTargetSchema),
     limitations: z.array(z.string()),
 })
     .strict();

package/dist/domain/native/nativeCallObservation.js

@@ -3,11 +3,11 @@ import { localPathStringSchema } from "../localPath.js";
 const hexSchema = z.string().regex(/^0x[0-9a-f]+$/u);
 const nativeString = z
     .string()
-    .regex(/^[^\0]*$/u, "Native launch and breakpoint strings cannot contain NUL");
+    .regex(/^[^\x00]*$/u, "Native launch and breakpoint strings cannot contain NUL");
 /** Objective-C class names and selectors never contain spaces or brackets. */
 const objcName = nativeString
     .min(1)
-    .regex(/^[^\s[\]]+$/u, "Use the bare name without spaces or brackets");
+    .regex(/^[^\s\x5b\x5d]+$/u, "Use the bare name without spaces or brackets");
 const functionBreakpoint = {
     kind: z.literal("function"),
     name: nativeString
@@ -46,7 +46,7 @@ export const nativeCallObservationInputSchema = z.strictObject({
         .record(z
         .string()
         .min(1)
-        .regex(/^[^=\0]+$/u, "Environment names cannot contain '=' or NUL"), z.string().regex(/^[^\0]*$/u, "Environment values cannot contain NUL"))
+        .regex(/^[^=\x00]+$/u, "Environment names cannot contain '=' or NUL"), z.string().regex(/^[^\x00]*$/u, "Environment values cannot contain NUL"))
         .default({})
         .describe("Overrides on top of the environment REA runs with."),
     working_directory: localPathStringSchema.optional(),

package/dist/domain/native/nativeInstruction.js

@@ -54,6 +54,13 @@ export const nativeInstructionSchema = z.strictObject({
         conditional: z.boolean(),
         computed: z.boolean(),
         direct_destinations: z.array(z.string()),
+        classification_evidence: z
+            .array(z.strictObject({
+            source: z.string().min(1),
+            value: z.string().min(1),
+        }))
+            .optional()
+            .describe("Observed provider facts used to classify flow; older captures or other providers may omit them."),
     }),
     references: z.array(reference),
     limitations: z.array(z.string()),

package/dist/domain/native/nativeValueFlow.js

@@ -16,9 +16,7 @@ export const nativePcodeOperationSchema = z.strictObject({
     sequence: z.number().int().nonnegative(),
     opcode: z.string().min(1),
     is_dead: z.boolean(),
-    block_membership: z
-        .enum(["member", "detached", "unavailable"])
-        .default("unavailable"),
+    block_membership: z.enum(["member", "detached", "unavailable"]),
     inputs: z.array(nativeVarnodeSchema),
     output: nativeVarnodeSchema.nullable(),
 });
@@ -50,20 +48,16 @@ export const nativeValueFlowSchema = z.discriminatedUnion("available", [
         operations: z.array(nativePcodeOperationSchema),
         def_use: z.array(nativePcodeDefUseSchema),
         effects: z.array(nativePcodeEffectSchema),
-        parameters: z
-            .array(z.strictObject({
+        parameters: z.array(z.strictObject({
             ordinal: z.number().int().nonnegative(),
             name: z.string(),
             data_type: z.string(),
-        }))
-            .default([]),
-        parameter_uses: z
-            .array(z.strictObject({
+        })),
+        parameter_uses: z.array(z.strictObject({
             ordinal: z.number().int().nonnegative(),
             use: z.string(),
             input_index: z.number().int().nonnegative(),
-        }))
-            .default([]),
+        })),
         truncated: z.boolean(),
         omitted_operations_lower_bound: z.number().int().nonnegative(),
         known_omitted_inputs: z.number().int().nonnegative(),