rea-agents 6.1.0 → 6.3.0

package/dist/domain/process/processObservation.js

@@ -1,5 +1,11 @@
 import { z } from "zod";
 import { jsonValueSchema } from "../jsonValue.js";
+/** Project normalized PTY facts without source text used only for audit. */
+export const comparableTerminalFrame = (frame) => ({
+    sequence: frame.sequence,
+    at_ms: frame.at_ms,
+    data: frame.data,
+});
 /** Process-capture observation families shared by live drivers and trace assertions. */
 export const processObservationSourceSchema = z.enum([
     "terminal_raw",
@@ -67,11 +73,13 @@ export const processObservationSubject = (source, value) => {
 const projectedRecord = (capture, location) => {
     const projected = (() => {
         switch (location.collection) {
-            case "frames":
+            case "frames": {
+                const frame = capture.frames[location.index];
                 return {
                     source: "terminal_raw",
-                    value: capture.frames[location.index],
+                    value: frame === undefined ? undefined : comparableTerminalFrame(frame),
                 };
+            }
             case "rendered_frames":
                 return {
                     source: "terminal_rendered",

package/dist/domain/process/processScenario.js

@@ -4,17 +4,36 @@ import { z } from "zod";
 const positiveBudget = z.number().int().safe().positive();
 const timedEventBase = { at_ms: z.number().int().safe().nonnegative() };
 const reservedRunIdEnvironmentName = "REA_PROCESS_RUN_ID";
+const ENVIRONMENT_NAME_CHARACTER = "[^=\\x00]";
+/**
+ * Nonempty environment names other than the reserved run identifier. The
+ * exclusion is spelled as a complement instead of a negative look-ahead,
+ * because RE2 and Rust schema validators reject look-around and would refuse
+ * every tool in the advertised catalog.
+ */
+const environmentNamePattern = (reserved) => {
+    // After the complete reserved name, at least one more character is needed.
+    let rest = `${ENVIRONMENT_NAME_CHARACTER}+`;
+    for (let index = reserved.length - 1; index >= 0; index -= 1) {
+        const character = reserved[index] ?? "";
+        // Diverge here, match the next reserved character, or (after a nonempty
+        // prefix) end the name early.
+        const choice = `[^=\\x00${character}]${ENVIRONMENT_NAME_CHARACTER}*|${character}${rest}`;
+        rest = index === 0 ? choice : `(?:${choice})?`;
+    }
+    return new RegExp(`^(?:${rest})$`, "u");
+};
 const environmentName = z
     .string()
     .min(1, "Environment names must not be empty")
-    .regex(/^(?!REA_PROCESS_RUN_ID(?![\s\S]))[^=\0]+$/u, {
+    .regex(environmentNamePattern(reservedRunIdEnvironmentName), {
     error: (issue) => issue.input === reservedRunIdEnvironmentName
         ? `${reservedRunIdEnvironmentName} is reserved by the process adapter`
         : "Environment names cannot contain '=' or NUL",
 });
 const childProcessString = z
     .string()
-    .regex(/^[^\0]*$/u, "Values passed to operating-system APIs cannot contain NUL");
+    .regex(/^[^\x00]*$/u, "Values passed to operating-system APIs cannot contain NUL");
 export const normalizationSchema = z.object({
     paths: z.boolean(),
     pids: z.boolean(),
@@ -62,6 +81,9 @@ export const processComparisonContract = (scenario) => ({
     settle_ms: scenario.settle_ms,
     limits: scenario.limits,
     normalization: scenario.normalization,
+    ...(scenario.normalization.ports
+        ? { port_normalization_version: "contextual-endpoints-v2" }
+        : {}),
 });
 /**
  * Boundary schema for one bounded process experiment.

package/dist/domain/process/processTraceComparison.js

@@ -1,7 +1,5 @@
 import { evaluateProcessTraceSide, processTraceComparisonResultSchema, } from "./processTraceEvaluation.js";
 import { processTraceSpecificationSchema, } from "./processTraceSpecification.js";
-export { processTraceComparisonResultSchema, } from "./processTraceEvaluation.js";
-export { processTraceSpecificationSchema, } from "./processTraceSpecification.js";
 /** Compare two captures against an explicit finite trace language. */
 export const compareProcessTraces = (left, right, specificationInput) => {
     const specification = processTraceSpecificationSchema.parse(specificationInput);

package/dist/domain/process/processTraceDimensionProjection.js

@@ -1,4 +1,4 @@
-/** Map declared trace sources to legacy process-comparison dimensions. */
+/** Map declared trace sources to process-comparison dimensions. */
 export const dimensionsForTraceSources = (sources) => {
     const dimensions = new Set();
     for (const source of sources) {

package/dist/domain/process/processTraceEvaluation.js

@@ -1,11 +1,11 @@
 import { z } from "zod";
-import { processObservationLocationSchema, projectProcessObservation, } from "./processObservation.js";
-import { canonicalTraceJson, comparableTracePayload, processTraceCardinalityBounds, } from "./processTraceSpecification.js";
-const identifierSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9._-]{0,63}$/u);
-const locationSchema = processObservationLocationSchema;
+import { processSourceTruncated } from "./processCaptureCoverage.js";
+import { comparableProcessObservationPayload, processObservationLocationSchema, projectProcessObservation, } from "./processObservation.js";
+import { canonicalTraceJson, processTraceCardinalityBounds, } from "./processTraceSpecification.js";
+const identifierSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9._\x2d]{0,63}$/u);
 const matchedEventSchema = z.strictObject({
     event_id: identifierSchema,
-    location: locationSchema,
+    location: processObservationLocationSchema,
 });
 const sideResultShape = {
     satisfied_constraints: z.array(z.string()),
@@ -36,7 +36,7 @@ const diagnosticSchema = z.strictObject({
     side: z.enum(["left", "right"]),
     message: z.string(),
     event_ids: z.array(identifierSchema),
-    locations: z.array(locationSchema),
+    locations: z.array(processObservationLocationSchema),
 });
 /** Structured verdict for one declared process trace language. */
 export const processTraceComparisonResultSchema = z.strictObject({
@@ -56,11 +56,11 @@ const scopesFor = (sources) => new Set([...sources].map((source) => {
         return "process";
     return "interaction";
 }));
-const unknownSide = () => ({
+const unknownSide = (rawTrace = []) => ({
     status: "unknown",
     matched_variant: null,
     satisfied_constraints: [],
-    raw_trace: [],
+    raw_trace: rawTrace,
 });
 const failure = (input) => ({
     result: {
@@ -102,7 +102,7 @@ const evaluateFiniteTrace = (ids, specification) => {
 };
 const collectRecords = (capture, sources) => {
     const records = [];
-    for (const location of capture.event_journal ?? []) {
+    for (const location of capture.event_journal) {
         const record = projectProcessObservation(capture, location);
         if (record !== null && sources.has(record.source))
             records.push({
@@ -121,10 +121,10 @@ const matchRecords = (records, specification) => {
     for (const event of specification.events) {
         const ignoredFields = event.ignore_fields ?? [];
         ignoredFieldsBySource.set(event.source, ignoredFields);
-        eventsByKey.set(`${event.source}\0${canonicalTraceJson(comparableTracePayload(event.exact, ignoredFields))}`, event);
+        eventsByKey.set(`${event.source}\0${canonicalTraceJson(comparableProcessObservationPayload(event.exact, ignoredFields))}`, event);
     }
     for (const record of records) {
-        const match = eventsByKey.get(`${record.source}\0${canonicalTraceJson(comparableTracePayload(record.payload, ignoredFieldsBySource.get(record.source)))}`);
+        const match = eventsByKey.get(`${record.source}\0${canonicalTraceJson(comparableProcessObservationPayload(record.payload, ignoredFieldsBySource.get(record.source)))}`);
         if (match === undefined)
             return failure({
                 kind: "predicate",
@@ -296,10 +296,9 @@ const evaluateMatchedTrace = (trace, specification) => {
 export const evaluateProcessTraceSide = (capture, specification) => {
     const sources = new Set(specification.events.map(({ source }) => source));
     const relevantScopes = scopesFor(sources);
-    if (capture.truncated ||
-        capture.residual_unknowns.some(({ scope }) => relevantScopes.has(scope)))
-        return { result: unknownSide(), diagnostic: null };
-    if ((capture.event_journal ?? []).length === 0)
+    const incomplete = [...sources].some((source) => processSourceTruncated(capture, source)) ||
+        capture.residual_unknowns.some(({ scope }) => relevantScopes.has(scope));
+    if (capture.event_journal.length === 0)
         return {
             result: unknownSide(),
             diagnostic: {
@@ -310,6 +309,11 @@ export const evaluateProcessTraceSide = (capture, specification) => {
             },
         };
     const matched = matchRecords(collectRecords(capture, sources), specification);
+    if (incomplete)
+        return {
+            result: unknownSide("rawTrace" in matched ? matched.rawTrace : matched.result.raw_trace),
+            diagnostic: null,
+        };
     return "rawTrace" in matched
         ? evaluateMatchedTrace(matched, specification)
         : matched;

package/dist/domain/process/processTraceSpecification.js

@@ -1,10 +1,9 @@
 import canonicalize from "canonicalize";
 import { z } from "zod";
+import { IDENTIFIER_PATTERN } from "../stringPatterns.js";
 import { jsonValueSchema } from "../jsonValue.js";
 import { comparableProcessObservationPayload, processObservationSourceSchema, } from "./processObservation.js";
-const identifierSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9._-]*$/u);
-/** Process observation families admitted by a declared trace specification. */
-export const processTraceSourceSchema = processObservationSourceSchema;
+const identifierSchema = z.string().regex(IDENTIFIER_PATTERN);
 const cardinalitySchema = z.discriminatedUnion("kind", [
     z.strictObject({ kind: z.literal("required") }),
     z.strictObject({ kind: z.literal("optional") }),
@@ -25,7 +24,7 @@ const cardinalitySchema = z.discriminatedUnion("kind", [
 ]);
 const eventDeclarationSchema = z.strictObject({
     id: identifierSchema,
-    source: processTraceSourceSchema,
+    source: processObservationSourceSchema,
     exact: jsonValueSchema,
     ignore_fields: z
         .array(z.enum([
@@ -87,8 +86,6 @@ export const canonicalTraceJson = (value) => {
         throw new TypeError("Trace specification contains a non-JSON value");
     return serialized;
 };
-/** Remove only explicitly declared schedule metadata before exact matching. */
-export const comparableTracePayload = (value, ignoredFields = []) => comparableProcessObservationPayload(value, ignoredFields);
 export const processTraceCardinalityBounds = (cardinality) => {
     switch (cardinality.kind) {
         case "required":
@@ -353,7 +350,7 @@ export const processTraceSpecificationSchema = specificationShapeSchema.superRef
                 message: "exact payload must omit every ignored schedule field",
                 path: ["events", index, "exact"],
             });
-        const predicate = `${event.source}\0${canonicalTraceJson(comparableTracePayload(event.exact, ignoredFields))}`;
+        const predicate = `${event.source}\0${canonicalTraceJson(comparableProcessObservationPayload(event.exact, ignoredFields))}`;
         if (predicates.has(predicate))
             context.addIssue({
                 code: "custom",

package/dist/domain/providerAdapterError.js

@@ -4,11 +4,13 @@ export class ProviderAdapterError extends AnalysisError {
     providerId;
     operation;
     _tag = "ProviderAdapterError";
+    userMessage;
     diagnostics;
     constructor(providerId, operation, options = {}) {
         super(`Provider ${providerId} adapter failed during ${operation}`, options);
         this.providerId = providerId;
         this.operation = operation;
+        this.userMessage = options.userMessage;
         this.diagnostics =
             options.diagnostics === undefined
                 ? undefined

package/dist/domain/providerCleanupError.js

@@ -7,8 +7,12 @@ export class ProviderCleanupError extends ProviderAdapterError {
     constructor(providerId, resources, diagnostics, 
     /** Identify the operation owning these resources; binary callers retain their default. */
     options) {
-        const { operation = "close_binary", ...errorOptions } = options ?? {};
-        super(providerId, operation, { ...errorOptions, diagnostics });
+        const { operation = "close_binary", partialObservation, ...errorOptions } = options ?? {};
+        super(providerId, operation, {
+            ...errorOptions,
+            ...(partialObservation === undefined ? {} : { partialObservation }),
+            diagnostics,
+        });
         this.cleanupResources = [...resources];
     }
 }

package/dist/domain/reconstructionCoverage.js

@@ -1,12 +1,16 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
+import { compareUnicodeCodePoints, compositeKey, } from "./unicodeCodePointOrder.js";
 import { evidenceBundleSchema, parseEvidenceBundle } from "./evidenceBundle.js";
 import { evaluateReconstructionClaims, evaluateReconstructionPackageProofs, evaluateReconstructionSurfaces, evaluateReconstructionCoverageRisks, recommendedReconstructionProbes, } from "./reconstructionCoverageEvaluation.js";
 import { digestSchema } from "./../domain/digests.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
+import { offsetDateTimeSchema } from "./offsetDateTime.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
-const stableIdSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9._:/-]{0,199}$/u);
+const stableIdSchema = z
+    .string()
+    .regex(/^[A-Za-z][A-Za-z0-9._:\x2f\x2d]{0,199}$/u);
 const boundedTextSchema = z.string().trim().min(1);
 const authoritySchema = z.enum([
     "observed",
@@ -86,7 +90,7 @@ const verifierContractSchema = verifierContractBaseSchema.extend({
 const verifierResultSchema = z.strictObject({
     verifier_id: stableIdSchema,
     contract_sha256: digestSchema,
-    observed_at: z.string().datetime({ offset: true }),
+    observed_at: offsetDateTimeSchema,
     status: z.enum([
         "pass",
         "fail",
@@ -312,7 +316,7 @@ const closureStatus = (reasons) => {
         return "unknown";
     return "partial";
 };
-const reasonOrder = (left, right) => `${left.code}:${left.subject_id}`.localeCompare(`${right.code}:${right.subject_id}`);
+const reasonOrder = (left, right) => compareUnicodeCodePoints(compositeKey([left.code, left.subject_id]), compositeKey([right.code, right.subject_id]));
 const digest = (value) => {
     const encoded = canonicalize(value);
     if (encoded === undefined)

package/dist/domain/reconstructionObligationLedgerSchemas.js

@@ -1,9 +1,10 @@
 import { z } from "zod";
+import { STABLE_IDENTIFIER_PATTERN } from "./stringPatterns.js";
 import { evidenceBundleSchema } from "./evidenceBundle.js";
 import { digestSchema } from "./../domain/digests.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
-const stableIdSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9._:/-]*$/u);
+const stableIdSchema = z.string().regex(STABLE_IDENTIFIER_PATTERN);
 const textSchema = z.string().trim().min(1);
 export const obligationStatusSchema = z.enum([
     "unowned",

package/dist/domain/reconstructionReadinessSchemas.js

@@ -1,10 +1,11 @@
 import { z } from "zod";
+import { STABLE_IDENTIFIER_PATTERN } from "./stringPatterns.js";
 import { evidenceBundleSchema } from "./evidenceBundle.js";
 import { reconstructionObligationLedgerSchema } from "./reconstructionObligationLedgerSchemas.js";
 import { digestSchema } from "./../domain/digests.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
-const stableIdSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9._:/-]*$/u);
+const stableIdSchema = z.string().regex(STABLE_IDENTIFIER_PATTERN);
 const boundedTextSchema = z.string().trim().min(1);
 export const readinessStatusSchema = z.enum([
     "pass",

package/dist/domain/reconstructionUnknowns.js

@@ -1,4 +1,5 @@
 import { uniqueSorted } from "./canonicalOrdering.js";
+import { compareUnicodeCodePoints, compositeKey, } from "./unicodeCodePointOrder.js";
 /** Select the latest revision of each residual unknown. */
 export const reconstructionUnknownHeads = (revisions) => {
     const heads = new Map();
@@ -44,7 +45,7 @@ export const reconstructionClaimUnknowns = (heads, comparisonId, sourceIds) => {
         const unknown = heads.get(id);
         return unknown === undefined ? [] : [unknown];
     })
-        .sort((left, right) => left.unknown_id.localeCompare(right.unknown_id, "en"));
+        .sort((left, right) => compareUnicodeCodePoints(left.unknown_id, right.unknown_id));
 };
 /** Aggregate deterministic probes for unresolved claims. */
 export const reconstructionProbes = (results, heads) => {
@@ -57,7 +58,7 @@ export const reconstructionProbes = (results, heads) => {
         const probes = unknowns.flatMap(({ recommended_probes: items }) => items);
         const candidates = probes.length > 0 ? probes : [defaultProbe(result.kind)];
         for (const probe of candidates) {
-            const key = `${probe.operation}\0${probe.rationale}`;
+            const key = compositeKey([probe.operation, probe.rationale]);
             const current = output.get(key) ?? {
                 ...probe,
                 claim_ids: [],
@@ -71,7 +72,7 @@ export const reconstructionProbes = (results, heads) => {
             output.set(key, current);
         }
     }
-    const sorted = [...output.values()].sort((left, right) => `${left.operation}\0${left.rationale}`.localeCompare(`${right.operation}\0${right.rationale}`, "en"));
+    const sorted = [...output.values()].sort((left, right) => compareUnicodeCodePoints(compositeKey([left.operation, left.rationale]), compositeKey([right.operation, right.rationale])));
     return sorted;
 };
 const defaultProbe = (kind) => kind === "behavioral"

package/dist/domain/reconstructionVerification.js

@@ -4,16 +4,17 @@ import { z } from "zod";
 import { artifactComparisonResultSchema } from "./artifactComparison.js";
 import { artifactInventoryResultSchema } from "./artifactGraph.js";
 import { uniqueSorted } from "./canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 import { comparisonSourceEvidenceSides } from "./comparisonSourceEvidence.js";
 import { parseEvidence } from "./evidence.js";
 import { parseEvidenceBundle } from "./evidenceBundle.js";
-import { functionComparisonResultSchema } from "./functionComparison.js";
+import { functionComparisonResultSchema } from "./functionComparisonSchemas.js";
 import { PROCESS_PROVIDER, isProcessEvidenceProvider, } from "./process/processEvidenceProvider.js";
 import { functionDossierSchema } from "./hopperValues.js";
-import { deriveProcessComparisonStatus, PROCESS_COMPARISON_DIMENSIONS, processCaptureComparisonSchema, parseProcessCapture, } from "./process/processCapture.js";
+import { deriveProcessComparisonStatus, PROCESS_COMPARISON_DIMENSIONS, processCaptureComparisonSchema, } from "./process/processComparison.js";
+import { parseProcessCapture } from "./process/processCaptureParsing.js";
 import { reconstructionClaimResultSchema, reconstructionSpecificationSchema, reconstructionVerificationResultSchema, } from "./reconstructionVerificationSchemas.js";
 import { reconstructionClaimUnknowns, reconstructionProbes, reconstructionUnknownHeads, } from "./reconstructionUnknowns.js";
-export { reconstructionVerificationInputSchema, reconstructionVerificationResultSchema, } from "./reconstructionVerificationSchemas.js";
 const providers = {
     behavioral: {
         operation: "compare_process_captures",
@@ -42,7 +43,7 @@ export const verifyReconstruction = (specificationInput, bundleInput) => {
     const heads = reconstructionUnknownHeads(bundle.unknowns);
     const results = specification.claims
         .map((claim) => evaluateClaim(claim, records, heads))
-        .sort((left, right) => left.claim_id.localeCompare(right.claim_id, "en"));
+        .sort((left, right) => compareUnicodeCodePoints(left.claim_id, right.claim_id));
     const failed = count(results, "fail");
     const unresolved = count(results, "unknown");
     const probes = reconstructionProbes(results, heads);
@@ -51,7 +52,7 @@ export const verifyReconstruction = (specificationInput, bundleInput) => {
         status: failed > 0 ? "fail" : unresolved > 0 ? "unknown" : "pass",
         specification_sha256: digest({
             ...specification,
-            claims: [...specification.claims].sort((left, right) => left.claim_id.localeCompare(right.claim_id, "en")),
+            claims: [...specification.claims].sort((left, right) => compareUnicodeCodePoints(left.claim_id, right.claim_id)),
         }),
         summary: {
             total: results.length,

package/dist/domain/reconstructionVerificationSchemas.js

@@ -1,10 +1,11 @@
 import { z } from "zod";
+import { IDENTIFIER_PATTERN } from "./stringPatterns.js";
 import { digestSchema } from "./../domain/digests.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 import { PROCESS_COMPARISON_DIMENSIONS } from "./process/processComparison.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const unknownIdSchema = prefixedDigestSchema("unk");
-const claimIdSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9._-]*$/u);
+const claimIdSchema = z.string().regex(IDENTIFIER_PATTERN);
 const titleSchema = z.string().trim().min(1);
 const verificationStatusSchema = z.enum(["pass", "fail", "unknown"]);
 const commonClaim = {

package/dist/domain/referenceSourceGraph.js

@@ -1,6 +1,7 @@
 import { posix } from "node:path";
 import { z } from "zod";
-import { canonicalDigest, canonicalJson } from "./comparisonSemantics.js";
+import { canonicalJson } from "./comparisonSemantics.js";
+import { digestCanonicalValue } from "./canonicalDigest.js";
 import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 import { digestSchema } from "./../domain/digests.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
@@ -66,26 +67,27 @@ const sourceDirectorySchema = z.strictObject({
 const symlinkTargetSchema = z
     .string()
     .min(1)
-    .refine((target) => target === "<outside-root>" ||
-    isPortableAbsoluteSymlinkTarget(target) ||
+    .refine((target) => isPortableAbsoluteSymlinkTarget(target) ||
     (!target.startsWith("/") &&
         !target.includes("\\") &&
         posix.normalize(target) === target), "Expected a normalized POSIX symlink target");
 const isPortableAbsoluteSymlinkTarget = (target) => target.startsWith("/") ||
     /^[A-Za-z]:[\\/]/u.test(target) ||
     /^\\\\[^\\/]+[\\/][^\\/]+/u.test(target);
-const sourceSymlinkSchema = z.strictObject({
-    ...entryBaseShape,
-    kind: z.literal("symlink"),
-    target: symlinkTargetSchema,
-    target_state: z.enum([
-        "internal",
-        "external",
-        "missing",
-        "unreadable",
-        "unknown",
-    ]),
-});
+const sourceSymlinkSchema = z.union([
+    z.strictObject({
+        ...entryBaseShape,
+        kind: z.literal("symlink"),
+        target: symlinkTargetSchema,
+        target_state: z.enum(["internal", "external", "missing"]),
+    }),
+    z.strictObject({
+        ...entryBaseShape,
+        kind: z.literal("symlink"),
+        target: z.null(),
+        target_state: z.enum(["unreadable", "unknown"]),
+    }),
+]);
 const sourceEntrySchema = z.union([
     sourceFileSchema,
     sourceDirectorySchema,
@@ -108,8 +110,6 @@ const exclusionSchema = z.strictObject({
     reason: z.enum([
         "configured-secret",
         "symlink-escape",
-        "size-limit",
-        "inventory-limit",
         "unreadable",
         "caller-excluded",
     ]),
@@ -152,7 +152,7 @@ const graphShape = {
         caller: z
             .string()
             .min(1)
-            .regex(/^[\w .:@/+-]+$/u),
+            .regex(/^[\w .:@\x2f+\x2d]+$/u),
     }),
     limitations: z.array(boundedTextSchema),
 };
@@ -232,13 +232,11 @@ const checkSymlinks = (graph, paths, context) => {
     for (const [index, entry] of graph.entries.entries()) {
         if (entry.kind !== "symlink")
             continue;
+        if (entry.target === null)
+            continue;
         const absolute = isPortableAbsoluteSymlinkTarget(entry.target);
-        if ((entry.target_state === "external" &&
-            entry.target !== "<outside-root>" &&
-            !absolute) ||
-            (entry.target_state === "internal" &&
-                (entry.target === "<outside-root>" || absolute)) ||
-            (entry.target_state === "missing" && entry.target === "<outside-root>"))
+        if ((entry.target_state === "external" && !absolute) ||
+            (entry.target_state === "internal" && absolute))
             context.addIssue({
                 code: "custom",
                 message: "Symlink target path does not match its target state",
@@ -332,7 +330,7 @@ const rootCommitment = (entries, exclusions) => ({
     }),
     exclusions,
 });
-const computeRootSha256 = (entries, exclusions) => canonicalDigest(rootCommitment(entries, exclusions), "Reference source graph");
+const computeRootSha256 = (entries, exclusions) => digestCanonicalValue(rootCommitment(entries, exclusions), "Reference source graph");
 /** Build and internally commit a normalized historical source graph. */
 export const createHistoricalSourceGraph = (input) => {
     const parsed = historicalSourceGraphInputSchema.parse(input);
@@ -344,7 +342,7 @@ export const createHistoricalSourceGraph = (input) => {
 /** Parse a graph and reject stale or caller-invented root commitments. */
 export const parseHistoricalSourceGraph = (input) => historicalSourceGraphSchema.parse(input);
 /** Compute a deterministic graph commitment containing no absolute root path. */
-export const computeHistoricalSourceGraphSha256 = (input) => canonicalDigest(parseHistoricalSourceGraph(input), "Reference source graph");
+export const computeHistoricalSourceGraphSha256 = (input) => digestCanonicalValue(parseHistoricalSourceGraph(input), "Reference source graph");
 /** Build a deterministic, relocation-independent manifest for a source graph. */
 export const createHistoricalSourceManifest = (input) => {
     const graph = parseHistoricalSourceGraph(input);
@@ -359,14 +357,15 @@ export const createHistoricalSourceManifest = (input) => {
     };
     return historicalSourceManifestBaseSchema.parse({
         ...semantic,
-        manifest_id: `hsm_${canonicalDigest(semantic, "Reference source graph")}`,
+        manifest_id: `hsm_${digestCanonicalValue(semantic, "Reference source graph")}`,
     });
 };
 /** Parse and verify a historical source manifest's semantic identifier. */
 export const parseHistoricalSourceManifest = (input) => {
     const manifest = historicalSourceManifestBaseSchema.parse(input);
     const { manifest_id: manifestId, ...semantic } = manifest;
-    if (`hsm_${canonicalDigest(semantic, "Reference source graph")}` !== manifestId)
+    if (`hsm_${digestCanonicalValue(semantic, "Reference source graph")}` !==
+        manifestId)
         throw new TypeError("Historical source manifest identifier does not match");
     return manifest;
 };

package/dist/domain/referenceSourceImportParsing.js

@@ -1,5 +1,7 @@
 import { parse } from "@babel/parser";
-import { isCallExpression, isExportAllDeclaration, isExportNamedDeclaration, isIdentifier, isImport, isImportDeclaration, isImportExpression, isMemberExpression, isNode, isStringLiteral, isTSExternalModuleReference, isTSImportEqualsDeclaration, isTSModuleDeclaration, } from "@babel/types";
+import { traverseJavaScriptAst } from "./javascript/javascriptSemanticTraversal.js";
+import { parserPluginsForPath } from "./javascript/javascriptSourceParser.js";
+import { isCallExpression, isExportAllDeclaration, isExportNamedDeclaration, isIdentifier, isImport, isImportDeclaration, isImportExpression, isMemberExpression, isStringLiteral, isTSExternalModuleReference, isTSImportEqualsDeclaration, isTSModuleDeclaration, } from "@babel/types";
 const codeSourceLanguages = new Set(["JavaScript", "TypeScript", "JSX", "TSX"]);
 const safeModuleName = (node) => {
     if (isStringLiteral(node))
@@ -112,40 +114,18 @@ const isRequireCallee = (callee) => {
     }
     return false;
 };
-const isImportCallee = (callee) => isImport(callee);
-const collectModuleExpressions = (node, targets) => {
-    if (node === null || node === undefined)
-        return;
-    if (typeof node !== "object")
-        return;
-    if (Array.isArray(node)) {
-        for (const item of node)
-            collectModuleExpressions(item, targets);
-        return;
-    }
-    if (!isNode(node))
-        return;
-    if (isCallExpression(node) || isImportExpression(node)) {
-        targets.push(node);
-    }
-    for (const value of Object.values(node)) {
-        if (value !== null &&
-            value !== undefined &&
-            typeof value === "object" &&
-            !isSourceLocation(value)) {
-            collectModuleExpressions(value, targets);
-        }
-    }
-};
-const isSourceLocation = (value) => typeof value === "object" &&
-    value !== null &&
-    "start" in value &&
-    "end" in value &&
-    !("type" in value);
 const extractRequireAndDynamicImports = (body, from_path, relationships) => {
+    // Single traversal owner: iterative, VISITOR_KEYS-gated, no recursion over
+    // loc/comment objects. Survives deeply nested generated member chains that
+    // overflowed the previous hand-rolled Object.values walker.
     const expressions = [];
     for (const statement of body)
-        collectModuleExpressions(statement, expressions);
+        traverseJavaScriptAst(statement, {
+            enter: (node) => {
+                if (isCallExpression(node) || isImportExpression(node))
+                    expressions.push(node);
+            },
+        });
     for (const call of expressions) {
         if (isImportExpression(call)) {
             const specifier = safeModuleName(call.source);
@@ -171,7 +151,7 @@ const extractRequireAndDynamicImports = (body, from_path, relationships) => {
             }
             continue;
         }
-        if (isImportCallee(call.callee) && isModuleExpression(first)) {
+        if (isImport(call.callee) && isModuleExpression(first)) {
             const result = moduleSpecifierFromExpression(first);
             if (result !== undefined) {
                 appendRelationship(relationships, {
@@ -185,17 +165,11 @@ const extractRequireAndDynamicImports = (body, from_path, relationships) => {
     }
 };
 const parseWithBabel = (path, source, language) => {
-    const plugins = ["jsx"];
-    if (language === "TypeScript" || language === "TSX") {
-        plugins.push([
-            "typescript",
-            {
-                dts: path.endsWith(".d.ts") ||
-                    path.endsWith(".d.mts") ||
-                    path.endsWith(".d.cts"),
-            },
-        ]);
-    }
+    // Single parser-mode owner: path-driven plugins (dts/JSX/mts) shared with
+    // the semantic pipeline. `language` only gates non-JS/TS callers upstream;
+    // TypeScript syntax must parse identically here and in semantic analysis.
+    void language;
+    const plugins = parserPluginsForPath(path);
     try {
         const ast = parse(source, {
             sourceType: "unambiguous",
@@ -218,7 +192,22 @@ const parseWithBabel = (path, source, language) => {
 export const parseReferenceSourceImports = (path, bytes, language) => {
     if (language !== null && !codeSourceLanguages.has(language))
         return { relationships: [], parse_failures: [] };
-    const source = new TextDecoder("utf-8", { fatal: false }).decode(bytes);
+    let source;
+    try {
+        source = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch {
+        return {
+            relationships: [],
+            parse_failures: [
+                {
+                    path,
+                    parser: "utf-8",
+                    reason: "Source bytes are not valid UTF-8; import targets were not parsed.",
+                },
+            ],
+        };
+    }
     const { ast, reasons } = parseWithBabel(path, source, language);
     const parseFailures = reasons.map((reason) => ({
         path,