rea-agents 6.2.0 → 6.4.0

package/dist/domain/webCaptureDiff.js

@@ -1,4 +1,5 @@
-import { canonicalDigest } from "./comparisonSemantics.js";
+import { digestCanonicalValue } from "./canonicalDigest.js";
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 import { webCaptureDiffSchema, } from "./webCaptureDiffSchemas.js";
 /** Compare normalized observations without treating incomplete absence as proof. */
 export const compareWebCaptures = (input) => {
@@ -23,7 +24,7 @@ export const compareWebCaptures = (input) => {
         dimensions,
         limitations: [
             "A changed status proves an observed difference; an unknown status means absence could not be established from capture completeness.",
-            "Network comparison covers only activity observed after each CDP attachment.",
+            "Network comparison covers only activity observed after each CDP attachment. WebSocket connections with the same URL are compared as an unordered collection of ordered frame streams, retaining connection counts; their individual identities are not stable across captures.",
             "Accessibility roles, ignored state, text, and hierarchy are compared only when the accessibility tree was fully captured and text capture was selected and not truncated.",
             "Storage key inventories are compared only when selected and complete; usage and quota are compared only when reported. Redacted content is compared through complete SHA-256 fingerprints.",
         ],
@@ -41,8 +42,8 @@ const compareIdentities = (before, after) => {
     for (const identity of after.keys())
         if (!before.has(identity))
             changes.push({ identity, change: "added" });
-    return changes.sort((left, right) => left.identity.localeCompare(right.identity) ||
-        left.change.localeCompare(right.change));
+    return changes.sort((left, right) => compareUnicodeCodePoints(left.identity, right.identity) ||
+        compareUnicodeCodePoints(left.change, right.change));
 };
 const compareDimension = (before, after, complete, reason) => {
     const all = compareIdentities(before, after).filter(({ change }) => complete || change === "modified");
@@ -72,7 +73,7 @@ const accessibilityDimension = (before, after) => {
     const afterAccess = accessibilityComparable(after);
     const textComparable = beforeAccess.text && afterAccess.text;
     const nodesComparable = beforeAccess.nodes && afterAccess.nodes;
-    return compareDimension(singleton("accessibility_tree", digest(accessibilityProjection(before.accessibility, textComparable, nodesComparable))), singleton("accessibility_tree", digest(accessibilityProjection(after.accessibility, textComparable, nodesComparable))), beforeAccess.complete && afterAccess.complete, "Accessibility tree or text capture was incomplete in at least one observation.");
+    return compareDimension(singleton("accessibility_tree", digestCanonicalValue(accessibilityProjection(before.accessibility, textComparable, nodesComparable))), singleton("accessibility_tree", digestCanonicalValue(accessibilityProjection(after.accessibility, textComparable, nodesComparable))), beforeAccess.complete && afterAccess.complete, "Accessibility tree or text capture was incomplete in at least one observation.");
 };
 const storageDimension = (before, after) => {
     const keysComplete = storageKeysComparable(before) && storageKeysComparable(after);
@@ -86,32 +87,87 @@ const storageDimension = (before, after) => {
 const compareWebCaptureDimensions = (input) => {
     const before = input.before.inspection;
     const after = input.after.inspection;
-    const dimension = compareDimension;
     return {
-        dom_structure: dimension(singleton("document", digest(domProjection(before))), singleton("document", digest(domProjection(after))), sectionsComplete(before, ["frames", "dom"]) &&
+        dom_structure: compareDimension(singleton("document", digestCanonicalValue(domProjection(before))), singleton("document", digestCanonicalValue(domProjection(after))), sectionsComplete(before, ["frames", "dom"]) &&
             sectionsComplete(after, ["frames", "dom"]), "DOM or frame capture was incomplete in at least one observation."),
-        scripts: dimension(keyed(before.scripts.items.map(scriptProjection), (item) => item.script_key), keyed(after.scripts.items.map(scriptProjection), (item) => item.script_key), sectionsComplete(before, ["scripts"]) &&
+        scripts: compareDimension(keyed(before.scripts.items.map(scriptProjection), (item) => item.script_key), keyed(after.scripts.items.map(scriptProjection), (item) => item.script_key), sectionsComplete(before, ["scripts"]) &&
             sectionsComplete(after, ["scripts"]), "Script inventory was incomplete in at least one observation."),
-        resources: dimension(keyed(before.resources, (item) => item.resource_key), keyed(after.resources, (item) => item.resource_key), sectionsComplete(before, ["resources"]) &&
+        resources: compareDimension(keyed(before.resources, (item) => item.resource_key), keyed(after.resources, (item) => item.resource_key), sectionsComplete(before, ["resources"]) &&
             sectionsComplete(after, ["resources"]), "Resource inventory was incomplete in at least one observation."),
-        network: dimension(networkMap(before), networkMap(after), sectionsComplete(before, ["network_requests"]) &&
-            sectionsComplete(after, ["network_requests"]), "Network capture is attach-window limited or incomplete."),
-        metadata: dimension(singleton("metadata", digest(metadataProjection(before))), singleton("metadata", digest(metadataProjection(after))), sectionsComplete(before, ["metadata"]) &&
+        network: networkDimension(before, after),
+        metadata: compareDimension(singleton("metadata", digestCanonicalValue(metadataProjection(before))), singleton("metadata", digestCanonicalValue(metadataProjection(after))), sectionsComplete(before, ["metadata"]) &&
             sectionsComplete(after, ["metadata"]), "Safe metadata capture was incomplete in at least one observation."),
-        webmcp: dimension(webMcpMap(input.before.webmcp), webMcpMap(input.after.webmcp), webMcpComplete(input.before.webmcp) && webMcpComplete(input.after.webmcp), "WebMCP discovery was unavailable or incomplete in at least one capture."),
+        webmcp: compareDimension(webMcpMap(input.before.webmcp), webMcpMap(input.after.webmcp), webMcpComplete(input.before.webmcp) && webMcpComplete(input.after.webmcp), "WebMCP discovery was unavailable or incomplete in at least one capture."),
         accessibility: accessibilityDimension(before, after),
         storage: storageDimension(before, after),
     };
 };
-const keyed = (values, identity) => new Map(values.map((value) => [identity(value), digest(value)]));
-const networkMap = (inspection) => {
+const keyed = (values, identity) => new Map(values.map((value) => [identity(value), digestCanonicalValue(value)]));
+const bodyShapesSelected = (inspection) => !inspection.completeness.excluded.some(({ section, reason }) => section === "json_body_shapes" && reason === "not_approved") &&
+    (inspection.network.requests.length === 0 ||
+        inspection.network.requests.some(({ body_shapes }) => body_shapes.status !== "not_approved"));
+const webSocketShapesSelected = (inspection) => !inspection.completeness.excluded.some(({ section, reason }) => section === "websocket_shapes" && reason === "not_approved");
+const networkIdentity = (request) => `net_${digestCanonicalValue({ method: request.method, url: request.url, resource_type: request.resource_type })}`;
+const networkDimension = (before, after) => {
+    const selected = bodyShapesSelected(before) && bodyShapesSelected(after);
+    const webSocketShapes = webSocketShapesSelected(before) && webSocketShapesSelected(after);
+    const sources = new Map();
+    if (selected) {
+        const observedSources = (inspection) => {
+            const result = new Map();
+            for (const request of inspection.network.requests) {
+                const identity = networkIdentity(request);
+                const previous = result.get(identity);
+                result.set(identity, {
+                    request: previous?.request !== false && request.body_shapes.request !== null,
+                    response: previous?.response !== false &&
+                        request.body_shapes.response !== null,
+                });
+            }
+            return result;
+        };
+        const left = observedSources(before);
+        const right = observedSources(after);
+        for (const [identity, coverage] of left) {
+            const next = right.get(identity);
+            sources.set(identity, {
+                request: coverage.request && next?.request === true,
+                response: coverage.response && next?.response === true,
+            });
+        }
+    }
+    const shapesComplete = !selected ||
+        [before, after].every((inspection) => sectionsComplete(inspection, ["json_body_shapes"]) &&
+            inspection.network.requests.every(({ body_shapes }) => body_shapes.status === "included"));
+    const webSocketShapesComplete = !webSocketShapes ||
+        [before, after].every((inspection) => sectionsComplete(inspection, ["websocket_shapes"]) &&
+            inspection.network.websocket_connections.every((connection) => connection.events.every((event) => event.payload_shape !== null)));
+    const webSocketPayloadBytesComplete = [before, after].every((inspection) => inspection.network.websocket_connections.every((connection) => connection.events.every((event) => event.payload_bytes !== null)));
+    const beforeWebSockets = webSocketGroups(before);
+    const afterWebSockets = webSocketGroups(after);
+    const [beforeWebSocketPayload, afterWebSocketPayload] = webSocketPayloadMaps(beforeWebSockets, afterWebSockets, webSocketShapes);
+    return compareDimension(new Map([
+        ...networkMap(before, sources),
+        ...webSocketMetadataMap(beforeWebSockets),
+        ...beforeWebSocketPayload,
+    ]), new Map([
+        ...networkMap(after, sources),
+        ...webSocketMetadataMap(afterWebSockets),
+        ...afterWebSocketPayload,
+    ]), [before, after].every((inspection) => sectionsComplete(inspection, [
+        "network_requests",
+        "websocket_connections",
+        "websocket_frames",
+    ])) &&
+        shapesComplete &&
+        webSocketPayloadBytesComplete &&
+        webSocketShapesComplete, "Network capture or selected HTTP/WebSocket payload-shape coverage is attach-window limited, unavailable, or incomplete.");
+};
+const networkMap = (inspection, sources) => {
     const grouped = new Map();
     for (const request of inspection.network.requests) {
-        const identity = `net_${digest({
-            method: request.method,
-            url: request.url,
-            resource_type: request.resource_type,
-        })}`;
+        const identity = networkIdentity(request);
+        const shapes = sources.get(identity);
         const values = grouped.get(identity) ?? [];
         values.push({
             status: request.status,
@@ -119,15 +175,96 @@ const networkMap = (inspection) => {
             encoded_data_length: request.encoded_data_length,
             redirects: (request.redirects ?? []).map(({ request_timestamp: _requestTimestamp, redirect_event_timestamp: _redirectEventTimestamp, ...redirect }) => redirect),
             initiator: request.initiator,
-            body_shapes: request.body_shapes,
+            ...(shapes?.request === true
+                ? { request_shape: request.body_shapes.request }
+                : {}),
+            ...(shapes?.response === true
+                ? { response_shape: request.body_shapes.response }
+                : {}),
         });
         grouped.set(identity, values);
     }
     return new Map([...grouped].map(([identity, values]) => [
         identity,
-        digest(values.map((value) => digest(value)).sort()),
+        digestCanonicalValue(values.map((value) => digestCanonicalValue(value)).sort()),
+    ]));
+};
+const webSocketGroups = (inspection) => {
+    const groups = new Map();
+    for (const connection of inspection.network.websocket_connections) {
+        const stream = digestCanonicalValue(connection.events.map(({ direction, opcode }) => ({
+            direction,
+            opcode,
+        })));
+        const key = digestCanonicalValue({ url: connection.url, stream });
+        const previous = groups.get(key);
+        if (previous !== undefined)
+            previous.connections.push(connection);
+        else
+            groups.set(key, {
+                url: connection.url,
+                stream,
+                connections: [connection],
+            });
+    }
+    return groups;
+};
+const webSocketMetadataMap = (groups) => {
+    const byUrl = new Map();
+    for (const group of groups.values()) {
+        const streams = byUrl.get(group.url) ?? [];
+        for (let index = 0; index < group.connections.length; index += 1)
+            streams.push(group.stream);
+        byUrl.set(group.url, streams);
+    }
+    return new Map([...byUrl].map(([url, streams]) => [
+        `ws_${digestCanonicalValue(url)}`,
+        digestCanonicalValue(streams.sort(compareUnicodeCodePoints)),
     ]));
 };
+const webSocketPayloadMaps = (beforeGroups, afterGroups, selected) => {
+    const left = new Map();
+    const right = new Map();
+    for (const [groupKey, beforeGroup] of beforeGroups) {
+        const afterGroup = afterGroups.get(groupKey);
+        if (afterGroup === undefined ||
+            beforeGroup.connections.length !== afterGroup.connections.length)
+            continue;
+        const eventCount = beforeGroup.connections[0]?.events.length ?? 0;
+        const comparableBytes = new Set();
+        const comparableShapes = new Set();
+        for (let index = 0; index < eventCount; index += 1) {
+            if (beforeGroup.connections.every((connection) => connection.events[index]?.payload_bytes !== null) &&
+                afterGroup.connections.every((connection) => connection.events[index]?.payload_bytes !== null))
+                comparableBytes.add(index);
+            // Compare only when every same-metadata connection has shape evidence
+            // on both sides; this avoids assigning an unknown shape to a known one.
+            if (selected &&
+                beforeGroup.connections.every((connection) => connection.events[index]?.payload_shape !== null) &&
+                afterGroup.connections.every((connection) => connection.events[index]?.payload_shape !== null))
+                comparableShapes.add(index);
+        }
+        if (comparableBytes.size === 0 && comparableShapes.size === 0)
+            continue;
+        const project = (group) => digestCanonicalValue(group.connections
+            .map((connection) => connection.events.map((event, index) => {
+            const comparablePayload = {};
+            if (comparableBytes.has(index))
+                comparablePayload.payload_bytes = event.payload_bytes;
+            if (comparableShapes.has(index))
+                comparablePayload.payload_shape = event.payload_shape;
+            return Object.keys(comparablePayload).length === 0
+                ? null
+                : comparablePayload;
+        }))
+            .map((stream) => digestCanonicalValue(stream))
+            .sort(compareUnicodeCodePoints));
+        const identity = `wss_${groupKey}`;
+        left.set(identity, project(beforeGroup));
+        right.set(identity, project(afterGroup));
+    }
+    return [left, right];
+};
 const webMcpMap = (discovery) => discovery === null
     ? new Map()
     : keyed(discovery.tools.items, (tool) => tool.tool_key);
@@ -147,7 +284,9 @@ const incompleteSections = (completeness) => new Set([
 const domProjection = (inspection) => ({
     frames: inspection.frames
         .map(({ url, origin }) => ({ url, origin }))
-        .sort((left, right) => left.url.localeCompare(right.url)),
+        .sort((left, right) => compareUnicodeCodePoints(left.url, right.url) ||
+        compareUnicodeCodePoints(left.origin ?? "", right.origin ?? "") ||
+        Number(left.origin !== null) - Number(right.origin !== null)),
     nodes: inspection.dom.nodes.map(({ index: _index, ...node }) => node),
 });
 const scriptProjection = (script) => ({
@@ -162,17 +301,18 @@ const scriptProjection = (script) => ({
 const metadataProjection = (inspection) => ({
     responses: inspection.metadata.responses
         .map(({ request_id: _requestId, ...response }) => response)
-        .map((value) => digest(value))
+        .map((value) => digestCanonicalValue(value))
+        .sort(),
+    dom_urls: inspection.metadata.dom_urls
+        .map((value) => digestCanonicalValue(value))
         .sort(),
-    dom_urls: inspection.metadata.dom_urls.map((value) => digest(value)).sort(),
     agent_hints: inspection.metadata.agent_hints
-        .map((value) => digest(value))
+        .map((value) => digestCanonicalValue(value))
         .sort(),
     excluded_dom_urls: inspection.metadata.excluded_dom_urls,
     headers_allowlisted: inspection.metadata.headers_allowlisted,
 });
 const singleton = (key, value) => new Map([[key, value]]);
-const digest = (value) => canonicalDigest(value);
 const accessibilityComparable = (inspection) => {
     const text = inspection.accessibility.text_capture.status === "included" &&
         inspection.accessibility.text_capture.excluded_fields === 0;
@@ -209,7 +349,7 @@ const storageMap = (storage, includeKeys, includeUsage, fingerprintIdentities) =
     const map = new Map([
         [
             "storage:summary",
-            digest({
+            digestCanonicalValue({
                 origin: storage.origin,
                 values_redacted: storage.values_redacted,
                 ...(includeUsage
@@ -225,7 +365,7 @@ const storageMap = (storage, includeKeys, includeUsage, fingerprintIdentities) =
         return map;
     const add = (kind, keys) => {
         for (const key of keys) {
-            map.set(`storage:${kind}:${key}`, digest(key));
+            map.set(`storage:${kind}:${key}`, digestCanonicalValue(key));
         }
     };
     add("local_storage", storage.local_storage_keys);
@@ -236,7 +376,7 @@ const storageMap = (storage, includeKeys, includeUsage, fingerprintIdentities) =
         const identity = `${fingerprint.scope}:${fingerprint.identity_sha256}`;
         if (!fingerprintIdentities.has(identity))
             continue;
-        map.set(`storage:content:${identity}`, digest(fingerprint.value_sha256));
+        map.set(`storage:content:${identity}`, digestCanonicalValue(fingerprint.value_sha256));
     }
     return map;
 };

package/dist/domain/webCaptureDiffSchemas.js

@@ -50,12 +50,6 @@ const dimensionSchema = z.union([
         reason: z.string(),
     }),
 ]);
-const legacyUnknownDimension = {
-    status: "unknown",
-    total_changes: 0,
-    changes: [],
-    reason: "Dimension was not recorded by this version 1 capture diff.",
-};
 /** Completeness-aware changes across stable browser evidence dimensions. */
 export const webCaptureDiffSchema = z
     .object({
@@ -69,8 +63,8 @@ export const webCaptureDiffSchema = z
         network: dimensionSchema,
         metadata: dimensionSchema,
         webmcp: dimensionSchema,
-        accessibility: dimensionSchema.default(legacyUnknownDimension),
-        storage: dimensionSchema.default(legacyUnknownDimension),
+        accessibility: dimensionSchema,
+        storage: dimensionSchema,
     }),
     limitations: z.array(z.string()),
 })

package/dist/domain/webInventory.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 /** Assign deterministic identities to a bounded resource inventory. */
 export const stableWebResources = (resources) => {
     const keyed = resources.map((resource) => ({
@@ -8,8 +9,8 @@ export const stableWebResources = (resources) => {
     }));
     return [
         ...new Map(keyed.map((resource) => [resource.resource_key, resource])).values(),
-    ].sort((left, right) => left.resource_key.localeCompare(right.resource_key) ||
-        left.url.localeCompare(right.url));
+    ].sort((left, right) => compareUnicodeCodePoints(left.resource_key, right.resource_key) ||
+        compareUnicodeCodePoints(left.url, right.url));
 };
 /** Reconcile one script with resource-tree observations without fuzzy matching. */
 export const reconcileWebScript = (script, resources) => {

package/dist/domain/webMcpDiscovery.js

@@ -2,8 +2,8 @@ import { z } from "zod";
 import { browserCompletenessSchema } from "./browserCompleteness.js";
 import { browserAllowedOriginsSchema, browserEndpointSchema, } from "./browserObservation.js";
 import { browserVersionSchema } from "./browserObservationSchemas.js";
-import { jsonShapeSchema } from "./jsonShape.js";
-import { prefixedDigestSchema } from "./../domain/digests.js";
+import { jsonValueSchema } from "./jsonValue.js";
+import { digestSchema, prefixedDigestSchema } from "./../domain/digests.js";
 /** Input for passive discovery of page-registered WebMCP tools. */
 export const discoverWebMcpToolsInputSchema = z.strictObject({
     cdp_endpoint: browserEndpointSchema,
@@ -19,7 +19,8 @@ const webMcpToolSchema = z.object({
     frame_url: z.string(),
     owner_origin: z.string(),
     declaration_kind: z.enum(["declarative", "imperative"]),
-    input_schema_shape: jsonShapeSchema.nullable(),
+    input_schema: jsonValueSchema.nullable(),
+    input_schema_sha256: digestSchema.nullable(),
     annotations: z.object({
         read_only: z.boolean().nullable(),
         untrusted_content: z.boolean().nullable(),

package/dist/domain/webScriptExport.js

@@ -24,7 +24,7 @@ const sourceSchema = z.discriminatedUnion("kind", [
     }),
     z.strictObject({
         kind: z.literal("scenario-response"),
-        transaction_id: z.string().nullable(),
+        transaction_id: z.string().min(1),
         request_sequence: z.number().int().min(1),
         response_sequence: z.number().int().min(1).nullable(),
         status: z.number().nullable(),

package/dist/domain/webScriptExportError.js

@@ -4,10 +4,16 @@ export class WebScriptExportError extends ArtifactOperationError {
     userMessage;
     cleanupIncomplete;
     cleanupResources;
-    constructor(reason, target, diagnostic, residualPaths = []) {
-        super("export_web_scripts", reason);
+    constructor(reason, target, diagnostic, options = {}) {
+        super("export_web_scripts", reason, undefined, undefined, options);
         this.userMessage = `Script export failed for ${target}: ${diagnostic}`;
-        this.cleanupResources = residualPaths;
-        this.cleanupIncomplete = residualPaths.length > 0;
+        this.cleanupResources = [
+            ...new Set([
+                ...(options.cleanup?.resources ?? []),
+                ...(options.residualPaths ?? []),
+            ]),
+        ];
+        this.cleanupIncomplete =
+            options.cleanup !== undefined || (options.residualPaths?.length ?? 0) > 0;
     }
 }

package/dist/domain/webScriptExportPlan.js

@@ -18,7 +18,7 @@ export const planWebScriptExport = (scripts) => {
             };
         const candidate = candidates[index];
         const reason = conflicts.has(index)
-            ? "Captured paths collide by content version, case, or file/directory prefix."
+            ? "Captured paths collide by content version or file/directory prefix."
             : (candidate?.reason ?? null);
         const path = reason === null ? candidate?.path : undefined;
         return {
@@ -74,8 +74,9 @@ const candidatePath = (script) => {
             : null,
     };
 };
-// Register every prefix so case collisions in parent directories and a file
-// conflicting with a directory isolate all affected sources, not just the last.
+// Register every exact prefix so a repeated path, or a file that is also a
+// directory prefix, isolates every affected source. Case-distinct spellings
+// stay distinct until the destination filesystem reports a collision.
 const conflictingPaths = (candidates) => {
     const prefixes = new Map();
     candidates.forEach(({ path }, index) => {
@@ -84,23 +85,16 @@ const conflictingPaths = (candidates) => {
         const parts = path.split("/");
         parts.forEach((_, position) => {
             const spelling = parts.slice(0, position + 1).join("/");
-            const key = spelling.toLowerCase();
-            const entry = prefixes.get(key) ?? {
-                spellings: new Set(),
-                indices: [],
-                files: [],
-            };
-            entry.spellings.add(spelling);
+            const entry = prefixes.get(spelling) ?? { indices: [], files: [] };
             entry.indices.push(index);
             if (position === parts.length - 1)
                 entry.files.push(index);
-            prefixes.set(key, entry);
+            prefixes.set(spelling, entry);
         });
     });
     const conflicts = new Set();
     for (const entry of prefixes.values())
-        if (entry.spellings.size > 1 ||
-            entry.files.length > 1 ||
+        if (entry.files.length > 1 ||
             (entry.files.length > 0 && entry.indices.length > entry.files.length))
             for (const index of entry.indices)
                 conflicts.add(index);

package/dist/domain/zipPackageFormat.js

@@ -17,7 +17,8 @@ export const zipPackageFormatForPath = (path) => {
         return "zip";
     if (lower.endsWith(".ipa"))
         return "ipa";
-    if (lower.endsWith(".apk") || lower.endsWith(".aab"))
+    // An Android App Bundle is a ZIP archive, not a standalone APK.
+    if (lower.endsWith(".apk"))
         return "apk";
     if (lower.endsWith(".msix") || lower.endsWith(".msixbundle"))
         return "msix";
@@ -25,3 +26,5 @@ export const zipPackageFormatForPath = (path) => {
         return "appx";
     return undefined;
 };
+/** Inventory cannot see bytes that are not central-directory entries. */
+export const ZIP_NON_ENTRY_TAIL_LIMITATION = "ZIP inventory lists central-directory entries only. Bytes after the central directory, including an APK Signing Block or a ZIP comment, are not occurrences.";

package/dist/domain/zodCollectionSteps.js

@@ -0,0 +1,24 @@
+import { z } from "zod";
+/**
+ * An array schema's own constraints, such as a minimum length, without its
+ * element schema. Pair it with {@link parseElementSteps} to validate a large
+ * collection in cooperative steps.
+ */
+export const arrayContainerSchema = (array) => array.clone({ ...array.def, element: z.unknown() });
+/** Elements validated between yields, in the issues and paths a whole-array parse reports. */
+export function* parseElementSteps(element, values, path, issues) {
+    const parsed = [];
+    for (const [index, value] of values.entries()) {
+        if (index % 64 === 0)
+            yield;
+        const result = element.safeParse(value);
+        if (result.success)
+            parsed.push(result.data);
+        else
+            issues.push(...result.error.issues.map((issue) => ({
+                ...issue,
+                path: [...path, index, ...issue.path],
+            })));
+    }
+    return parsed;
+}

package/dist/dotnet/ManagedArtifactInspector.js

@@ -1,3 +1,4 @@
+import { admitManagedProjection, managedDecodeBudget, } from "./ManagedDecodeBudget.js";
 import { managedArtifactInspectionSchema, } from "../domain/managed/managedArtifact.js";
 import { readManagedPeLayout, } from "./ManagedPeReader.js";
 import { managedTableRowCounts, readManagedMetadataInventory, readManagedResourceDirectory, } from "./ManagedMetadataInventory.js";
@@ -73,7 +74,7 @@ const unavailableResult = (target, bytes, layout) => {
         : [
             "The PE has no CLI data directory; managed metadata and CIL are unavailable.",
         ];
-    return managedArtifactInspectionSchema.parse({
+    return managedArtifactInspectionSchema.parse(admitManagedProjection({
         ...base(target, bytes, layout),
         classification: {
             status: malformed ? "malformed" : "not-managed",
@@ -83,7 +84,9 @@ const unavailableResult = (target, bytes, layout) => {
             managed_architecture: "unknown",
             evidence: [
                 {
-                    code: malformed ? "cli-directory-malformed" : "cli-directory-absent",
+                    code: malformed
+                        ? "cli-directory-malformed"
+                        : "cli-directory-absent",
                     detail: limitations[0],
                     file_offset: layout.cliIssue?.offset ?? null,
                 },
@@ -106,7 +109,7 @@ const unavailableResult = (target, bytes, layout) => {
             issues,
         },
         limitations,
-    });
+    }));
 };
 const runtimeFamilyFor = (cli, inventory, metadata, layout) => {
     const evidence = [
@@ -198,7 +201,7 @@ const runtimeClassification = ({ layout, metadata, inventory, }) => {
 const partialMetadataResult = ({ target, bytes, layout, issue, }) => ({
     ...base(target, bytes, layout),
     classification: {
-        status: "malformed",
+        status: issue.code === "resource-limit" ? "managed" : "malformed",
         container: "pe",
         runtime_family: (layout.cli?.flags ?? 1) & 1 ? "unknown" : "mixed-clr-native",
         implementation: "unknown",
@@ -212,7 +215,7 @@ const partialMetadataResult = ({ target, bytes, layout, issue, }) => ({
         ],
     },
     metadata: {
-        status: "malformed",
+        status: issue.code === "resource-limit" ? "partial" : "malformed",
         version: null,
         stream_names: [],
         table_row_counts: {},
@@ -225,7 +228,9 @@ const partialMetadataResult = ({ target, bytes, layout, issue, }) => ({
     attributes: [],
     coverage: { state: "partial", issues: [issue] },
     limitations: [
-        "CLI metadata could not be read because the PE/CLI structure is malformed or unsupported.",
+        issue.code === "resource-limit"
+            ? "CLI metadata inspection stopped at its representation budget; omitted facts are unknown."
+            : "CLI metadata could not be read because the PE/CLI structure is malformed or unsupported.",
     ],
 });
 /** Inspect PE/CLI identity directly from local bytes without CLR loading. */
@@ -242,48 +247,55 @@ export const inspectManagedArtifactBytes = (bytes, target) => {
     catch (cause) {
         if (!(cause instanceof ManagedReaderFailure))
             throw cause;
-        return managedArtifactInspectionSchema.parse(partialMetadataResult({
+        return managedArtifactInspectionSchema.parse(admitManagedProjection(partialMetadataResult({
             target,
             bytes,
             layout,
             issue: cause.issue,
-        }));
+        })));
     }
     const resourceIssues = [];
     const resourceDirectory = readManagedResourceDirectory(layout, resourceIssues);
-    const inventory = readManagedMetadataInventory(bytes, metadata, resourceDirectory);
-    const issues = [...resourceIssues, ...inventory.issues];
-    const limitations = [
-        ...(issues.length === 0
-            ? []
-            : [
-                "At least one metadata or resource item could not be read; coverage is partial.",
-            ]),
-        "Static inspection did not load the assembly, resolve dependencies through a CLR, decompile C#, or execute target code.",
-    ];
-    return managedArtifactInspectionSchema.parse({
-        ...base(target, bytes, layout),
-        classification: {
-            status: "managed",
-            container: "pe",
-            ...runtimeClassification({ layout, metadata, inventory }),
-        },
-        metadata: {
-            status: issues.length === 0 ? "complete" : "partial",
-            version: metadata.version,
-            stream_names: metadata.streamNames,
-            table_row_counts: managedTableRowCounts(metadata),
-        },
-        module: inventory.module,
-        assembly: inventory.assembly,
-        target_frameworks: inventory.targetFrameworks,
-        references: inventory.references,
-        resources: inventory.resources,
-        attributes: inventory.attributes,
-        coverage: {
-            state: issues.length === 0 ? "complete" : "partial",
-            issues,
-        },
-        limitations,
-    });
+    try {
+        const inventory = readManagedMetadataInventory(bytes, metadata, resourceDirectory);
+        const issues = [...resourceIssues, ...inventory.issues];
+        const limitations = [
+            ...(issues.length === 0
+                ? []
+                : [
+                    "At least one metadata or resource item could not be read; coverage is partial.",
+                ]),
+            "Static inspection did not load the assembly, resolve dependencies through a CLR, decompile C#, or execute target code.",
+        ];
+        return managedArtifactInspectionSchema.parse(admitManagedProjection({
+            ...base(target, bytes, layout),
+            classification: {
+                status: "managed",
+                container: "pe",
+                ...runtimeClassification({ layout, metadata, inventory }),
+            },
+            metadata: {
+                status: issues.length === 0 ? "complete" : "partial",
+                version: metadata.version,
+                stream_names: metadata.streamNames,
+                table_row_counts: managedTableRowCounts(metadata),
+            },
+            module: inventory.module,
+            assembly: inventory.assembly,
+            target_frameworks: inventory.targetFrameworks,
+            references: inventory.references,
+            resources: inventory.resources,
+            attributes: inventory.attributes,
+            coverage: {
+                state: issues.length === 0 ? "complete" : "partial",
+                issues,
+            },
+            limitations,
+        }, managedDecodeBudget(metadata)));
+    }
+    catch (cause) {
+        if (!(cause instanceof ManagedReaderFailure))
+            throw cause;
+        return managedArtifactInspectionSchema.parse(admitManagedProjection(partialMetadataResult({ target, bytes, layout, issue: cause.issue })));
+    }
 };