rea-agents 6.3.0 → 6.4.0

package/dist/application/analysisView/AnalysisViewService.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { ANALYSIS_VIEW_PROVIDER } from "../InvestigationProviders.js";
 import { resolveEvidenceInput } from "../EvidenceInputResolver.js";
+import { AnalysisCapabilityUnavailableError } from "../../domain/analysisErrorCore.js";
 import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
 import { EvidenceIntegrityError } from "../../domain/evidenceErrors.js";
 import { createEvidence, parseEvidence, } from "../../domain/evidence.js";
@@ -25,6 +26,12 @@ export const inspectAnalysisViewValidated = (input, lookup) => {
         operation: parent.operation,
         normalizedResult: parent.normalized_result,
         limitations: parent.limitations,
+        artifact: parent.subject === null
+            ? null
+            : {
+                path: parent.subject.local_path,
+                sha256: parent.subject.digest.sha256,
+            },
     }, input.view);
     if (!projected.ok)
         return projected;
@@ -33,6 +40,25 @@ export const inspectAnalysisViewValidated = (input, lookup) => {
         return err(new EvidenceIntegrityError(`Parent subject SHA-256 ${parent.subject.digest.sha256} differs from analysis artifact SHA-256 ${projected.value.artifact.sha256}.`));
     return ok(createAnalysisViewEvidence(input, parent, projected.value));
 };
+/**
+ * Retain complete analysis Evidence in the session, then project its summary
+ * view from the retained record. Callers page or select the rest through
+ * inspect_analysis_view with the view's parent Evidence ID.
+ */
+export const summarizeRetainedAnalysis = (evidence, retention) => {
+    if (retention.recordEvidence === undefined ||
+        retention.evidenceById === undefined)
+        return err(new AnalysisCapabilityUnavailableError(ANALYSIS_VIEW_PROVIDER.id, evidence.operation, "summary detail requires a server session that retains Evidence for later views", {
+            userMessage: "This server does not retain Evidence. Select detail complete to receive the complete analysis inline.",
+        }));
+    const recorded = retention.recordEvidence(evidence);
+    if (!recorded.ok)
+        return recorded;
+    return inspectAnalysisViewValidated({
+        source: { kind: "retained-evidence", evidence_id: evidence.evidence_id },
+        view: { kind: "summary" },
+    }, retention.evidenceById);
+};
 const resolveAnalysisViewSource = (source, lookup) => {
     if (source.kind === "retained-evidence")
         return resolveEvidenceInput(source, lookup);
@@ -41,7 +67,10 @@ const resolveAnalysisViewSource = (source, lookup) => {
     }
     catch (cause) {
         if (cause instanceof z.ZodError)
-            return err(analysisInputErrorFromIssues(INSPECT_ANALYSIS_VIEW_OPERATION, cause.issues, source.evidence, { cause }));
+            return err(analysisInputErrorFromIssues(INSPECT_ANALYSIS_VIEW_OPERATION, cause.issues.map((issue) => ({
+                ...issue,
+                path: ["source", "evidence", ...issue.path],
+            })), { source }, { cause }));
         if (cause instanceof TypeError)
             return err(new EvidenceIntegrityError(cause.message, cause.message.length > 0 ? { userMessage: cause.message } : undefined));
         throw cause;
@@ -70,7 +99,16 @@ const createAnalysisViewEvidence = (input, parent, result) => {
         confidence: "derived",
         authority: parent.authority,
         limitations: result.limitations,
-        locations: [{ kind: "artifact-path", path: result.artifact.path }],
+        locations: [
+            ...(result.artifact.path.length > 0
+                ? [{ kind: "artifact-path", path: result.artifact.path }]
+                : []),
+            ...(result.kind === "native" &&
+                result.procedure_address !== null &&
+                result.procedure_address.length > 0
+                ? [{ kind: "address", address: result.procedure_address }]
+                : []),
+        ],
         evidenceLinks: [parent.evidence_id],
     });
 };

package/dist/application/apktool/ApktoolResourceAnalysisPort.js

@@ -0,0 +1 @@
+export {};

package/dist/application/apktool/ApktoolResourceAnalysisService.js

@@ -0,0 +1,13 @@
+import { apktoolRequestSchema, } from "../../domain/apktool/apktoolResourceAnalysis.js";
+import { executeProviderOperation } from "../ProviderOperationExecution.js";
+/** Shared CLI/MCP admission, execution, and Evidence composition for Apktool. */
+export class ApktoolResourceAnalysisService {
+    provider;
+    constructor(provider) {
+        this.provider = provider;
+    }
+    /** Run one caller-selected Apktool request and retain target identity inline. */
+    async execute(operation, input, options) {
+        return executeProviderOperation(operation, input, options, apktoolRequestSchema, this.provider, "observed");
+    }
+}

package/dist/application/binary/AnalysisClientCleanup.js

@@ -1,6 +1,4 @@
 import { ProviderCleanupError } from "../../domain/providerCleanupError.js";
-import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
-import { projectAnalysisError } from "../../domain/analysisErrorProjection.js";
 import { err } from "../../domain/result.js";
 import { AnalysisError } from "../../domain/analysisErrorBase.js";
 /** Close one provider client and normalize unexpected adapter rejection. */
@@ -15,25 +13,3 @@ export const closeAnalysisClient = async (client, providerId, options = {}) => {
         return err(new ProviderCleanupError(providerId, ["provider-client"], { reason: "provider client close rejected unexpectedly" }, { cause }));
     }
 };
-/** Preserve the original lifecycle failure alongside incomplete cleanup. */
-export const analysisErrorWithCleanupFailure = (primary, cleanup, operation = "close_binary") => {
-    const projected = projectAnalysisError(cleanup);
-    return new ProviderAdapterError(cleanup instanceof ProviderAdapterError ? cleanup.providerId : "rea", operation, {
-        cause: primary,
-        userMessage: projectAnalysisError(primary).message,
-        ...(primary.capturedOutput === undefined
-            ? {}
-            : { capturedOutput: primary.capturedOutput }),
-        ...(primary.partialObservation === undefined
-            ? {}
-            : { partialObservation: primary.partialObservation }),
-        cleanup: {
-            reason: projected.message,
-            resources: cleanup.cleanupResources,
-        },
-        diagnostics: {
-            primary_error: projectAnalysisError(primary),
-            cleanup_error: projected,
-        },
-    });
-};

package/dist/application/binary/BinarySession.js

@@ -13,7 +13,8 @@ import { BinarySessionRecords } from "./BinarySessionRecords.js";
 import { binarySessionStatus } from "./BinarySessionStatus.js";
 import { resolveSessionOpen, resolveSessionTarget, validateResolvedSessionTarget, } from "./BinarySessionOpen.js";
 import { bindExecutionTarget, commitExecutionProfile, prepareSessionExecution, } from "./BinarySessionExecution.js";
-import { analysisErrorWithCleanupFailure, closeAnalysisClient, } from "./AnalysisClientCleanup.js";
+import { closeAnalysisClient } from "./AnalysisClientCleanup.js";
+import { analysisErrorWithCleanupFailure } from "../../domain/analysisErrorCleanup.js";
 const OFFICIAL_OPERATIONS = new Set(OFFICIAL_TOOL_CONTRACTS.map(({ name }) => name));
 const ENHANCED_OPERATIONS = new Set(ENHANCED_TOOL_CONTRACTS.map(({ name }) => name));
 /**

package/dist/application/binaryDiagnostics/BinaryLayoutService.js

@@ -50,7 +50,8 @@ export class BinaryLayoutService {
             operation: OPERATION,
             parameters: input.data,
             result: value,
-            rawResult: value,
+            // The decoded report is the only representation; do not repeat it.
+            rawResult: null,
             confidence: "observed",
             limitations: value.limitations,
             locations: [{ kind: "artifact-path", path: value.artifact.path }],

package/dist/application/binaryDiagnostics/PeResourcesPort.js

@@ -0,0 +1 @@
+export {};

package/dist/application/binaryDiagnostics/PeResourcesService.js

@@ -0,0 +1,111 @@
+import { isAbsolute } from "node:path";
+import { AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, } from "../../domain/analysisErrorCore.js";
+import { createEvidence } from "../../domain/evidence.js";
+import { inspectPeResourcesInputSchema, peResourcesSchema, } from "../../domain/native/peResources.js";
+import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
+import { err, ok } from "../../domain/result.js";
+/** Shared caller validation, output parsing and Evidence provenance for CLI/MCP. */
+export class PeResourcesService {
+    provider;
+    constructor(provider) {
+        this.provider = provider;
+    }
+    async inspect(rawInput, options) {
+        const operation = "inspect_pe_resources";
+        if (options?.signal?.aborted)
+            return err(new AnalysisCancelledError(operation));
+        const input = inspectPeResourcesInputSchema.safeParse(rawInput);
+        if (!input.success)
+            return err(analysisInputErrorFromIssues(operation, input.error.issues, rawInput, {
+                cause: input.error,
+            }));
+        if (!isAbsolute(input.data.path))
+            return err(new AnalysisInputError(operation, undefined, [
+                {
+                    path: ["path"],
+                    reason: "invalid_format",
+                    message: "Expected an absolute filesystem path on this host.",
+                },
+            ]));
+        const result = await this.provider.inspect(input.data, options);
+        if (!result.ok)
+            return result;
+        if (options?.signal?.aborted)
+            return err(new AnalysisCancelledError(operation));
+        const report = peResourcesSchema.safeParse(result.value);
+        if (!report.success ||
+            report.data.artifact.path !== input.data.path ||
+            !validReport(report.data, input.data.max_entries, input.data.max_file_bytes))
+            return err(new AnalysisOutputError(operation, "PE resource provider returned malformed output or changed artifact identity."));
+        const value = report.data;
+        return ok(createEvidence({
+            path: value.artifact.path,
+            format: "pe",
+            sha256: value.artifact.sha256,
+        }, this.provider.identity, {
+            operation,
+            parameters: input.data,
+            result: value,
+            confidence: "observed",
+            limitations: value.limitations,
+            locations: [{ kind: "artifact-path", path: value.artifact.path }],
+        }));
+    }
+}
+/** Check cross-field invariants before provider output becomes public Evidence. */
+const validReport = (report, maxEntries, maxBytes) => {
+    const inside = ({ offset, bytes }) => offset <= report.artifact.bytes - bytes;
+    if (report.artifact.bytes > maxBytes ||
+        report.coverage.resources !== report.resources.length ||
+        report.coverage.examined_entries > maxEntries ||
+        report.coverage.examined_entries !==
+            report.directories.reduce((sum, item) => sum + item.named_entries + item.id_entries, 0))
+        return false;
+    if (report.directory === null &&
+        (report.directories.length > 0 || report.resources.length > 0))
+        return false;
+    if (report.directory !== null &&
+        (!inside(report.directory.location) ||
+            !inside(report.directory.data_directory_location)))
+        return false;
+    if (!report.directories.every((item) => inside(item.location)))
+        return false;
+    if (!report.resources.every((item, index) => item.index === index &&
+        inside(item.data_entry_location) &&
+        inside(item.payload.location) &&
+        item.entry_locations.every(inside) &&
+        [item.type, item.name, item.language].every((identity) => identity.kind === "id" || inside(identity.location))))
+        return false;
+    return report.icon_groups.every((group) => {
+        const resource = report.resources[group.resource_index];
+        if (resource === undefined ||
+            resource.type.kind !== "id" ||
+            resource.type.id !== 14)
+            return false;
+        return group.images.every((image) => inside(image.location) &&
+            image.location.offset >= resource.payload.location.offset &&
+            image.location.offset + image.location.bytes <=
+                resource.payload.location.offset + resource.payload.location.bytes &&
+            image.candidate_resource_indices.every((index) => {
+                const icon = report.resources[index];
+                return (icon !== undefined &&
+                    icon.type.kind === "id" &&
+                    icon.type.id === 3 &&
+                    icon.name.kind === "id" &&
+                    icon.name.id === image.resource_id);
+            }) &&
+            (image.same_language_resource_index === null
+                ? image.size_matches === null
+                : image.candidate_resource_indices.includes(image.same_language_resource_index) &&
+                    sameIdentity(report.resources[image.same_language_resource_index]?.language, resource.language) &&
+                    image.size_matches ===
+                        (report.resources[image.same_language_resource_index]?.payload
+                            .location.bytes ===
+                            image.declared_bytes)));
+    });
+};
+const sameIdentity = (left, right) => left?.kind === "id" && right.kind === "id"
+    ? left.id === right.id
+    : left?.kind === "name" &&
+        right.kind === "name" &&
+        left.utf16le_hex === right.utf16le_hex;

package/dist/application/binaryDiagnostics/RecordedCrashService.js

@@ -53,7 +53,8 @@ export class RecordedCrashService {
             operation: OPERATION,
             parameters: input.data,
             result: value,
-            rawResult: value,
+            // The decoded report is the only representation; do not repeat it.
+            rawResult: null,
             confidence: value.debugger.status === "available" ? "derived" : "observed",
             limitations: value.limitations,
             locations: [{ kind: "artifact-path", path: value.artifact.path }],

package/dist/application/evm/EvmInterfaceService.js

@@ -15,6 +15,9 @@ export class EvmInterfaceService {
     constructor(provider) {
         this.provider = provider;
     }
+    close() {
+        return this.provider.close?.() ?? Promise.resolve();
+    }
     /** Preserve selected byte identity while clearly labeling recovered ABI candidates as inferences. */
     async inspect(rawInput, options) {
         if (options?.signal?.aborted)

package/dist/application/firmware/FirmwareAnalysisService.js

@@ -9,6 +9,9 @@ export class FirmwareAnalysisService {
     constructor(provider) {
         this.provider = provider;
     }
+    close() {
+        return this.provider.close?.() ?? Promise.resolve();
+    }
     /** Execute an explicit inspection or extraction and preserve its producing identity. */
     async execute(operation, input, options) {
         if (options?.signal?.aborted === true)

package/dist/application/investigation/InspectEvidenceBundle.js

@@ -0,0 +1,18 @@
+import { AnalysisInputError } from "../../domain/analysisErrorCore.js";
+import { err, ok } from "../../domain/result.js";
+import { summarizeEvidenceBundle, } from "../../domain/evidenceRecordSummary.js";
+/** Select complete bundle delivery or discovery metadata without analysis payloads. */
+export const inspectEvidenceBundle = (bundle, options) => {
+    if (options.detail === "complete" && options.filters !== undefined)
+        return err(new AnalysisInputError("get_evidence_bundle", undefined, [
+            {
+                path: ["filters"],
+                reason: "invalid_value",
+                message: "Record filters require detail: summary; complete returns the canonical bundle.",
+                expected: "detail: summary",
+            },
+        ]));
+    return ok(options.detail === "summary"
+        ? summarizeEvidenceBundle(bundle, options.filters)
+        : bundle);
+};

package/dist/application/javascript/ElectronBoundaryGraphContext.js

@@ -1,9 +1,10 @@
 import { sha256Text } from "../../domain/javascript/javascriptStaticAnalysisHelpers.js";
+import { sourceNodeFor, } from "./JavaScriptArtifactGraphContext.js";
 import { astObservationEvidence, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
 /** Resolve the file or recovered bundle module that owns one finding. */
-export const electronFindingSourceNode = (context, file, moduleKey) => moduleKey === null
+export const electronFindingSourceNode = (context, file, moduleKey, runtime) => moduleKey === null
     ? (context.assetNodes.get(file.path) ?? context.fileNodes.get(file.path))
-    : context.moduleNodes.get(`${file.path}\0${moduleKey}`);
+    : sourceNodeFor(context, file.path, moduleKey, runtime);
 /** Observation-scoped identity shared safely across different artifact files. */
 export const electronObservationIdentity = (context, scope, key) => ({
     strategy: "observation-fingerprint",

package/dist/application/javascript/ElectronBoundaryGraphIpc.js

@@ -21,7 +21,7 @@ const addIpcRecord = (state, record) => {
     const coverage = coverageFor(context, record.file);
     if (coverage === undefined)
         return;
-    const source = electronFindingSourceNode(context, record.file, record.finding.module_key);
+    const source = electronFindingSourceNode(context, record.file, record.finding.module_key, record.finding.module_runtime);
     if (source === undefined)
         return;
     state.sources.set(record.key, source);
@@ -181,7 +181,7 @@ const addValidationObservations = (state) => {
         for (const validation of javascript.electron.sender_validations) {
             const handlerRecord = containingHandler(state.records, file, validation);
             const target = handlerRecord === undefined
-                ? electronFindingSourceNode(state.context, file, validation.module_key)
+                ? electronFindingSourceNode(state.context, file, validation.module_key, validation.module_runtime)
                 : state.handlers.get(handlerRecord.key);
             if (target !== undefined)
                 addValidationObservation({

package/dist/application/javascript/ElectronBoundaryGraphNative.js

@@ -1,6 +1,7 @@
 import { javascriptAnalysisCoverage, resolveArtifactPath, } from "./JavaScriptArtifactGraphContext.js";
 import { astObservationEvidence } from "./JavaScriptArtifactGraphEvidence.js";
 import { compositeKey } from "../../domain/unicodeCodePointOrder.js";
+import { javascriptDisplayText } from "../../domain/javascript/javascriptAstValues.js";
 import { addElectronInferenceEdge, electronFindingSourceNode, electronObservationIdentity, electronRangeKey, } from "./ElectronBoundaryGraphContext.js";
 /** Project JavaScript-requested native addon binding and re-export surfaces. */
 export const addElectronNativeBoundaries = (context) => {
@@ -15,24 +16,32 @@ export const addElectronNativeBoundaries = (context) => {
 };
 const addNativeBinding = (input) => {
     const { context, file, value, coverage } = input;
-    const source = electronFindingSourceNode(context, file, value.module_key);
+    const source = electronFindingSourceNode(context, file, value.module_key, value.module_runtime);
     if (source === undefined)
         return;
     const resolved = resolveArtifactPath(value.specifier, file.path, context.filesByPath, value.module_kind);
     const addon = resolved === null ? undefined : context.fileNodes.get(resolved);
     const binding = context.accumulator.addNode({
         kind: "native-export",
-        identity: electronObservationIdentity(context, "javascript-requested-native-export", 
-        // Members are a variable-length source-derived list: compositeKey keeps
-        // ["a\0b"] distinct from ["a", "b"] inside the digested identity.
-        `${file.path}:${value.specifier}:${value.binding_kind}:${compositeKey(value.members)}:${electronRangeKey(value.location)}`),
+        identity: electronObservationIdentity(context, "javascript-requested-native-export", compositeKey([
+            file.path,
+            value.specifier,
+            value.binding_kind,
+            value.members,
+            value.namespace_access ?? null,
+            value.dynamic_member_access ?? null,
+            electronRangeKey(value.location),
+        ])),
         observations: [
             {
-                label: value.members.join(", "),
+                label: value.members.map(javascriptDisplayText).join(", ") ||
+                    value.specifier,
                 properties: {
                     specifier: value.specifier,
                     binding_kind: value.binding_kind,
                     requested_members: value.members,
+                    namespace_access: value.namespace_access ?? null,
+                    dynamic_member_access: value.dynamic_member_access ?? null,
                     resolved_path: resolved,
                     native_export_verification: "not-performed",
                 },
@@ -61,6 +70,8 @@ const addNativeBinding = (input) => {
             specifier: value.specifier,
             binding_kind: value.binding_kind,
             requested_members: value.members,
+            namespace_access: value.namespace_access ?? null,
+            dynamic_member_access: value.dynamic_member_access ?? null,
         },
         limitations: [
             "Requested JavaScript members are not verified native exports.",
@@ -79,6 +90,8 @@ const addNativeBinding = (input) => {
         properties: {
             resolved_path: resolved,
             requested_members: value.members,
+            namespace_access: value.namespace_access ?? null,
+            dynamic_member_access: value.dynamic_member_access ?? null,
             verified: false,
         },
         confidence: "medium",

package/dist/application/javascript/ElectronBoundaryGraphWindows.js

@@ -10,17 +10,17 @@ export const addElectronWindowBoundaries = (context) => {
             continue;
         const coverage = javascriptAnalysisCoverage(javascript);
         for (const value of javascript.electron.browser_windows) {
-            const source = electronFindingSourceNode(context, file, value.module_key);
+            const source = electronFindingSourceNode(context, file, value.module_key, value.module_runtime);
             if (source !== undefined)
                 addBrowserWindow({ context, file, source, value, coverage });
         }
         for (const value of javascript.electron.context_bridge_apis) {
-            const source = electronFindingSourceNode(context, file, value.module_key);
+            const source = electronFindingSourceNode(context, file, value.module_key, value.module_runtime);
             if (source !== undefined)
                 addContextBridge({ context, file, source, value, coverage });
         }
         for (const value of javascript.electron.utility_processes) {
-            const source = electronFindingSourceNode(context, file, value.module_key);
+            const source = electronFindingSourceNode(context, file, value.module_key, value.module_runtime);
             if (source !== undefined)
                 addUtilityProcess({ context, file, source, value, coverage });
         }

package/dist/application/javascript/JavaScriptApplicationService.js

@@ -1,9 +1,9 @@
 import { z } from "zod";
 import { ArtifactReaderFailure } from "../../artifacts/ArtifactReader.js";
 import { analyzeJavaScriptApplicationInputSchema, parseOwnedJavaScriptApplicationAnalysisSteps, } from "../../domain/javascript/javascriptApplicationAnalysis.js";
-import { AnalysisAccessDeniedError, AnalysisInputError, AnalysisOutputError, AnalysisUnsupportedTargetError, } from "../../domain/analysisErrorCore.js";
+import { AnalysisOutputError } from "../../domain/analysisErrorCore.js";
 import { ArtifactOperationError } from "../../domain/artifactOperationError.js";
-import {} from "../../domain/analysisErrorBase.js";
+import { AnalysisError } from "../../domain/analysisErrorBase.js";
 import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
 import { err, ok } from "../../domain/result.js";
 import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
@@ -13,14 +13,14 @@ import { reconstructJavaScriptArtifact } from "./JavaScriptArtifactReconstructio
 import { JAVASCRIPT_APPLICATION_PROVIDER } from "../InvestigationProviders.js";
 const OPERATION = "analyze_javascript_application";
 /** Statically analyze one local JavaScript/Electron application. */
-export const analyzeJavaScriptApplication = async (rawInput, options = {}) => {
+export const analyzeJavaScriptApplication = async (rawInput, scope, options = {}) => {
     const parsed = analyzeJavaScriptApplicationInputSchema.safeParse(rawInput);
     if (!parsed.success)
         return err(analysisInputErrorFromIssues(OPERATION, parsed.error.issues, rawInput));
-    return analyzeJavaScriptApplicationValidated(parsed.data, options);
+    return analyzeJavaScriptApplicationValidated(parsed.data, scope, options);
 };
 /** Analyze input already parsed by a trusted adapter boundary. */
-export const analyzeJavaScriptApplicationValidated = async (input, options = {}) => {
+export const analyzeJavaScriptApplicationValidated = async (input, scope, options = {}) => {
     try {
         assertJavaScriptAnalysisActive(options.signal);
         await options.progress?.report({
@@ -34,7 +34,13 @@ export const analyzeJavaScriptApplicationValidated = async (input, options = {})
             input_path: input.input_path,
             format: input.format,
             integrity_policy: input.integrity_policy,
-        }, options.signal, options.progress);
+            ...(input.max_heap_mb === undefined
+                ? {}
+                : { max_heap_mb: input.max_heap_mb }),
+            ...(input.analysis_timeout_ms === undefined
+                ? {}
+                : { analysis_timeout_ms: input.analysis_timeout_ms }),
+        }, scope, options.signal, options.progress);
         const { electron_summary: summary, ...application } = reconstructed;
         await options.progress?.report({
             phase: "validate_javascript_application_result",
@@ -68,13 +74,11 @@ export const analyzeJavaScriptApplicationValidated = async (input, options = {})
         return ok(evidence);
     }
     catch (cause) {
-        // Input selection failures are already typed by their cause.
-        if (cause instanceof AnalysisInputError ||
-            cause instanceof AnalysisUnsupportedTargetError ||
-            cause instanceof AnalysisAccessDeniedError)
+        // Preserve execution constraints and their completed partial Evidence.
+        if (cause instanceof AnalysisError)
             return err(cause);
         if (cause instanceof ArtifactReaderFailure)
-            return err(new ArtifactOperationError(OPERATION, cause.reason, cause.details, cause.message));
+            return err(artifactFailureToOperationError(cause));
         if (cause instanceof z.ZodError)
             return err(new AnalysisOutputError(OPERATION, describeResultSchemaFailure(cause), {
                 cause,
@@ -98,6 +102,13 @@ export const analyzeJavaScriptApplicationValidated = async (input, options = {})
         }));
     }
 };
+const artifactFailureToOperationError = (cause) => new ArtifactOperationError(OPERATION, cause.reason, cause.details, cause.message, {
+    cause,
+    ...(cause.cleanup === undefined ? {} : { cleanup: cause.cleanup }),
+    ...(cause.partialObservation === undefined
+        ? {}
+        : { partialObservation: cause.partialObservation }),
+});
 const describeResultSchemaFailure = (cause) => {
     const issue = cause.issues[0];
     if (issue === undefined)

package/dist/application/javascript/JavaScriptApplicationWorkflowEvidence.js

@@ -1,12 +1,11 @@
 import { createEvidence, } from "../../domain/evidence.js";
-import { jsonValueSchema } from "../../domain/jsonValue.js";
 import { JAVASCRIPT_APPLICATION_WORKFLOW_PROVIDER } from "../InvestigationProviders.js";
 /** Create derived Evidence for one bounded application-graph feature trace. */
 export const createApplicationFeatureTraceEvidence = (parameters, result) => createEvidence(undefined, JAVASCRIPT_APPLICATION_WORKFLOW_PROVIDER, {
     predicateType: "rea.application-feature-trace",
     operation: "trace_application_feature",
     parameters,
-    result: jsonValueSchema.parse(result),
+    result,
     rawResult: null,
     confidence: "inferred",
     authority: "analyst-inference",
@@ -19,7 +18,7 @@ export const createJavaScriptSemanticTraceEvidence = (parameters, result) => cre
     predicateType: "rea.javascript-semantic-trace",
     operation: "trace_javascript_semantics",
     parameters,
-    result: jsonValueSchema.parse(result),
+    result,
     rawResult: null,
     confidence: "inferred",
     authority: "analyst-inference",
@@ -32,7 +31,7 @@ export const createApplicationVersionComparisonEvidence = (parameters, result) =
     predicateType: "rea.application-version-comparison",
     operation: "compare_application_versions",
     parameters,
-    result: jsonValueSchema.parse(result),
+    result,
     rawResult: null,
     confidence: "inferred",
     authority: "analyst-inference",
@@ -45,7 +44,7 @@ export const createSourceToBundleComparisonEvidence = (parameters, result) => cr
     predicateType: "rea.source-to-bundle-comparison",
     operation: "compare_source_to_bundle",
     parameters,
-    result: jsonValueSchema.parse(result),
+    result,
     rawResult: null,
     confidence: "inferred",
     authority: "analyst-inference",
@@ -58,7 +57,7 @@ export const createJavaScriptExportShapeComparisonEvidence = (parameters, result
     predicateType: "rea.javascript-export-shape-comparison",
     operation: "compare_javascript_export_shapes",
     parameters,
-    result: jsonValueSchema.parse(result),
+    result,
     rawResult: null,
     confidence: "inferred",
     authority: "analyst-inference",