rea-agents 6.2.0 → 6.4.0

package/dist/domain/canonicalOrdering.js

@@ -1,15 +1,3 @@
 import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
-/**
- * Canonical code-point ordering shared across domain and application layers.
- *
- * Compares strings by Unicode code point so graph ordering, fingerprints, and
- * deterministic tie-breaks stay stable regardless of locale. Prefer this over
- * `String.prototype.localeCompare`, which is locale-dependent.
- *
- * Ordering by code point differs from ordering by UTF-16 code unit for astral
- * code points (above U+FFFF), whose lead surrogate is numerically below the
- * BMP tail U+E000-U+FFFF.
- */
-export const compareCodePoints = (left, right) => compareUnicodeCodePoints(left, right);
 /** Deduplicate and sort strings with canonical code-point ordering. */
-export const uniqueSorted = (values) => [...new Set(values)].sort(compareCodePoints);
+export const uniqueSorted = (values) => [...new Set(values)].sort(compareUnicodeCodePoints);

package/dist/domain/changedBehavior.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { artifactComparisonResultSchema } from "./artifactComparison.js";
 import { uniqueSorted } from "./canonicalOrdering.js";
+import { compositeKey, compareUnicodeCodePoints, } from "./unicodeCodePointOrder.js";
 import { comparisonSourceEvidenceIds } from "./comparisonSourceEvidence.js";
 import { evidenceSchema, parseEvidence } from "./evidence.js";
 import { functionComparisonResultSchema } from "./functionComparisonSchemas.js";
@@ -274,9 +275,7 @@ const behaviorStatus = (statuses) => {
 const isChange = (status) => status === "added" || status === "removed" || status === "changed";
 const count = (findings, classification) => findings.filter((finding) => finding.classification === classification)
     .length;
-const compareFindings = (left, right) => [left.scope, left.dimension, left.source_comparison_id]
-    .join("\0")
-    .localeCompare([right.scope, right.dimension, right.source_comparison_id].join("\0"), "en");
+const compareFindings = (left, right) => compareUnicodeCodePoints(compositeKey([left.scope, left.dimension, left.source_comparison_id]), compositeKey([right.scope, right.dimension, right.source_comparison_id]));
 const assertUnique = (values, label) => {
     if (new Set(values).size !== values.length)
         throw new TypeError(`Changed-behavior analysis rejects duplicate ${label}`);

package/dist/domain/compactStringIdentity.js

@@ -0,0 +1,9 @@
+import { digestCanonicalValue } from "./canonicalDigest.js";
+/** Retain short exact string keys or commit their value in a reserved digest namespace. */
+export const compactStringIdentityKey = (value) => {
+    const prefix = "value-sha256:";
+    const digestKey = `${prefix}${digestCanonicalValue(value, "String identity")}`;
+    return value.length <= digestKey.length && !value.startsWith(prefix)
+        ? value
+        : digestKey;
+};

package/dist/domain/comparisonSemantics.js

@@ -1,13 +1,8 @@
 import canonicalize from "canonicalize";
-import { digestCanonicalValue } from "./canonicalDigest.js";
 /** Whether an inventory can support a claim that an item is absent. */
 export const absenceClaimable = (coverage) => coverage.status === "complete" &&
     coverage.truncated !== true &&
     (coverage.omitted_count === undefined || coverage.omitted_count === 0);
-/** SHA-256 of canonical JSON for stable, provider-neutral comparison IDs. */
-export const canonicalDigest = (value, context = "Comparison") => {
-    return digestCanonicalValue(value, context);
-};
 /** Canonical JSON used for deterministic tie breaking and stable digests. */
 export const canonicalJson = (value, context = "Comparison") => {
     const encoded = canonicalize(value);

package/dist/domain/digests.js

@@ -25,6 +25,3 @@ export const prefixedDigestSchema = (prefix) => z
     .regex(new RegExp(`^${prefix}_[a-f0-9]{64}$`, "u"), `Expected a ${prefix}_ prefixed lowercase sha256 digest`);
 /** True when `value` is a bare digest. */
 export const isDigest = (value) => typeof value === "string" && SHA256_PATTERN.test(value);
-/** True when `value` is a digest carrying `prefix`. */
-export const isPrefixedDigest = (value, prefix) => typeof value === "string" &&
-    prefixedDigestSchema(prefix).safeParse(value).success;

package/dist/domain/evidence.js

@@ -2,6 +2,7 @@ import { z } from "zod";
 import { digestCanonicalValue } from "./canonicalDigest.js";
 import { canonicalJsonDigestSteps } from "./canonicalJsonDigestSteps.js";
 import { analysisProfileSchema, } from "./analysisProfile.js";
+import { BINARY_ARCHITECTURES, } from "./binaryTargetTypes.js";
 import { jsonObjectSchema, jsonValueSchema, jsonValueValidationIssue, jsonValueValidationSteps, } from "./jsonValue.js";
 import { freezeJsonSnapshot, isImmutableJsonSnapshot, } from "./immutableJson.js";
 import { digestSchema } from "./../domain/digests.js";
@@ -41,7 +42,7 @@ const subjectSchema = z.object({
         "javascript-bundle",
         "entitlements",
     ]),
-    architecture: z.enum(["x86", "x86_64", "arm", "arm64"]).nullable(),
+    architecture: z.enum(BINARY_ARCHITECTURES).nullable(),
     local_path: z.string(),
 });
 /** Source location attached to an evidence observation. */
@@ -108,6 +109,15 @@ export const validateAnalysisProfileProvider = (evidence, context) => {
 };
 /** Strict, provider-neutral record for one successful public observation. */
 export const evidenceSchema = evidenceBaseSchema.superRefine(validateAnalysisProfileProvider);
+const authenticatedEvidenceSchema = evidenceSchema.superRefine((evidence, context) => {
+    const { evidence_id: evidenceId, ...withoutId } = evidence;
+    if (computeEvidenceId(withoutId) !== evidenceId)
+        context.addIssue({
+            code: "custom",
+            path: ["evidence_id"],
+            message: "Evidence semantic identifier does not match its record",
+        });
+});
 const immutableEvidenceSnapshots = new WeakMap();
 const immutableResultSchema = z
     .custom(isImmutableJsonSnapshot)
@@ -147,11 +157,7 @@ export const parseEvidence = (input) => {
         : undefined;
     if (immutable !== undefined)
         return immutable;
-    const evidence = evidenceSchema.parse(input);
-    const { evidence_id: evidenceId, ...withoutId } = evidence;
-    if (computeEvidenceId(withoutId) !== evidenceId)
-        throw new TypeError("Evidence semantic identifier does not match its record");
-    return evidence;
+    return authenticatedEvidenceSchema.parse(input);
 };
 /** Authenticate and seal a ledger-owned snapshot; external mutable values are copied first. */
 export const immutableEvidence = (input) => rememberImmutableEvidence(parseEvidence(input));

package/dist/domain/evidenceBundle.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import canonicalize from "canonicalize";
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 import { evidenceSchema, immutableEvidence, parseEvidence, providerSchema, } from "./evidence.js";
 import { residualUnknownSchema, } from "./residualUnknown.js";
 import { freezeJsonSnapshot } from "./immutableJson.js";
@@ -43,7 +44,7 @@ export const createImmutableEvidenceBundle = (records, unknowns = []) => {
 };
 /** Project records into a deterministic bundle whose order has no semantics. */
 export const createEvidenceBundle = (records, unknowns = []) => {
-    const sortedRecords = [...records].sort((left, right) => left.evidence_id.localeCompare(right.evidence_id));
+    const sortedRecords = [...records].sort((left, right) => compareUnicodeCodePoints(left.evidence_id, right.evidence_id));
     return {
         artifacts: uniqueSorted(sortedRecords.flatMap(({ subject }) => subject === null
             ? []
@@ -73,55 +74,60 @@ export const createEvidenceBundle = (records, unknowns = []) => {
                 },
             ]
             : []),
-        unknowns: [...unknowns].sort((left, right) => left.unknown_id.localeCompare(right.unknown_id) ||
+        unknowns: [...unknowns].sort((left, right) => compareUnicodeCodePoints(left.unknown_id, right.unknown_id) ||
             left.revision - right.revision),
         records: sortedRecords,
     };
 };
-/** Restrict a bundle to records and complete unknown histories for one artifact. */
+/** Retain target records and eligible complete unknown histories with their mutation evidence. */
 export const evidenceBundleForTarget = (bundle, sha256) => {
     const recordsById = new Map(bundle.records.map((record) => [record.evidence_id, record]));
-    const candidates = bundle.unknowns.filter(({ scope_digest: scopeDigest }) => scopeDigest === sha256);
+    const histories = new Map();
+    for (const unknown of bundle.unknowns) {
+        const history = histories.get(unknown.unknown_id) ?? [];
+        history.push(unknown);
+        histories.set(unknown.unknown_id, history);
+    }
     const retained = new Set();
-    const revisionsById = new Map();
     const dependents = new Map();
-    for (const unknown of candidates) {
-        const mutationEvidenceIds = new Set(unknown.mutation_evidence_ids);
-        const evidenceAvailable = referencedEvidenceIds(unknown).every((id) => {
-            const record = recordsById.get(id);
-            return (record?.subject?.digest.sha256 === sha256 ||
-                (mutationEvidenceIds.has(id) &&
-                    record?.subject === null &&
-                    record.predicate_type === "rea.residual-unknown-mutation"));
+    const relationships = new Map();
+    for (const [id, history] of histories) {
+        const eligible = history.every((unknown) => {
+            if (unknown.scope_digest !== sha256)
+                return false;
+            const mutationEvidenceIds = new Set(unknown.mutation_evidence_ids);
+            return referencedEvidenceIds(unknown).every((evidenceId) => {
+                const record = recordsById.get(evidenceId);
+                // Mutation subjects record the target active at the time of an edit,
+                // which need not be the question's immutable investigation scope.
+                return (record?.subject?.digest.sha256 === sha256 ||
+                    (mutationEvidenceIds.has(evidenceId) &&
+                        record?.predicate_type === "rea.residual-unknown-mutation"));
+            });
         });
-        if (!evidenceAvailable)
+        if (!eligible)
             continue;
-        retained.add(unknown);
-        revisionsById.set(unknown.unknown_id, (revisionsById.get(unknown.unknown_id) ?? 0) + 1);
-        for (const relatedId of new Set(unknown.relationships.map(({ unknown_id: id }) => id))) {
+        retained.add(id);
+        const relatedIds = new Set(history.flatMap((unknown) => unknown.relationships.map(({ unknown_id }) => unknown_id)));
+        relationships.set(id, relatedIds);
+        for (const relatedId of relatedIds) {
             const references = dependents.get(relatedId) ?? new Set();
-            references.add(unknown);
+            references.add(id);
             dependents.set(relatedId, references);
         }
     }
     const pending = [];
-    for (const unknown of retained)
-        if (unknown.relationships.some(({ unknown_id: id }) => !revisionsById.has(id)))
-            pending.push(unknown);
+    for (const [id, relatedIds] of relationships)
+        if ([...relatedIds].some((relatedId) => !retained.has(relatedId)))
+            pending.push(id);
     for (let index = 0; index < pending.length; index += 1) {
-        const unknown = pending[index];
-        if (unknown === undefined || !retained.delete(unknown))
+        const id = pending[index];
+        if (id === undefined || !retained.delete(id))
             continue;
-        const remaining = (revisionsById.get(unknown.unknown_id) ?? 1) - 1;
-        if (remaining > 0) {
-            revisionsById.set(unknown.unknown_id, remaining);
-            continue;
-        }
-        revisionsById.delete(unknown.unknown_id);
-        for (const dependent of dependents.get(unknown.unknown_id) ?? [])
+        for (const dependent of dependents.get(id) ?? [])
             pending.push(dependent);
     }
-    const unknowns = candidates.filter((unknown) => retained.has(unknown));
+    const unknowns = bundle.unknowns.filter((unknown) => retained.has(unknown.unknown_id));
     const mutationIds = new Set(unknowns.flatMap(({ mutation_evidence_ids: ids }) => ids));
     return createEvidenceBundle(bundle.records.filter((record) => record.subject?.digest.sha256 === sha256 ||
         mutationIds.has(record.evidence_id)), unknowns);
@@ -166,7 +172,19 @@ export const parseEvidenceBundle = (input) => {
     if (new Set(recordIds).size !== recordIds.length)
         throw new TypeError("Evidence bundle contains duplicate record IDs");
     validateUnknownGraph(parsed.unknowns, parsed.records);
-    const canonical = createEvidenceBundle(parsed.records.map(parseEvidence), parsed.unknowns);
+    const canonical = createEvidenceBundle(parsed.records.map((record, index) => {
+        try {
+            return parseEvidence(record);
+        }
+        catch (cause) {
+            if (cause instanceof z.ZodError)
+                throw new z.ZodError(cause.issues.map((issue) => ({
+                    ...issue,
+                    path: ["records", index, ...issue.path],
+                })));
+            throw cause;
+        }
+    }), parsed.unknowns);
     if (JSON.stringify(parsed) !== JSON.stringify(canonical))
         throw new TypeError("Evidence bundle manifests are not canonical");
     return canonical;
@@ -364,6 +382,6 @@ const uniqueSorted = (values) => {
     for (const value of values)
         unique.set(JSON.stringify(value), value);
     return [...unique.entries()]
-        .sort(([left], [right]) => left.localeCompare(right))
+        .sort(([left], [right]) => compareUnicodeCodePoints(left, right))
         .map(([, value]) => value);
 };

package/dist/domain/evidenceRecordSummary.js

@@ -0,0 +1,144 @@
+import { z } from "zod";
+import { digestSchema, prefixedDigestSchema } from "./digests.js";
+import { evidenceSchema } from "./evidence.js";
+/** Exact retained-record selectors; selection never resolves a provider address. */
+export const evidenceRecordFiltersSchema = z.strictObject({
+    evidence_id: prefixedDigestSchema("ev").optional(),
+    operation: z.string().min(1).optional(),
+    target_sha256: digestSchema.optional(),
+    analysis_profile_digest: digestSchema.optional(),
+    procedure_address: z.string().min(1).optional(),
+});
+const countSchema = z.number().int().nonnegative();
+const nativeMetadataSchema = z.object({
+    procedure: z.object({ address: z.string(), name: z.string().nullish() }),
+    native_value_flow: z.unknown().optional(),
+});
+const valueFlowMetadataSchema = z.union([
+    z.object({
+        available: z.literal(true),
+        truncated: z.boolean(),
+        omitted_operations_lower_bound: countSchema.optional(),
+        known_omitted_inputs: countSchema.optional(),
+        known_omitted_edges: countSchema.optional(),
+    }),
+    z.object({ available: z.literal(false), reason: z.string() }),
+]);
+const nativeSummarySchema = z.discriminatedUnion("available", [
+    z.strictObject({
+        available: z.literal(true),
+        procedure_address: z.string(),
+        procedure_name: z.string().nullable(),
+        value_flow: z.discriminatedUnion("status", [
+            z.strictObject({
+                status: z.literal("observed"),
+                truncated: z.boolean(),
+                omitted_operations_lower_bound: countSchema.nullable(),
+                known_omitted_inputs: countSchema.nullable(),
+                known_omitted_edges: countSchema.nullable(),
+            }),
+            z.strictObject({ status: z.literal("unavailable"), reason: z.string() }),
+            z.strictObject({ status: z.literal("not-recorded") }),
+            z.strictObject({ status: z.literal("unknown"), reason: z.string() }),
+        ]),
+    }),
+    z.strictObject({
+        available: z.literal(false),
+        reason: z.enum(["different-operation", "not-recorded-or-incompatible"]),
+    }),
+]);
+/** Metadata for complete retained records, independent of analysis completeness. */
+export const evidenceBundleSummarySchema = z.strictObject({
+    kind: z.literal("evidence-bundle-summary"),
+    filters: z.record(z.string(), z.string()),
+    total_retained_records: countSchema,
+    matching_records: countSchema,
+    unknown_revisions: countSchema,
+    records: z.array(z.strictObject({
+        evidence_id: evidenceSchema.shape.evidence_id,
+        subject: evidenceSchema.shape.subject,
+        provider: evidenceSchema.shape.provider,
+        operation: evidenceSchema.shape.operation,
+        confidence: evidenceSchema.shape.confidence,
+        authority: evidenceSchema.shape.authority,
+        analysis_profile_digest: digestSchema.nullable(),
+        retention: z.literal("complete-record"),
+        limitation_count: countSchema,
+        native_dossier: nativeSummarySchema,
+    })),
+});
+const nativeSummary = (evidence) => {
+    if (evidence.operation !== "analyze_function")
+        return { available: false, reason: "different-operation" };
+    // Read only producer metadata. Parsing the full dossier would allocate every
+    // large collection merely to discover its already authenticated parent ID.
+    const parsed = nativeMetadataSchema.safeParse(evidence.normalized_result);
+    if (!parsed.success)
+        return { available: false, reason: "not-recorded-or-incompatible" };
+    const flow = valueFlowMetadataSchema.safeParse(parsed.data.native_value_flow);
+    return {
+        available: true,
+        procedure_address: parsed.data.procedure.address,
+        procedure_name: parsed.data.procedure.name ?? null,
+        value_flow: parsed.data.native_value_flow == null
+            ? { status: "not-recorded" }
+            : !flow.success
+                ? {
+                    status: "unknown",
+                    reason: "Value-flow metadata has an incompatible representation.",
+                }
+                : flow.data.available
+                    ? {
+                        status: "observed",
+                        truncated: flow.data.truncated,
+                        omitted_operations_lower_bound: flow.data.omitted_operations_lower_bound ?? null,
+                        known_omitted_inputs: flow.data.known_omitted_inputs ?? null,
+                        known_omitted_edges: flow.data.known_omitted_edges ?? null,
+                    }
+                    : { status: "unavailable", reason: flow.data.reason },
+    };
+};
+/** Discover retained Evidence without reading or copying its complete payloads. */
+export const summarizeEvidenceBundle = (bundle, filters = {}) => {
+    const selectedFilters = {};
+    for (const [field, value] of Object.entries(filters))
+        if (value !== undefined)
+            selectedFilters[field] = value;
+    const records = [];
+    for (const evidence of bundle.records) {
+        if ((filters.evidence_id !== undefined &&
+            filters.evidence_id !== evidence.evidence_id) ||
+            (filters.operation !== undefined &&
+                filters.operation !== evidence.operation) ||
+            (filters.target_sha256 !== undefined &&
+                filters.target_sha256 !== evidence.subject?.digest.sha256) ||
+            (filters.analysis_profile_digest !== undefined &&
+                filters.analysis_profile_digest !== evidence.analysis_profile?.digest))
+            continue;
+        const native = nativeSummary(evidence);
+        if (filters.procedure_address !== undefined &&
+            (!native.available ||
+                filters.procedure_address !== native.procedure_address))
+            continue;
+        records.push({
+            evidence_id: evidence.evidence_id,
+            subject: evidence.subject,
+            provider: evidence.provider,
+            operation: evidence.operation,
+            confidence: evidence.confidence,
+            authority: evidence.authority,
+            analysis_profile_digest: evidence.analysis_profile?.digest ?? null,
+            retention: "complete-record",
+            limitation_count: evidence.limitations.length,
+            native_dossier: native,
+        });
+    }
+    return {
+        kind: "evidence-bundle-summary",
+        filters: selectedFilters,
+        total_retained_records: bundle.records.length,
+        matching_records: records.length,
+        unknown_revisions: bundle.unknowns.length,
+        records,
+    };
+};

package/dist/domain/firmware/firmwareAnalysis.js

@@ -1,12 +1,13 @@
 import { z } from "zod";
+import { isAbsolute } from "node:path";
 import { digestSchema } from "../digests.js";
 import { jsonValueSchema } from "../jsonValue.js";
-import { isAbsoluteLocalPath, localPathStringSchema } from "../localPath.js";
+import { localPathStringSchema } from "../localPath.js";
 const bytes = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
 const range = z.strictObject({ offset: bytes, length: bytes.positive() });
 const target = {
     path: localPathStringSchema
-        .refine(isAbsoluteLocalPath, {
+        .refine(isAbsolute, {
         message: "path must be an absolute local filesystem path (for example /tmp/firmware.bin or C:\\firmware\\firmware.bin)",
     })
         .describe("Absolute local firmware file; never executed. Relative paths are rejected."),
@@ -17,7 +18,7 @@ export const firmwareInputSchemas = {
     extract_firmware: z.strictObject({
         ...target,
         output_directory: localPathStringSchema
-            .refine(isAbsoluteLocalPath, {
+            .refine(isAbsolute, {
             message: "output_directory must be an absolute local filesystem path",
         })
             .describe("Absolute, absent output directory; parent must exist"),

package/dist/domain/functionComparison.js

@@ -1,4 +1,5 @@
 import { canonicalJson } from "./comparisonSemantics.js";
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 import { parseFunctionEvidence } from "./functionDossierEvidence.js";
 import { functionMatch } from "./functionComparisonNormalization.js";
 import { functionComparisonResultSchema, } from "./functionComparisonSchemas.js";
@@ -32,6 +33,6 @@ export const compareFunctions = (leftInput, rightInput) => {
                     ]
                     : []),
             ]),
-        ].sort((a, b) => a.localeCompare(b)),
+        ].sort((a, b) => compareUnicodeCodePoints(a, b)),
     });
 };

package/dist/domain/functionComparisonNormalization.js

@@ -1,5 +1,5 @@
 import { canonicalJson } from "./comparisonSemantics.js";
-import { compareCodePoints } from "./canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 export const identityProjection = (snapshot) => ({
     name: snapshot.dossier.procedure.name,
     signature: snapshot.dossier.procedure.signature,
@@ -136,9 +136,10 @@ export const sorted = (values) => values
     value,
     json: canonicalJson(value, "Function normalization"),
 }))
-    .sort((left, right) => compareCodePoints(left.json, right.json))
+    .sort((left, right) => compareUnicodeCodePoints(left.json, right.json))
     .map(({ value }) => value);
-export const isAutoName = (name) => /^(?:sub_[0-9a-f]+|fcn\.[0-9a-f]+)$/iu.test(name);
+/** Recognize address-derived procedure names without excluding named FUN_ symbols. */
+export const isAutoName = (name) => /^(?:sub_[0-9a-f]+|fcn\.[0-9a-f]+|FUN_[0-9a-f]+)$/iu.test(name);
 const parseAddress = (value) => /^0x[0-9a-f]+$/iu.test(value) ? BigInt(value) : null;
 const relativeAddress = (value, base) => {
     const parsed = parseAddress(value);

package/dist/domain/functionComparisonResults.js

@@ -1,4 +1,4 @@
-import { canonicalDigest } from "./comparisonSemantics.js";
+import { digestCanonicalValue } from "./canonicalDigest.js";
 export const dimensionResult = (input) => {
     const context = {
         dimension: input.dimension,
@@ -51,4 +51,4 @@ export const summarize = (dimensions) => ({
     changed: dimensions.filter(({ status }) => status === "changed").length,
     unknown: dimensions.filter(({ status }) => status === "unknown").length,
 });
-const digest = (value) => canonicalDigest(value, "Function comparison");
+const digest = (value) => digestCanonicalValue(value, "Function comparison");

package/dist/domain/functionDossierEvidence.js

@@ -1,4 +1,5 @@
 import { parseEvidence } from "./evidence.js";
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 import { functionDossierSchema } from "./hopperValues.js";
 /** Parse one complete analyze_function Evidence record for comparison workflows. */
 export const parseFunctionEvidence = (input) => {
@@ -14,6 +15,6 @@ export const parseFunctionEvidence = (input) => {
         dossier,
         limitations: [
             ...new Set([...evidence.limitations, ...dossier.limitations]),
-        ].sort((left, right) => left.localeCompare(right)),
+        ].sort((left, right) => compareUnicodeCodePoints(left, right)),
     };
 };

package/dist/domain/hopperValues.js

@@ -29,12 +29,12 @@ const procedureMapSchema = z.record(z.string(), z.string());
 const addressedNamesSchema = z.array(z.object({ address: z.string(), name: z.string() }));
 const addressedNameMapSchema = z.record(z.string(), z.string());
 const segmentSchema = z.object({
-    name: z.string().default(""),
-    start: z.string().default(""),
-    end: z.string().default(""),
-    readable: z.boolean().nullable().default(null),
-    writable: z.boolean().nullable().default(null),
-    executable: z.boolean().nullable().default(null),
+    name: z.string(),
+    start: z.string(),
+    end: z.string(),
+    readable: z.boolean().nullable(),
+    writable: z.boolean().nullable(),
+    executable: z.boolean().nullable(),
 });
 const unavailableAnalysisFactSchema = z
     .object({ available: z.literal(false), reason: z.string() })
@@ -142,10 +142,6 @@ export const functionBodySchema = z.discriminatedUnion("available", [
             });
     }),
 ]);
-const unknownFunctionBody = () => functionBodySchema.default({
-    available: false,
-    reason: "The provider did not report complete function body ranges.",
-});
 /** Check the declared entry membership against complete, inclusive body ranges. */
 export const functionBodyEntryAgrees = (body, address) => {
     if (!body.available)
@@ -176,8 +172,8 @@ export const procedureIdentitySchema = z
     .object({
     address: z.string(),
     name: z.string(),
-    classification: procedureClassificationSchema.nullable().default(null),
-    body: unknownFunctionBody(),
+    classification: procedureClassificationSchema.nullable(),
+    body: functionBodySchema,
 })
     .strict()
     .superRefine((identity, context) => {
@@ -289,9 +285,9 @@ export const functionDossierSchema = z
         successors: z.array(z.string()),
     })
         .strict()),
-    native_api: nativeApiBoundarySchema.nullable().default(null),
-    native_value_flow: nativeValueFlowSchema.nullable().default(null),
-    limitations: z.array(z.string()).default([]),
+    native_api: nativeApiBoundarySchema.nullable(),
+    native_value_flow: nativeValueFlowSchema.nullable(),
+    limitations: z.array(z.string()),
 })
     .strict();
 /** Strictly parse a complete provider-neutral function dossier. */

package/dist/domain/inputIssueProjection.js

@@ -6,8 +6,23 @@ export const projectInputIssues = (issues, input) => issues.flatMap((issue) => p
 const projectIssue = (issue, input) => {
     const path = issue.path.flatMap((part) => typeof part === "string" || typeof part === "number" ? [part] : []);
     // Branch issue paths are relative to the union; branches often agree.
-    if (issue.code === "invalid_union")
+    if (issue.code === "invalid_union") {
+        // Unmatched discriminators and ambiguous unions have no branch issues.
+        // Keep their outer failure instead of flattening it into an empty list.
+        if (issue.errors.length === 0) {
+            const expected = "options" in issue ? issue.options?.filter(isSafeExpected) : undefined;
+            return [
+                {
+                    path,
+                    reason: valueAtPath(input, path) === undefined
+                        ? "missing_argument"
+                        : "invalid_value",
+                    ...(expected === undefined ? {} : { expected }),
+                },
+            ];
+        }
         return uniqueIssues(issue.errors.flatMap((branch) => branch.flatMap((branchIssue) => projectIssue({ ...branchIssue, path: [...issue.path, ...branchIssue.path] }, input))));
+    }
     if (issue.code === "invalid_key")
         return issue.issues.flatMap((keyIssue) => projectIssue({ ...keyIssue, path: [...issue.path, ...keyIssue.path] }, input));
     if (issue.code === "unrecognized_keys")

package/dist/domain/javascript/electronActiveObservation.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
-import { isAbsoluteLocalPath, localPathStringSchema } from "../localPath.js";
-const pathInputSchema = localPathStringSchema.refine(isAbsoluteLocalPath, {
+import { isAbsolute } from "node:path";
+import { localPathStringSchema } from "../localPath.js";
+const pathInputSchema = localPathStringSchema.refine(isAbsolute, {
     message: "Electron executable, application, and root paths must be absolute local filesystem paths (for example /Applications/Electron.app/Contents/MacOS/Electron)",
 });
 const absolutePathSchema = z
@@ -63,7 +64,7 @@ export const electronActiveObservationInputSchema = z.strictObject({
     args: z
         .array(z
         .string()
-        .regex(/^[^\u0000]*$/u, "Electron arguments must not contain NUL"))
+        .regex(/^[^\x00]*$/u, "Electron arguments must not contain NUL"))
         .default([]),
     actions: z.array(actionSchema).default([]),
 });