rea-agents 6.2.0 → 6.3.0

package/dist/application/javascript/JavaScriptArtifactPathResolution.js

@@ -1,4 +1,4 @@
-import { builtinModules } from "node:module";
+import { isBuiltin } from "node:module";
 import { posix } from "node:path";
 import { admitsCanonicalPathSyntax, hasScheme, htmlUrlText, looksExternal, percentDecodeUrlPath, stripQueryAndFragment, } from "../../domain/artifactPathSyntax.js";
 const EXTENSIONS = [
@@ -11,7 +11,6 @@ const EXTENSIONS = [
     ".html",
     ".node",
 ];
-const NODE_BUILTINS = new Set(builtinModules.map((name) => name.replace(/^node:/u, "")));
 /** Resolve one declaration under its exact syntax/metadata context. */
 export const resolveArtifactPathByContext = (input) => resolvePackagePath(input, new Set());
 const resolvePackagePath = (input, packageChain, mode = "full", exportsTargetUrl = false) => {
@@ -109,9 +108,7 @@ const contextualCandidate = (input, exportsTargetUrl) => {
 };
 const bareModuleCandidate = (input, declared) => {
     const packageName = barePackageName(declared);
-    if (packageName === null ||
-        NODE_BUILTINS.has(packageName) ||
-        declared.startsWith("#"))
+    if (packageName === null || isBuiltin(declared) || declared.startsWith("#"))
         return unresolvedOutcome(input, "external", [
             "The bare specifier is a Node builtin, package import map, or invalid package name.",
         ]);
@@ -179,7 +176,9 @@ const htmlCandidate = (input) => {
     if (declaredPath.startsWith("/"))
         return declaredPath.slice(1);
     if (base === undefined || base === null || base === "")
-        return posix.join(posix.dirname(input.sourcePath), declaredPath);
+        return declaredPath === ""
+            ? input.sourcePath
+            : posix.join(posix.dirname(input.sourcePath), declaredPath);
     // A local base href is a second untrusted path input; apply the same
     // admission rules a declared path gets so it cannot smuggle traversal or
     // separator syntax past canonicalization.
@@ -195,21 +194,32 @@ const htmlCandidate = (input) => {
     const basePath = decodedBase.startsWith("/")
         ? decodedBase.slice(1)
         : posix.join(posix.dirname(input.sourcePath), decodedBase);
+    if (declaredPath === "")
+        return emptyHtmlReference(input, decodedBase, basePath);
     return posix.join(htmlBaseDirectory(decodedBase, basePath), declaredPath);
 };
+const emptyHtmlReference = (input, base, basePath) => {
+    if (!htmlBaseIsDirectory(base))
+        return basePath;
+    const confined = confineCandidate(input, basePath);
+    if (typeof confined !== "string")
+        return confined;
+    return unresolvedOutcome(input, "not-found", [
+        `The HTML reference resolves to directory ${confined || "."}, not an exact selected application file.`,
+    ]);
+};
 /**
  * The directory a relative HTML reference resolves against. A base path
  * ending in "/" or in a "." or ".." segment is already a directory, because a
  * relative reference resolves against the base URL's directory and those
  * segments are dropped rather than stepped through.
  */
-const htmlBaseDirectory = (base, basePath) => base.endsWith("/") ||
+const htmlBaseIsDirectory = (base) => base.endsWith("/") ||
     base.endsWith("/.") ||
     base.endsWith("/..") ||
     base === "." ||
-    base === ".."
-    ? basePath
-    : posix.dirname(basePath);
+    base === "..";
+const htmlBaseDirectory = (base, basePath) => htmlBaseIsDirectory(base) ? basePath : posix.dirname(basePath);
 const confineCandidate = (input, candidate) => {
     const normalized = posix.normalize(candidate);
     if (normalized === ".." ||
@@ -354,11 +364,20 @@ const packageEntry = (text, moduleKind, useExports) => {
     }
 };
 const packageExport = (value, moduleKind) => {
+    if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+        const keys = Object.keys(value);
+        if (keys.some((key) => key.startsWith(".")) &&
+            keys.some((key) => !key.startsWith(".")))
+            return {
+                status: "rejected",
+                limitation: "The package exports configuration mixes subpath keys and condition keys.",
+            };
+    }
     const root = typeof value === "object" && value !== null && Object.hasOwn(value, ".")
         ? Reflect.get(value, ".")
         : value;
     const flattened = exportTargets(root, packageExportConditions(moduleKind));
-    if (flattened.kind === "invalid")
+    if (flattened.kind === "invalid" || flattened.kind === "invalid-config")
         return { status: "rejected", limitation: flattened.limitation };
     const first = flattened.kind === "unmatched" ? undefined : flattened.values[0];
     return first === undefined
@@ -404,6 +423,9 @@ const exportTargets = (value, conditions) => {
         let invalid = null;
         for (const entry of value) {
             const nested = exportTargets(entry, conditions);
+            // Node's array fallback catches invalid targets, not invalid configuration.
+            if (nested.kind === "invalid-config")
+                return nested;
             if (nested.kind === "invalid") {
                 invalid = nested.limitation;
                 continue;
@@ -420,6 +442,14 @@ const exportTargets = (value, conditions) => {
     }
     if (typeof value !== "object")
         return invalidExportTarget(value, "must be a relative string, object, array, or null");
+    for (const key of Object.keys(value)) {
+        const numeric = Number(key);
+        if (String(numeric) === key && numeric >= 0 && numeric < 0xffff_ffff)
+            return {
+                kind: "invalid-config",
+                limitation: `The package exports configuration contains numeric condition key ${JSON.stringify(key)}.`,
+            };
+    }
     for (const [condition, target] of Object.entries(value)) {
         if (!conditions.has(condition))
             continue;
@@ -433,11 +463,13 @@ const exportTargets = (value, conditions) => {
  * Node selects an exports target by walking the declared keys in order and
  * taking the first whose condition is active for the calling resolver.
  * "default" is always active, and "node" plus "node-addons" are active for the
- * built-in resolver that owns installed-package imports and requires.
+ * built-in resolver that owns installed-package imports and requires. The
+ * supported Node runtimes also activate "module-sync" for both loaders.
  */
 const packageExportConditions = (moduleKind) => new Set([
     "node",
     "node-addons",
+    "module-sync",
     ...(moduleKind === undefined ? [] : [moduleKind]),
     "default",
 ]);

package/dist/application/javascript/JavaScriptArtifactReconstruction.js

@@ -21,7 +21,10 @@ export const reconstructJavaScriptArtifact = async (rawInput, signal, progress)
     abortIfNeeded(signal);
     const path = await resolveSelectedInput(input.input_path);
     const format = await resolveFormat(path, input);
-    const snapshot = await scanCanonicalArtifactInventory(path, { signal });
+    const snapshot = await scanCanonicalArtifactInventory(path, {
+        signal,
+        integrity: { mode: input.integrity_policy },
+    });
     if (snapshot.manifest.root_format !== format)
         throw new ArtifactReaderFailure("format", `Artifact inventory classified ${path} as ${snapshot.manifest.root_format}, not ${format}`);
     const reader = createReader(path, format);
@@ -47,7 +50,7 @@ export const reconstructJavaScriptArtifact = async (rawInput, signal, progress)
         await reportPhase("seal_javascript_application_graph", "Sealing the validated application graph");
         const graph = await completeJavaScriptAnalysisSteps(applicationGraphSteps, signal);
         await reportPhase("build_javascript_semantic_graph", "Binding and validating static semantic relationships");
-        const semanticGraphSteps = semanticProjection.finishImmutableSteps(snapshot.manifest.root_sha256, graph, analysis);
+        const semanticGraphSteps = semanticProjection.finishImmutableSteps(snapshot.manifest.root_sha256, graph);
         await reportPhase("seal_javascript_semantic_graph", "Validating and sealing the semantic graph");
         const semanticGraph = await completeJavaScriptAnalysisSteps(semanticGraphSteps, signal);
         await checkpointJavaScriptAnalysis(signal);
@@ -57,6 +60,7 @@ export const reconstructJavaScriptArtifact = async (rawInput, signal, progress)
             root_artifact_sha256: snapshot.manifest.root_sha256,
             inventory_manifest_id: snapshot.manifest.manifest_id,
             inventory_graph_sha256: snapshot.manifest.graph_sha256,
+            integrity_contradictions: snapshot.integrity_contradictions,
             graph,
             semantic_graph: semanticGraph,
             electron_summary: summarizeElectronBoundaries(analysis),
@@ -70,7 +74,6 @@ export const reconstructJavaScriptArtifact = async (rawInput, signal, progress)
                 findings: analysis.findings,
                 modules: analysis.modules,
                 parse_failures: analysis.parse_failures,
-                truncated_scopes: analysis.truncated_scopes,
             },
             limitations: analysis.limitations,
         };

package/dist/application/javascript/JavaScriptArtifactReconstructionInput.js

@@ -3,4 +3,5 @@ import { z } from "zod";
 export const javascriptArtifactReconstructionInputSchema = z.strictObject({
     input_path: z.string().min(1),
     format: z.enum(["auto", "asar", "directory"]).default("auto"),
+    integrity_policy: z.enum(["fail", "record-and-continue"]).default("fail"),
 });

package/dist/application/javascript/JavaScriptJsonModules.js

@@ -1,4 +1,4 @@
-import { compareCodePoints } from "../../domain/canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";
 /** Parse one approved JSON module without evaluating JavaScript or resolving imports. */
 export const analyzeJavaScriptJsonModule = (file) => {
     if (!file.text.included)
@@ -26,7 +26,7 @@ export const analyzeJavaScriptJsonModule = (file) => {
         };
     }
     const keys = typeof value === "object" && value !== null && !Array.isArray(value)
-        ? Object.keys(value).sort(compareCodePoints)
+        ? Object.keys(value).sort(compareUnicodeCodePoints)
         : [];
     const retained = keys;
     return {

package/dist/application/javascript/JavaScriptModuleRelationships.js

@@ -1,8 +1,8 @@
 import { posix } from "node:path";
-import { compareCodePoints } from "../../domain/canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";
 import { completeApplicationCoverage, partialApplicationCoverage, } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
-import { semanticCoverageResourceLimits } from "../../domain/javascript/javascriptSemanticCoverage.js";
-import { SEMANTIC_EXPRESSION_DEPTH_LIMIT, SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT, SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT, semanticResourceLimitReason, } from "../../domain/javascript/javascriptSemanticResourceLimits.js";
+import { semanticCoverageResourceLimits, semanticResourceLimitCoverage, } from "../../domain/javascript/javascriptSemanticCoverage.js";
+import { semanticResourceLimitReason } from "../../domain/javascript/javascriptSemanticResourceLimits.js";
 import { addAstContainsEdge, artifactLocalIdentity, } from "./JavaScriptArtifactGraphContext.js";
 import { astObservationEvidence, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
 import { resolveArtifactPathByContext, } from "./JavaScriptArtifactPathResolution.js";
@@ -17,7 +17,7 @@ export const addJavaScriptSourceModules = (context) => {
             continue;
         const exports = semantic.ir.moduleLinks
             .flatMap(({ exportedName }) => exportedName === null ? [] : [exportedName])
-            .sort(compareCodePoints);
+            .sort(compareUnicodeCodePoints);
         const retainedExports = [...new Set(exports)];
         const source = context.accumulator.addNode({
             kind: "javascript-module",
@@ -264,19 +264,7 @@ const semanticCoverage = (semantic) => {
     const resourceLimits = semanticCoverageResourceLimits(semantic.ir.coverage);
     if (semantic.ir.coverage.status === "complete" && resourceLimits.length === 0)
         return completeApplicationCoverage();
-    return partialApplicationCoverage(resourceLimits.map((resourceLimit) => ({
-        name: `javascript_semantic_${resourceLimit.replaceAll("-", "_")}`,
-        value: resourceLimit === "primitive-candidates"
-            ? SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT
-            : resourceLimit === "primitive-bytes"
-                ? SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT
-                : SEMANTIC_EXPRESSION_DEPTH_LIMIT,
-        unit: resourceLimit === "expression-depth"
-            ? "depth"
-            : resourceLimit === "primitive-bytes"
-                ? "bytes"
-                : "items",
-    })), semantic.ir.coverage.omittedCount);
+    return partialApplicationCoverage(semanticResourceLimitCoverage(resourceLimits), semantic.ir.coverage.omittedCount);
 };
 const moduleFormat = (path, ir) => {
     const extension = posix.extname(path).toLowerCase();

package/dist/application/javascript/JavaScriptRuntimeReconciliationService.js

@@ -1,9 +1,9 @@
 import { resolve } from "node:path";
 import { z } from "zod";
-import { AnalysisInputError, AnalysisProtocolError, } from "../../domain/analysisErrorCore.js";
+import { AnalysisProtocolError } from "../../domain/analysisErrorCore.js";
 import {} from "../../domain/analysisErrorBase.js";
 import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
-import { reconcileJavaScriptRuntime } from "../../domain/javascript/javascriptRuntimeReconciliation.js";
+import { parseRuntimeReconciliationInput, reconcileJavaScriptRuntime, } from "../../domain/javascript/javascriptRuntimeReconciliation.js";
 import { reconcileJavaScriptRuntimeInputSchema } from "../../domain/javascript/javascriptRuntimeReconciliationSchemas.js";
 import { err, ok } from "../../domain/result.js";
 import { createJavaScriptRuntimeReconciliationEvidence } from "./JavaScriptRuntimeReconciliationEvidence.js";
@@ -17,19 +17,20 @@ export const reconcileJavaScriptRuntimeEvidence = (rawInput) => {
 };
 /** Reconcile input already parsed by a trusted adapter boundary. */
 export const reconcileJavaScriptRuntimeEvidenceValidated = (parsedInput) => {
+    let parsed;
     try {
-        const input = reconcileJavaScriptRuntimeInputSchema.parse(normalizeRuntimeMappingRoots(parsedInput));
-        const result = reconcileJavaScriptRuntime(input);
-        return ok(createJavaScriptRuntimeReconciliationEvidence(input, result));
+        parsed = parseRuntimeReconciliationInput(normalizeRuntimeMappingRoots(parsedInput));
     }
     catch (cause) {
         if (cause instanceof z.ZodError)
             return err(analysisInputErrorFromIssues(OPERATION, cause.issues, parsedInput));
-        if (cause instanceof TypeError &&
-            SAFE_RECONCILIATION_INPUT_CONSTRAINTS.has(cause.message))
-            return err(new AnalysisInputError(OPERATION, undefined, [
-                { path: [], reason: "invalid_value", message: cause.message },
-            ]));
+        return err(new AnalysisProtocolError("JavaScript runtime reconciliation input parsing failed", { cause }));
+    }
+    try {
+        const result = reconcileJavaScriptRuntime(parsed);
+        return ok(createJavaScriptRuntimeReconciliationEvidence(parsed.input, result));
+    }
+    catch (cause) {
         return err(new AnalysisProtocolError("JavaScript runtime reconciliation produced an invalid result", { cause }));
     }
 };
@@ -50,20 +51,3 @@ const normalizeRuntimeMappingRoots = (input) => ({
 const isPortableAbsolutePath = (path) => path.startsWith("/") ||
     /^[a-z]:[\\/]/iu.test(path) ||
     /^(?:\\\\|\/\/)[^\\/]+[\\/][^\\/]+(?:[\\/]|$)/u.test(path);
-const SAFE_RECONCILIATION_INPUT_CONSTRAINTS = new Set([
-    "Evidence semantic identifier does not match its record",
-    "JavaScript application Evidence subject disagrees with its result",
-    "Runtime reconciliation requires inspect_web_page, inspect_electron_page, observe_javascript_runtime, or capture_electron_scenario Evidence",
-    "Runtime Evidence target or declared role disagrees with its result",
-    "Runtime Evidence contains an invalid builtin location",
-    "Runtime Evidence target disagrees with its captured result",
-    "Browser Evidence target is outside its recorded origin scope",
-    "Runtime Evidence contains source without source-capture selection",
-    "Active Electron Evidence application path disagrees with its configured root",
-    ...[
-        "inspect_web_page",
-        "inspect_electron_page",
-        "observe_javascript_runtime",
-        "capture_electron_scenario",
-    ].map((operation) => `Evidence does not match the supported ${operation} contract`),
-]);

package/dist/application/javascript/JavaScriptSemanticGraphAsyncProjection.js

@@ -84,7 +84,7 @@ const addEventUnknown = (context, operation, event, relation) => {
             : `Static ${operation.method} emitter identity is partial.`,
         candidate_node_ids: [],
         evidence: unknownSemanticEvidence(context.file, operation.location),
-    }));
+    }, context.state.evidenceContexts));
 };
 /** Project Node timer scheduling and exact local handle cancellation. */
 export const projectSemanticTimers = (context) => {
@@ -153,5 +153,5 @@ const projectTimerCancellation = (context, operation, timerNodes) => {
         detail: `Static ${operation.method} handle resolution was ${operation.resolution}.`,
         candidate_node_ids: [],
         evidence: unknownSemanticEvidence(context.file, operation.location),
-    }));
+    }, context.state.evidenceContexts));
 };

package/dist/application/javascript/JavaScriptSemanticGraphBuilder.js

@@ -45,7 +45,7 @@ export const buildJavaScriptSemanticGraph = ({ rootArtifactSha256, applicationGr
         if (analyzed.semantic !== null)
             projection.projectFile(analyzed.file, analyzed.semantic.ir);
     }
-    return projection.finish(rootArtifactSha256, applicationGraph, analysis);
+    return projection.finish(rootArtifactSha256, applicationGraph);
 };
 /** Accumulate semantic nodes while each source IR is still file-local. */
 export const createJavaScriptSemanticGraphProjection = () => {
@@ -68,7 +68,7 @@ export const createJavaScriptSemanticGraphProjection = () => {
             truncatedFiles += 1;
         state.fileNodeBudget = null;
     };
-    const finishWith = (factory, rootArtifactSha256, applicationGraph, analysis) => {
+    const finishWith = (factory, rootArtifactSha256, applicationGraph) => {
         bindSemanticGraphApplicationNodes(state, applicationGraph);
         if (state.roots.size === 0)
             addFallbackRoot(rootArtifactSha256, state);
@@ -78,6 +78,7 @@ export const createJavaScriptSemanticGraphProjection = () => {
             root_artifact_sha256: rootArtifactSha256,
             application_graph_id: applicationGraph.graph_id,
             root_node_ids: [...state.roots],
+            evidence_contexts: state.evidenceContexts.contexts,
             nodes: [...state.nodes.values()],
             relations: [...state.relations.values()],
             fingerprints,
@@ -98,7 +99,7 @@ export const createJavaScriptSemanticGraphProjection = () => {
                     : [],
                 families: JAVASCRIPT_SEMANTIC_RELATION_FAMILIES.map((family) => ({
                     family,
-                    status: semanticFamilyStatus(family, analysis),
+                    status: semanticFamilyStatus(family),
                     retained_relations: [...state.relations.values()].filter((relation) => JAVASCRIPT_SEMANTIC_RELATION_FAMILY[relation.relation] ===
                         family).length,
                     omitted_relations: truncatedFiles > 0 ? null : 0,
@@ -125,13 +126,14 @@ export const createJavaScriptSemanticGraphProjection = () => {
         state.relations.clear();
         state.unknowns.clear();
         state.roots.clear();
+        state.evidenceContexts.clear();
         fingerprints.length = 0;
         return graph;
     };
     return {
         projectFile: projectSource,
-        finish: (rootArtifactSha256, applicationGraph, analysis) => finishWith(createJavaScriptSemanticGraph, rootArtifactSha256, applicationGraph, analysis),
-        finishImmutableSteps: (rootArtifactSha256, applicationGraph, analysis) => finishWith(createImmutableJavaScriptSemanticGraphSteps, rootArtifactSha256, applicationGraph, analysis),
+        finish: (rootArtifactSha256, applicationGraph) => finishWith(createJavaScriptSemanticGraph, rootArtifactSha256, applicationGraph),
+        finishImmutableSteps: (rootArtifactSha256, applicationGraph) => finishWith(createImmutableJavaScriptSemanticGraphSteps, rootArtifactSha256, applicationGraph),
     };
 };
 const projectFile = (file, ir, state) => {
@@ -209,7 +211,7 @@ const projectFile = (file, ir, state) => {
     projectSemanticResources(context);
     projectSemanticClosureCaptures(context);
     projectSemanticFrontiers(context);
-    return projectSemanticFunctionFingerprints(file, ir, callableNodes);
+    return projectSemanticFunctionFingerprints(file, ir, callableNodes, state.evidenceContexts);
 };
 const createReturnSiteNodes = (file, ir, callables, state) => {
     const result = new Map();

package/dist/application/javascript/JavaScriptSemanticGraphChildProcessProjection.js

@@ -161,5 +161,5 @@ const addChildUnknown = (input) => {
         detail,
         candidate_node_ids: candidateNodeIds,
         evidence: unknownSemanticEvidence(context.file, location),
-    }));
+    }, context.state.evidenceContexts));
 };

package/dist/application/javascript/JavaScriptSemanticGraphConstruction.js

@@ -1,5 +1,5 @@
 import { javascriptDisplayText } from "../../domain/javascript/javascriptAstValues.js";
-import { createJavaScriptSemanticGraphNode, createJavaScriptSemanticGraphRelation, javaScriptSemanticNodeId, } from "../../domain/javascript/javascriptSemanticGraph.js";
+import { createJavaScriptSemanticGraphNode, createJavaScriptSemanticGraphRelation, JavaScriptSemanticEvidenceContextRegistry, javaScriptSemanticNodeId, } from "../../domain/javascript/javascriptSemanticGraph.js";
 import { inferredSemanticEvidence, observedSemanticEvidence, unavailableSemanticRootEvidence, } from "./JavaScriptSemanticGraphEvidence.js";
 /** Create empty projection state with structural application-node mappings. */
 export const createSemanticGraphProjectionState = (applicationGraph) => {
@@ -8,6 +8,7 @@ export const createSemanticGraphProjectionState = (applicationGraph) => {
         nodes: new Map(),
         relations: new Map(),
         unknowns: new Map(),
+        evidenceContexts: new JavaScriptSemanticEvidenceContextRegistry(),
         roots: new Set(),
         applicationNodeIdsByLocation: index.identifiers,
     };
@@ -38,7 +39,7 @@ export const constructSemanticGraphNode = (file, input, state) => createJavaScri
     label: input.label === null ? null : javascriptDisplayText(input.label),
     properties: input.properties ?? {},
     evidence: observedSemanticEvidence(file, input.location),
-});
+}, state.evidenceContexts);
 /** Reuse retained identities and reject exhausted budgets before allocation. */
 export const retainSemanticGraphNode = (state, file, input) => {
     const identifier = javaScriptSemanticNodeId({
@@ -89,8 +90,9 @@ export const addSemanticGraphRelation = (state, input) => {
         relation: input.relation,
         resolution: input.resolution ?? "candidate",
         properties: input.properties ?? {},
-        evidence: input.evidence ?? inferredSemanticEvidence(input.source),
-    });
+        evidence: input.evidence ??
+            inferredSemanticEvidence(state.evidenceContexts.resolve(input.source.evidence)),
+    }, state.evidenceContexts);
     if (state.relations.has(value.relation_id))
         return;
     state.relations.set(value.relation_id, value);
@@ -116,7 +118,7 @@ export const addSemanticFallbackRoot = (rootArtifactSha256, state) => {
         label: "unavailable semantic root",
         properties: {},
         evidence: unavailableSemanticRootEvidence(rootArtifactSha256),
-    }));
+    }, state.evidenceContexts));
     if (node !== null)
         state.roots.add(node.node_id);
 };

package/dist/application/javascript/JavaScriptSemanticGraphDataProjection.js

@@ -209,5 +209,5 @@ const addDataUnknown = (input) => {
         detail,
         candidate_node_ids: candidateNodeIds,
         evidence: unknownSemanticEvidence(context.file, location),
-    }));
+    }, context.state.evidenceContexts));
 };

package/dist/application/javascript/JavaScriptSemanticGraphEvidence.js

@@ -32,7 +32,7 @@ export const observedSemanticEvidence = (file, location) => ({
 });
 /** Conservative static relationship evidence derived from one syntax node. */
 export const inferredSemanticEvidence = (source) => ({
-    ...source.evidence,
+    ...source,
     authority: "static-relationship-inference",
     state: "inferred",
     confidence: "high",

package/dist/application/javascript/JavaScriptSemanticGraphFingerprintProjection.js

@@ -1,7 +1,7 @@
 import { createJavaScriptSemanticFingerprint, } from "../../domain/javascript/javascriptSemanticGraph.js";
 import { observedSemanticEvidence } from "./JavaScriptSemanticGraphEvidence.js";
 /** Bind domain fingerprint components to exact semantic function nodes. */
-export const projectSemanticFunctionFingerprints = (file, ir, callableNodes) => ir.functionFingerprints.flatMap((fingerprint) => {
+export const projectSemanticFunctionFingerprints = (file, ir, callableNodes, evidenceContexts) => ir.functionFingerprints.flatMap((fingerprint) => {
     const callable = callableNodes.get(fingerprint.callableId);
     if (callable === undefined)
         return [];
@@ -20,6 +20,6 @@ export const projectSemanticFunctionFingerprints = (file, ir, callableNodes) =>
             },
             limitations: fingerprint.limitations,
             evidence: observedSemanticEvidence(file, callable.identity.source_range),
-        }),
+        }, evidenceContexts),
     ];
 });

package/dist/application/javascript/JavaScriptSemanticGraphFlowProjection.js

@@ -119,7 +119,7 @@ const addPromiseUnknown = (context, operation, promise, promiseNodes) => {
             return candidate === undefined ? [] : [candidate.node_id];
         }),
         evidence: unknownSemanticEvidence(context.file, operation.location),
-    }));
+    }, context.state.evidenceContexts));
 };
 /** Link direct return expressions to their retained semantic references. */
 export const projectSemanticReturnValues = (context) => {
@@ -175,7 +175,7 @@ export const projectSemanticFrontiers = (context) => {
             detail: frontier.reason,
             candidate_node_ids: [],
             evidence: unknownSemanticEvidence(context.file, frontier.location),
-        });
+        }, context.state.evidenceContexts);
         addSemanticGraphUnknown(context.state, unknown);
     }
 };

package/dist/application/javascript/JavaScriptSemanticGraphObjectProjection.js

@@ -106,5 +106,5 @@ const addObjectUnknown = (context, operation, node, target) => {
         detail: `Static ${operation.kind} property ${operation.propertyPath === null ? "path is unresolved" : semanticPropertyPointer(operation.propertyPath)} has ${target.presence} presence; its receiver is ${target.receiverResolved ? "a retained container" : "unresolved or not a retained container"}; object identity is ${operation.resolution}.`,
         candidate_node_ids: [],
         evidence: unknownSemanticEvidence(context.file, operation.location),
-    }));
+    }, context.state.evidenceContexts));
 };

package/dist/application/javascript/JavaScriptSemanticGraphProjection.js

@@ -1,4 +1,4 @@
-import { compareCodePoints } from "../../domain/canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";
 import { JAVASCRIPT_SEMANTIC_RELATION_FAMILIES } from "../../domain/javascript/javascriptSemanticGraphSchemas.js";
 /** Index one immutable file IR; read retained callable membership at query time. */
 export const createSemanticCallableOwnerLookup = (ir, nodes) => {
@@ -29,7 +29,7 @@ export const createSemanticCallableOwnerLookup = (ir, nodes) => {
                 const node = nodes.get(candidate.callableId);
                 const rank = best === undefined
                     ? 1
-                    : compareCodePoints(candidate.priority, best.priority) ||
+                    : compareUnicodeCodePoints(candidate.priority, best.priority) ||
                         best.order - candidate.order;
                 if (node !== undefined && rank > 0) {
                     best = candidate;
@@ -120,7 +120,7 @@ export const createSemanticCallSiteLookup = (ir, nodes) => {
 };
 const rangeKey = (range) => `${range.start.line}:${range.start.column}-${range.end.line}:${range.end.column}`;
 /** Report extractor support without treating missing families as absence. */
-export const semanticFamilyStatus = (family, analysis) => {
+export const semanticFamilyStatus = (family) => {
     if (![
         "call-flow",
         "boundary",
@@ -136,7 +136,7 @@ export const semanticFamilyStatus = (family, analysis) => {
         "timer",
     ].includes(family))
         return "unsupported";
-    return analysis.truncated_scopes === 0 ? "partial" : "unknown";
+    return "partial";
 };
 const contains = (outer, inner) => pointCompare(outer.start, inner.start) <= 0 &&
     pointCompare(outer.end, inner.end) >= 0;

package/dist/application/javascript/JavaScriptSemanticGraphResourceProjection.js

@@ -54,5 +54,5 @@ const projectRelease = (context, operation, resourceNodes) => {
         detail: `Static ${operation.method} resource ownership is ambiguous.`,
         candidate_node_ids: resources.map(({ node_id: identifier }) => identifier),
         evidence: unknownSemanticEvidence(context.file, operation.location),
-    }));
+    }, context.state.evidenceContexts));
 };

package/dist/application/javascript/JavaScriptSemanticGraphValueProjection.js

@@ -72,17 +72,20 @@ const projectValue = (input) => {
                 detail: `Initializer container has unknown ${value.status === "object" ? "properties" : "items"}${container.coverage.omitted === null ? " with an unknown omitted count" : `; ${container.coverage.omitted} omitted`}.`,
                 candidate_node_ids: [target.node_id],
                 evidence: unknownSemanticEvidence(context.file, binding.definitions[0]?.location ?? null),
-            }));
+            }, context.state.evidenceContexts));
     }
-    else if (value.status === "unknown" && value.resourceLimit !== undefined) {
+    else if (value.status === "unknown" ||
+        value.status === "ambiguous" ||
+        value.status === "cycle") {
         const location = binding.definitions[0]?.location ?? null;
         const evidence = observedSemanticEvidence(context.file, location);
-        const isPropertyValue = role.startsWith("property:");
         addSemanticGraphUnknown(context.state, createJavaScriptSemanticGraphUnknown({
             node_id: target.node_id,
-            family: isPropertyValue ? "object-flow" : "data-flow",
-            relation_kinds: [isPropertyValue ? "writes-property" : "defines"],
-            reason: "resource-limit",
+            family: "data-flow",
+            relation_kinds: ["defines"],
+            reason: value.resourceLimit === undefined
+                ? "unknown-value"
+                : "resource-limit",
             detail: `${value.reason} Unknown value at ${role}.`,
             candidate_node_ids: [target.node_id],
             evidence: {
@@ -92,7 +95,7 @@ const projectValue = (input) => {
                 confidence: "unknown",
                 limitations: [value.reason],
             },
-        }));
+        }, context.state.evidenceContexts));
     }
 };
 const addLiteralNode = (context, binding, value, role) => retainSemanticGraphNode(context.state, context.file, {

package/dist/application/javascript/JavaScriptSemanticTraceService.js

@@ -1,25 +1,30 @@
 import { z } from "zod";
 import { AnalysisInputError, AnalysisProtocolError, } from "../../domain/analysisErrorCore.js";
 import {} from "../../domain/analysisErrorBase.js";
+import { applicationGraphEvidenceInputError, parseApplicationGraphEvidence, } from "./JavaScriptApplicationEvidenceGraph.js";
 import { jsonValueSchema } from "../../domain/jsonValue.js";
 import { queryJavaScriptSemanticGraph } from "../../domain/javascript/javascriptSemanticQuery.js";
 import { javaScriptSemanticTraceResultSchema, traceJavaScriptSemanticsInputSchema, } from "../../domain/javascript/javascriptSemanticTraceSchemas.js";
 import { err, ok } from "../../domain/result.js";
-import { parseApplicationGraphEvidence } from "./JavaScriptApplicationEvidenceGraph.js";
 import { createJavaScriptSemanticTraceEvidence } from "./JavaScriptApplicationWorkflowEvidence.js";
 const OPERATION = "trace_javascript_semantics";
 /** Trace semantic relations from input already parsed by a trusted adapter. */
 export const traceJavaScriptSemanticsEvidenceValidated = (input) => {
+    const sourceResult = parseApplicationGraphEvidence(input.application, [
+        "application",
+    ]);
+    if (!sourceResult.ok)
+        return err(applicationGraphEvidenceInputError(OPERATION, sourceResult.error));
+    const source = sourceResult.value;
+    if (source.semanticGraph === null)
+        return err(new AnalysisInputError(OPERATION, undefined, [
+            {
+                path: ["application"],
+                reason: "invalid_value",
+                expected: "inline Evidence from analyze_javascript_application with a semantic graph",
+            },
+        ]));
     try {
-        const source = parseApplicationGraphEvidence(input.application);
-        if (source.semanticGraph === null)
-            return err(new AnalysisInputError(OPERATION, undefined, [
-                {
-                    path: ["application"],
-                    reason: "invalid_value",
-                    expected: "inline Evidence from analyze_javascript_application with a semantic graph",
-                },
-            ]));
         const query = queryJavaScriptSemanticGraph(source.semanticGraph, input.query);
         const result = javaScriptSemanticTraceResultSchema.parse({
             ...query,

package/dist/application/native/NativeCallRoutes.js

@@ -3,16 +3,14 @@ import { parseRelatedAddresses, referenceKindSchema, } from "../../domain/hopper
 import { err, ok } from "../../domain/result.js";
 import { AnalysisOutputError } from "../../domain/analysisErrorCore.js";
 const referencesSchema = z.object({
-    reference_kinds_available: z.boolean().optional(),
+    reference_kinds_available: z.boolean(),
     references: z.array(z.object({
         source_address: z.string(),
         target_address: z.string(),
         target_procedure: z.object({ address: z.string() }).nullable(),
         kind: referenceKindSchema,
     })),
-    unresolved_calls: z
-        .array(z.object({ address: z.string(), reason: z.string() }))
-        .default([]),
+    unresolved_calls: z.array(z.object({ address: z.string(), reason: z.string() })),
 });
 /** Prefer typed static call references, preserving computed targets and targetless sites. */
 export const readNativeCallRoutes = async (analysis, procedure, signal) => {