rea-agents 6.2.0 → 6.4.0

package/dist/domain/jsonShape.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { compareCodePoints } from "./canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 const jsonValueTypeSchema = z.enum([
     "object",
     "array",
@@ -8,17 +8,22 @@ const jsonValueTypeSchema = z.enum([
     "boolean",
     "null",
 ]);
+const jsonShapePathSegmentSchema = z.discriminatedUnion("kind", [
+    z.object({ kind: z.literal("property"), name: z.string() }),
+    z.object({ kind: z.literal("array-element") }),
+]);
 /** Value-free structural summary of one approved JSON payload. */
 export const jsonShapeSchema = z.object({
     root_type: jsonValueTypeSchema,
     node_count: z.number().int().min(1),
     max_depth_observed: z.number().int().min(0),
     properties: z.array(z.object({
-        path: z.string(),
+        path: z.array(jsonShapePathSegmentSchema).min(1),
         types: z.array(jsonValueTypeSchema).min(1),
         observations: z.number().int().min(1),
     })),
 });
+const arrayElementKey = Symbol("array-element");
 /** Parse approved JSON and immediately discard values after iterative shape inference. */
 export const inferJsonShape = (text) => {
     let root;
@@ -30,8 +35,31 @@ export const inferJsonShape = (text) => {
         void cause;
         return null;
     }
-    const properties = new Map();
-    const pending = [{ value: root, path: "", depth: 0 }];
+    const rootShape = {
+        path: [],
+        types: new Set(),
+        observations: 0,
+    };
+    // Each structural path owns one accumulator, shared by all matching array rows.
+    const childShape = (parent, key) => {
+        const children = (parent.children ??= new Map());
+        const existing = children.get(key);
+        if (existing !== undefined)
+            return existing;
+        const node = {
+            path: [
+                ...parent.path,
+                typeof key === "string"
+                    ? { kind: "property", name: key }
+                    : { kind: "array-element" },
+            ],
+            types: new Set(),
+            observations: 0,
+        };
+        children.set(key, node);
+        return node;
+    };
+    const pending = [{ value: root, shape: rootShape }];
     let nodeCount = 0;
     let maxDepthObserved = 0;
     while (pending.length > 0) {
@@ -39,14 +67,15 @@ export const inferJsonShape = (text) => {
         if (current === undefined)
             break;
         nodeCount += 1;
-        maxDepthObserved = Math.max(maxDepthObserved, current.depth);
+        maxDepthObserved = Math.max(maxDepthObserved, current.shape.path.length);
+        current.shape.types.add(jsonValueType(current.value));
+        current.shape.observations += 1;
         if (Array.isArray(current.value)) {
+            if (current.value.length === 0)
+                continue;
+            const shape = childShape(current.shape, arrayElementKey);
             for (let index = current.value.length - 1; index >= 0; index -= 1)
-                pending.push({
-                    value: current.value[index],
-                    path: `${current.path}/*`,
-                    depth: current.depth + 1,
-                });
+                pending.push({ value: current.value[index], shape });
             continue;
         }
         if (!isRecord(current.value))
@@ -57,31 +86,31 @@ export const inferJsonShape = (text) => {
             if (entry === undefined)
                 continue;
             const [name, value] = entry;
-            const path = `${current.path}/${pointerName(name)}`;
-            const type = jsonValueType(value);
-            const existing = properties.get(path);
-            if (existing === undefined)
-                properties.set(path, { types: new Set([type]), observations: 1 });
-            else {
-                existing.types.add(type);
-                existing.observations += 1;
-            }
-            pending.push({ value, path, depth: current.depth + 1 });
+            pending.push({ value, shape: childShape(current.shape, name) });
         }
     }
-    return jsonShapeSchema.parse({
+    // Preorder over sorted siblings gives canonical paths without repeatedly
+    // comparing their shared prefixes. Each returned path owns its segments.
+    const properties = [];
+    const shapes = orderedChildren(rootShape);
+    while (shapes.length > 0) {
+        const shape = shapes.pop();
+        if (shape === undefined)
+            break;
+        properties.push({
+            path: shape.path.map((segment) => ({ ...segment })),
+            types: [...shape.types].sort(),
+            observations: shape.observations,
+        });
+        for (const child of orderedChildren(shape))
+            shapes.push(child);
+    }
+    return {
         root_type: jsonValueType(root),
         node_count: nodeCount,
         max_depth_observed: maxDepthObserved,
-        properties: [...properties.entries()]
-            .map(([path, value]) => ({
-            path,
-            types: [...value.types].sort(),
-            observations: value.observations,
-        }))
-            .sort((left, right) => left.path.localeCompare(right.path) ||
-            compareCodePoints(left.path, right.path)),
-    });
+        properties,
+    };
 };
 const jsonValueType = (value) => {
     if (value === null)
@@ -100,4 +129,13 @@ const jsonValueType = (value) => {
     }
 };
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const pointerName = (value) => value.replaceAll("~", "~0").replaceAll("/", "~1");
+/** Reverse sibling order for the traversal stack; array elements sort first. */
+const orderedChildren = (node) => [...(node.children ?? [])]
+    .sort(([left], [right]) => left === right
+    ? 0
+    : left === arrayElementKey
+        ? 1
+        : right === arrayElementKey
+            ? -1
+            : compareUnicodeCodePoints(right, left))
+    .map(([, child]) => child);

package/dist/domain/jsonValue.js

@@ -64,6 +64,9 @@ export function* jsonValueValidationSteps(root) {
     return finish(undefined);
 }
 const preserveJsonValue = (value) => {
+    const immutableCandidate = value;
+    if (isImmutableJsonSnapshot(immutableCandidate))
+        return value;
     if (Array.isArray(value))
         return value.map(preserveJsonValue);
     if (value !== null && typeof value === "object")

package/dist/domain/localPath.js

@@ -1,12 +1,18 @@
 import { isAbsolute, relative, sep } from "node:path";
 import { z } from "zod";
-/** Preserve selected filesystem names while rejecting OS-invalid NUL bytes. */
+/**
+ * Preserve selected filesystem names while rejecting OS-invalid NUL bytes.
+ *
+ * The pattern spells NUL as `\x00` rather than `\u0000`. Both accept exactly the
+ * same strings. The hex form also avoids the short `\0` spelling rejected by
+ * strict schema consumers. A client can reject its entire tool request when
+ * one advertised pattern cannot compile. See `offsetDateTimeSchema` for the
+ * same hex-escape convention.
+ */
 export const localPathStringSchema = z
     .string()
     .min(1)
-    .regex(/^[^\u0000]*$/u, "Local filesystem paths cannot contain NUL");
-/** True when the value is an absolute filesystem path on the host platform. */
-export const isAbsoluteLocalPath = (value) => isAbsolute(value);
+    .regex(/^[^\x00]*$/u, "Local filesystem paths cannot contain NUL");
 /** Test lexical containment on the host platform; callers must resolve symlinks first. */
 export const isPathWithinRoot = (root, path) => {
     const value = relative(root, path);

package/dist/domain/managed/managedApplicationGraph.js

@@ -65,6 +65,7 @@ export const projectManagedApplicationGraph = (input) => {
     const parsed = parseManagedInputs(input);
     const artifactIdentity = chooseArtifact(parsed);
     assertSameArtifact(parsed, artifactIdentity.sha256);
+    assertConsistentModuleIdentity(parsed);
     const evidenceLinks = [
         parsed.artifact?.evidence.evidence_id,
         parsed.members?.evidence.evidence_id,
@@ -82,8 +83,8 @@ export const projectManagedApplicationGraph = (input) => {
     };
     const artifactNode = addArtifactNode(state);
     addArtifactIdentityNodes(state, artifactNode, parsed);
-    const memberCounts = addMemberNodes(state, artifactNode, parsed);
-    const boundaryCounts = addBoundaryNodes(state, artifactNode, parsed);
+    addMemberNodes(state, artifactNode, parsed);
+    addBoundaryNodes(state, artifactNode, parsed);
     const omissions = omittedCounts(parsed);
     const limitations = projectionLimitations(parsed, omissions);
     const graph = createJavaScriptApplicationGraph({
@@ -104,10 +105,13 @@ export const projectManagedApplicationGraph = (input) => {
         summary: {
             graph_nodes: graph.nodes.length,
             graph_edges: graph.edges.length,
-            assemblies: parsed.artifact?.result.assembly === null ? 0 : 1,
-            modules: parsed.artifact?.result.module === null ? 0 : 1,
-            ...memberCounts,
-            ...boundaryCounts,
+            assemblies: countNodes(graph.nodes, "managed-assembly"),
+            modules: countNodes(graph.nodes, "managed-module"),
+            types: countNodes(graph.nodes, "managed-type"),
+            methods: countNodes(graph.nodes, "managed-method"),
+            fields: countNodes(graph.nodes, "managed-field"),
+            pinvoke_imports: countNodes(graph.nodes, "managed-pinvoke-import"),
+            native_implementations: countNodes(graph.nodes, "managed-native-implementation"),
         },
         graph,
         coverage: managedGraphResultCoverage(omissions),
@@ -119,6 +123,7 @@ export const projectManagedApplicationGraph = (input) => {
         projection_id: `magp_${sha256(withoutId)}`,
     });
 };
+const countNodes = (nodes, kind) => nodes.filter((node) => node.kind === kind).length;
 const parseManagedInputs = (input) => ({
     artifact: input.managed_artifact === undefined
         ? null
@@ -147,6 +152,37 @@ const assertSameArtifact = (parsed, sha256Value) => {
         if (result !== undefined && result.artifact.sha256 !== sha256Value)
             throw new TypeError("Managed graph projection inputs must describe the same artifact SHA-256");
 };
+/** Reject contradictory known module identities while leaving null fields unknown. */
+const assertConsistentModuleIdentity = (parsed) => {
+    const mvidClaims = [
+        parsed.artifact?.result.module?.mvid,
+        parsed.members?.result.module?.mvid,
+        parsed.members?.result.identity_scope.requires_mvid,
+        parsed.boundaries?.result.module?.mvid,
+        parsed.boundaries?.result.identity_scope.requires_mvid,
+    ]
+        .filter((mvid) => mvid !== undefined && mvid !== null)
+        .map((mvid) => mvid.toLowerCase());
+    if (new Set(mvidClaims).size > 1)
+        throw new TypeError("Managed graph inputs report conflicting known module MVIDs or token scopes");
+    const modules = [
+        parsed.artifact?.result.module,
+        parsed.members?.result.module,
+        parsed.boundaries?.result.module,
+    ].filter((module) => module !== undefined && module !== null);
+    for (const field of ["name", "generation", "token", "row_offset"]) {
+        const values = new Set(modules.map((module) => module[field]));
+        if (values.size > 1)
+            throw new TypeError(`Managed graph inputs report conflicting module ${field} values`);
+    }
+    for (const field of ["enc_id", "enc_base_id"]) {
+        const values = new Set(modules
+            .map((module) => module[field]?.toLowerCase())
+            .filter((value) => value !== undefined));
+        if (values.size > 1)
+            throw new TypeError(`Managed graph inputs report conflicting module ${field} values`);
+    }
+};
 const omittedCounts = (parsed) => assessManagedGraphOmissions({
     artifact: parsed.artifact?.result ?? null,
     members: parsed.members?.result ?? null,
@@ -172,4 +208,9 @@ const projectionLimitations = (parsed, omissions) => [
     ...(omissions.partialInput
         ? ["At least one supplied managed Evidence record has partial coverage."]
         : []),
+    ...(omissions.unscopedTokenRelationships
+        ? [
+            "Managed boundary tokens were not linked to member nodes because matching module MVID scope was not established.",
+        ]
+        : []),
 ];

package/dist/domain/managed/managedApplicationGraphCoverage.js

@@ -1,3 +1,4 @@
+import { managedTokenScopesMatch } from "./managedInspectionEvidence.js";
 const completeCoverage = () => ({
     status: "complete",
     truncated: false,
@@ -15,6 +16,11 @@ export const managedSourceCoverage = (state) => state === "complete"
     };
 /** Determine whether any supplied managed inspection was partial. */
 export const assessManagedGraphOmissions = (sources) => ({
+    unscopedTokenRelationships: sources.members !== null &&
+        sources.boundaries !== null &&
+        (sources.boundaries.pinvoke_imports.some(({ member_token }) => member_token !== null) ||
+            sources.boundaries.native_implementations.length > 0) &&
+        !managedTokenScopesMatch(sources.members.identity_scope.requires_mvid, sources.boundaries.identity_scope.requires_mvid),
     partialInput: [
         sources.members?.coverage.state,
         sources.boundaries?.coverage.state,
@@ -22,7 +28,7 @@ export const assessManagedGraphOmissions = (sources) => ({
     ].some((state) => state !== undefined && state !== "complete"),
 });
 /** Derive graph coverage solely from the coverage of supplied source evidence. */
-export const managedGraphEvidenceCoverage = (omissions) => omissions.partialInput
+export const managedGraphEvidenceCoverage = (omissions) => omissions.partialInput || omissions.unscopedTokenRelationships
     ? {
         status: "partial",
         truncated: false,
@@ -32,7 +38,7 @@ export const managedGraphEvidenceCoverage = (omissions) => omissions.partialInpu
     : completeCoverage();
 /** Report whether all supplied source evidence was complete. */
 export const managedGraphResultCoverage = (omissions) => ({
-    status: omissions.partialInput
+    status: omissions.partialInput || omissions.unscopedTokenRelationships
         ? "partial"
         : "complete-within-inputs",
 });

package/dist/domain/managed/managedApplicationGraphNodes.js

@@ -1,8 +1,8 @@
 import { basename } from "node:path";
 import { createJavaScriptApplicationEdge, createJavaScriptApplicationNode, } from "../javascript/javascriptApplicationGraph.js";
 import { managedSourceCoverage } from "./managedApplicationGraphCoverage.js";
+import { managedTokenScopesMatch } from "./managedInspectionEvidence.js";
 import {} from "./managedArtifact.js";
-import { moduleCoverageState } from "./managedApplicationGraphNodeCoverage.js";
 /** Add the root managed artifact node to the graph state. */
 export const addArtifactNode = (state) => {
     const node = createJavaScriptApplicationNode({
@@ -19,7 +19,7 @@ export const addArtifactNode = (state) => {
                     format: "pe",
                     source: "managed-application-graph",
                 },
-                evidence: managedEvidence(state, "project-managed-artifact"),
+                evidence: projectedManagedEvidence(state, "project-managed-artifact"),
             },
         ],
     });
@@ -28,39 +28,39 @@ export const addArtifactNode = (state) => {
 };
 /** Add managed assembly and module identity nodes for the artifact. */
 export const addArtifactIdentityNodes = (state, artifactNode, parsed) => {
-    const artifact = parsed.artifact?.result;
-    const artifactCoverage = managedSourceCoverage(parsed.artifact?.result.coverage.state ?? "complete");
-    if (artifact?.assembly !== undefined && artifact.assembly !== null) {
+    const artifactInput = parsed.artifact;
+    if (artifactInput !== null && artifactInput.result.assembly !== null) {
+        const assemblyFacts = artifactInput.result.assembly;
+        const artifactEvidence = sourceManagedEvidence(state, artifactInput.evidence, artifactInput.result.coverage.state);
         const assembly = createJavaScriptApplicationNode({
             kind: "managed-assembly",
-            identity: artifactLocalIdentity(state.artifactSha256, "managed-assembly", artifact.assembly.token),
+            identity: artifactLocalIdentity(state.artifactSha256, "managed-assembly", assemblyFacts.token),
             observations: [
                 {
-                    label: artifact.assembly.name,
+                    label: assemblyFacts.name,
                     properties: {
-                        name: artifact.assembly.name,
-                        version: artifact.assembly.version,
-                        culture: artifact.assembly.culture,
-                        public_key_kind: artifact.assembly.public_key.kind,
+                        name: assemblyFacts.name,
+                        version: assemblyFacts.version,
+                        culture: assemblyFacts.culture,
+                        public_key_kind: assemblyFacts.public_key.kind,
                     },
-                    evidence: managedEvidence(state, "inspect_managed_artifact", artifactCoverage),
+                    evidence: artifactEvidence,
                 },
             ],
         });
         state.nodes.push(assembly);
         addContainsEdge(state, artifactNode, assembly, {
             kind: "declares-managed-assembly",
-            coverage: artifactCoverage,
+            coverage: artifactEvidence.coverage,
         });
     }
-    const module = artifact?.module ??
-        parsed.members?.result.module ??
-        parsed.boundaries?.result.module;
-    if (module !== undefined && module !== null) {
-        const moduleCoverage = managedSourceCoverage(moduleCoverageState(parsed));
+    const moduleSource = selectModuleSource(parsed);
+    if (moduleSource !== null) {
+        const { module } = moduleSource;
+        const moduleEvidence = sourceManagedEvidence(state, moduleSource.evidence, moduleSource.coverageState);
         const moduleNode = createJavaScriptApplicationNode({
             kind: "managed-module",
-            identity: artifactLocalIdentity(state.artifactSha256, "managed-module", module.mvid ?? module.token),
+            identity: artifactLocalIdentity(state.artifactSha256, "managed-module", module.mvid?.toLowerCase() ?? module.token),
             observations: [
                 {
                     label: module.name,
@@ -70,28 +70,56 @@ export const addArtifactIdentityNodes = (state, artifactNode, parsed) => {
                         generation: module.generation,
                         token: module.token,
                     },
-                    evidence: managedEvidence(state, "inspect_managed_artifact", moduleCoverage),
+                    evidence: moduleEvidence,
                 },
             ],
         });
         state.nodes.push(moduleNode);
         addContainsEdge(state, artifactNode, moduleNode, {
             kind: "declares-managed-module",
-            coverage: moduleCoverage,
+            coverage: moduleEvidence.coverage,
         });
     }
 };
+const selectModuleSource = (parsed) => {
+    const sources = [
+        parsed.artifact?.result.module == null
+            ? null
+            : {
+                module: parsed.artifact.result.module,
+                evidence: parsed.artifact.evidence,
+                coverageState: parsed.artifact.result.coverage.state,
+            },
+        parsed.members?.result.module == null
+            ? null
+            : {
+                module: parsed.members.result.module,
+                evidence: parsed.members.evidence,
+                coverageState: parsed.members.result.coverage.state,
+            },
+        parsed.boundaries?.result.module == null
+            ? null
+            : {
+                module: parsed.boundaries.result.module,
+                evidence: parsed.boundaries.evidence,
+                coverageState: parsed.boundaries.result.coverage.state,
+            },
+    ].filter((source) => source !== null);
+    return (sources.find(({ module }) => module.mvid !== null) ?? sources[0] ?? null);
+};
 /** Add managed type, method, and field nodes from member evidence. */
 export const addMemberNodes = (state, artifactNode, parsed) => {
-    const members = parsed.members?.result;
-    if (members === undefined)
-        return { types: 0, methods: 0, fields: 0 };
+    const memberInput = parsed.members;
+    if (memberInput === null)
+        return;
+    const members = memberInput.result;
     const { types, methods, fields } = members;
     const typeCoverage = managedSourceCoverage(members.coverage.state);
     const methodCoverage = managedSourceCoverage(members.coverage.state);
     const fieldCoverage = managedSourceCoverage(members.coverage.state);
+    const sourceEvidence = sourceManagedEvidence(state, memberInput.evidence, members.coverage.state);
     for (const type of types) {
-        const node = typeNode(state, type, typeCoverage);
+        const node = typeNode(state, type, sourceEvidence);
         state.nodes.push(node);
         state.typeNodes.set(type.token, node);
         addContainsEdge(state, artifactNode, node, {
@@ -100,7 +128,7 @@ export const addMemberNodes = (state, artifactNode, parsed) => {
         });
     }
     for (const method of methods) {
-        const node = methodNode(state, method, methodCoverage);
+        const node = methodNode(state, method, sourceEvidence);
         state.nodes.push(node);
         state.methodNodes.set(method.token, node);
         const owner = method.declaring_type_token === null
@@ -112,7 +140,7 @@ export const addMemberNodes = (state, artifactNode, parsed) => {
         });
     }
     for (const field of fields) {
-        const node = fieldNode(state, field, fieldCoverage);
+        const node = fieldNode(state, field, sourceEvidence);
         state.nodes.push(node);
         state.fieldNodes.set(field.token, node);
         const owner = field.declaring_type_token === null
@@ -123,14 +151,9 @@ export const addMemberNodes = (state, artifactNode, parsed) => {
             coverage: fieldCoverage,
         });
     }
-    return {
-        types: types.length,
-        methods: methods.length,
-        fields: fields.length,
-    };
 };
 /** Build a managed type application node. */
-const typeNode = (state, type, coverage) => createJavaScriptApplicationNode({
+const typeNode = (state, type, evidence) => createJavaScriptApplicationNode({
     kind: "managed-type",
     identity: artifactLocalIdentity(state.artifactSha256, "managed-type-token", type.token),
     observations: [
@@ -144,12 +167,12 @@ const typeNode = (state, type, coverage) => createJavaScriptApplicationNode({
                 flags: type.flags,
                 extends_token: type.extends_token,
             },
-            evidence: managedEvidence(state, "inspect_managed_members", coverage),
+            evidence,
         },
     ],
 });
 /** Build a managed method application node. */
-const methodNode = (state, method, coverage) => createJavaScriptApplicationNode({
+const methodNode = (state, method, evidence) => createJavaScriptApplicationNode({
     kind: "managed-method",
     identity: artifactLocalIdentity(state.artifactSha256, "managed-method-token", method.token),
     observations: [
@@ -169,12 +192,12 @@ const methodNode = (state, method, coverage) => createJavaScriptApplicationNode(
                 normalized_il_sha256: method.body.normalized_il_sha256,
                 il_size: method.body.il_size,
             },
-            evidence: managedEvidence(state, "inspect_managed_members", coverage),
+            evidence,
         },
     ],
 });
 /** Build a managed field application node. */
-const fieldNode = (state, field, coverage) => createJavaScriptApplicationNode({
+const fieldNode = (state, field, evidence) => createJavaScriptApplicationNode({
     kind: "managed-field",
     identity: artifactLocalIdentity(state.artifactSha256, "managed-field-token", field.token),
     observations: [
@@ -191,24 +214,32 @@ const fieldNode = (state, field, coverage) => createJavaScriptApplicationNode({
                 signature_sha256: field.signature.raw_sha256,
                 signature_status: field.signature.parse_status,
             },
-            evidence: managedEvidence(state, "inspect_managed_members", coverage),
+            evidence,
         },
     ],
 });
 /** Add P/Invoke import and native implementation boundary nodes. */
 export const addBoundaryNodes = (state, artifactNode, parsed) => {
-    const boundaries = parsed.boundaries?.result;
-    if (boundaries === undefined)
-        return { pinvoke_imports: 0, native_implementations: 0 };
+    const boundaryInput = parsed.boundaries;
+    if (boundaryInput === null)
+        return;
+    const boundaries = boundaryInput.result;
     const { pinvoke_imports: pinvokes, native_implementations: implementations } = boundaries;
     const pinvokeCoverage = managedSourceCoverage(boundaries.coverage.state);
     const implementationCoverage = managedSourceCoverage(boundaries.coverage.state);
+    const sourceEvidence = sourceManagedEvidence(state, boundaryInput.evidence, boundaries.coverage.state);
+    const canJoinMemberTokens = parsed.members !== null &&
+        managedTokenScopesMatch(parsed.members.result.identity_scope.requires_mvid, boundaries.identity_scope.requires_mvid);
     for (const pinvoke of pinvokes) {
-        const node = pinvokeNode(state, pinvoke, pinvokeCoverage);
+        const node = pinvokeNode(state, pinvoke, sourceEvidence);
         state.nodes.push(node);
-        const owner = pinvoke.member_token === null
-            ? artifactNode
-            : (state.methodNodes.get(pinvoke.member_token) ?? artifactNode);
+        const method = pinvoke.member_token === null || !canJoinMemberTokens
+            ? undefined
+            : state.methodNodes.get(pinvoke.member_token);
+        const memberEvidence = method === undefined || parsed.members === null
+            ? undefined
+            : parsed.members.evidence;
+        const owner = method ?? artifactNode;
         state.edges.push(createJavaScriptApplicationEdge({
             source_node_id: owner.node_id,
             target_node_id: node.node_id,
@@ -218,25 +249,23 @@ export const addBoundaryNodes = (state, artifactNode, parsed) => {
                 import_name: pinvoke.import_name,
                 import_scope_name: pinvoke.import_scope_name,
             },
-            evidence: managedEvidence(state, "inspect_managed_native_boundaries", pinvokeCoverage),
+            evidence: pinvokeAssociationEvidence(state, boundaryInput.evidence, pinvokeCoverage, memberEvidence),
         }));
     }
     for (const implementation of implementations) {
-        const node = nativeImplementationNode(state, implementation, implementationCoverage);
+        const node = nativeImplementationNode(state, implementation, sourceEvidence);
         state.nodes.push(node);
-        const owner = state.methodNodes.get(implementation.token) ?? artifactNode;
+        const owner = (canJoinMemberTokens
+            ? state.methodNodes.get(implementation.token)
+            : undefined) ?? artifactNode;
         addContainsEdge(state, owner, node, {
             kind: "declares-managed-native-implementation",
             coverage: implementationCoverage,
         });
     }
-    return {
-        pinvoke_imports: pinvokes.length,
-        native_implementations: implementations.length,
-    };
 };
 /** Build a managed P/Invoke import application node. */
-const pinvokeNode = (state, pinvoke, coverage) => createJavaScriptApplicationNode({
+const pinvokeNode = (state, pinvoke, evidence) => createJavaScriptApplicationNode({
     kind: "managed-pinvoke-import",
     identity: artifactLocalIdentity(state.artifactSha256, "managed-pinvoke-token", pinvoke.token),
     observations: [
@@ -252,12 +281,12 @@ const pinvokeNode = (state, pinvoke, coverage) => createJavaScriptApplicationNod
                 call_convention: pinvoke.call_convention,
                 verification: pinvoke.verification,
             },
-            evidence: managedEvidence(state, "inspect_managed_native_boundaries", coverage),
+            evidence,
         },
     ],
 });
 /** Build a managed native implementation application node. */
-const nativeImplementationNode = (state, implementation, coverage) => createJavaScriptApplicationNode({
+const nativeImplementationNode = (state, implementation, evidence) => createJavaScriptApplicationNode({
     kind: "managed-native-implementation",
     identity: artifactLocalIdentity(state.artifactSha256, "managed-native-implementation-token", implementation.token),
     observations: [
@@ -273,7 +302,7 @@ const nativeImplementationNode = (state, implementation, coverage) => createJava
                 boundary_kind: implementation.boundary_kind,
                 body_interpretation: implementation.body_interpretation,
             },
-            evidence: managedEvidence(state, "inspect_managed_native_boundaries", coverage),
+            evidence,
         },
     ],
 });
@@ -284,7 +313,7 @@ const addContainsEdge = (state, source, target, options) => {
         target_node_id: target.node_id,
         relation: "contains",
         properties: { kind: options.kind },
-        evidence: managedEvidence(state, "project-managed-contains", options.coverage),
+        evidence: projectedManagedEvidence(state, "project-managed-contains", options.coverage),
     }));
 };
 /** Build an artifact-local key identity for a managed graph entity. */
@@ -296,7 +325,13 @@ const artifactLocalIdentity = (artifactSha256, namespace, key) => ({
     key,
 });
 /** Build managed static-analysis evidence for a graph observation. */
-const managedEvidence = (state, operation, coverage = managedSourceCoverage("complete")) => ({
+const sourceManagedEvidence = (state, source, coverageState) => createManagedEvidence(state, source.operation, managedSourceCoverage(coverageState), [source.evidence_id]);
+const projectedManagedEvidence = (state, operation, coverage = managedSourceCoverage("complete")) => createManagedEvidence(state, operation, coverage, state.evidenceLinks);
+const pinvokeAssociationEvidence = (state, boundaryEvidence, coverage, memberEvidence) => createManagedEvidence(state, boundaryEvidence.operation, coverage, [
+    boundaryEvidence.evidence_id,
+    ...(memberEvidence === undefined ? [] : [memberEvidence.evidence_id]),
+]);
+const createManagedEvidence = (state, operation, coverage, evidenceIds) => ({
     authority: "managed-static-analysis",
     state: "observed",
     confidence: "exact",
@@ -324,7 +359,7 @@ const managedEvidence = (state, operation, coverage = managedSourceCoverage("com
         : [
             "The source managed Evidence slice is incomplete; unreturned or unavailable items remain unobserved.",
         ],
-    evidence_ids: state.evidenceLinks,
+    evidence_ids: [...evidenceIds],
 });
 /** Sanitize an artifact path into a managed graph location. */
 const graphArtifactPath = (path) => {

package/dist/domain/managed/managedArtifact.js

@@ -256,6 +256,7 @@ const managedFieldAccessSchema = z.object({
 });
 const managedParseIssueSchema = z.object({
     code: z.enum([
+        "resource-limit",
         "invalid-cli-header",
         "invalid-directory",
         "invalid-metadata-root",