rea-agents 6.3.0 → 6.4.0

package/dist/domain/javascript/javascriptAstFingerprint.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import * as t from "@babel/types";
 import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
 import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
-import { propertyName } from "./javascriptAstValues.js";
+import { propertyName, semanticStaticPropertyKey, } from "./javascriptAstValues.js";
 import { stringValue } from "./javascriptStaticAnalysisHelpers.js";
 /** Derive a rename-resistant syntax fingerprint without code execution. */
 export const fingerprintJavaScriptAst = (node) => {
@@ -59,40 +59,71 @@ const semanticTokens = (node) => {
 };
 const collectAssignmentExports = (left, right, output) => {
     const path = memberPath(left);
-    if (path === "exports" || path === "module.exports") {
+    if (path === null)
+        return;
+    // Rebinding the CommonJS alias does not replace module.exports.
+    if (path.length === 1 && path[0] === "exports")
+        return;
+    const exportOffset = path[0] === "exports"
+        ? 1
+        : path[0] === "module" && path[1] === "exports"
+            ? 2
+            : null;
+    if (exportOffset === null)
+        return;
+    if (path.length === exportOffset) {
         if (t.isObjectExpression(right))
             collectObjectKeys(right, output);
         else
             addExport(output, "default");
         return;
     }
-    if (path.startsWith("exports."))
-        addExport(output, path.slice("exports.".length));
-    if (path.startsWith("module.exports."))
-        addExport(output, path.slice("module.exports.".length));
+    // A CommonJS export assignment exposes the first property below the
+    // exports object. Deeper writes mutate that exported value, rather than
+    // creating an export whose name is the dotted member path.
+    addExport(output, path[exportOffset]);
 };
 const collectCallExports = (call, output) => {
     const callee = memberPath(call.callee);
-    if (callee === "Object.defineProperty") {
-        const target = memberPath(call.arguments[0]);
+    if (callee === null)
+        return;
+    const definePropertyCall = callee.length === 2 &&
+        callee[0] === "Object" &&
+        callee[1] === "defineProperty";
+    const declarationCall = callee.length >= 2 && callee.at(-1) === "d";
+    if (!definePropertyCall && !declarationCall)
+        return;
+    const target = memberPath(call.arguments[0]);
+    const exportTarget = target !== null &&
+        ((target.length === 1 && target[0] === "exports") ||
+            (target.length === 2 &&
+                target[0] === "module" &&
+                target[1] === "exports"));
+    if (!exportTarget)
+        return;
+    if (definePropertyCall) {
         const name = stringValue(call.arguments[1]);
-        if ((target === "exports" || target === "module.exports") && name)
+        if (name !== undefined)
             addExport(output, name);
-    }
-    if (!callee.endsWith(".d"))
         return;
-    const target = memberPath(call.arguments[0]);
+    }
     const declarations = call.arguments[1];
-    if ((target === "exports" || target === "module.exports") &&
-        t.isObjectExpression(declarations))
+    if (t.isObjectExpression(declarations))
         collectObjectKeys(declarations, output);
 };
 const collectObjectKeys = (object, output) => {
     for (const property of object.properties) {
         if (!t.isObjectProperty(property) && !t.isObjectMethod(property))
             continue;
-        const name = propertyName(property.key);
-        if (name !== "")
+        const name = semanticStaticPropertyKey(property.key, property.computed);
+        // In an object literal, a non-computed `__proto__: value` sets the
+        // prototype instead of creating an own property. Shorthand, computed,
+        // and method forms do create own properties.
+        if (name !== null &&
+            !(t.isObjectProperty(property) &&
+                !property.computed &&
+                !property.shorthand &&
+                name === "__proto__"))
             addExport(output, name);
     }
 };
@@ -105,22 +136,18 @@ const memberPath = (node) => {
     while (current !== undefined &&
         current !== null &&
         (t.isMemberExpression(current) || t.isOptionalMemberExpression(current))) {
-        properties.push(propertyName(current.property));
-        current = t.isNode(current.object) ? current.object : undefined;
+        const property = semanticStaticPropertyKey(current.property, current.computed);
+        if (property === null)
+            return null;
+        properties.push(property);
+        current = current.object;
     }
-    const root = current !== undefined && t.isIdentifier(current)
+    if (current === undefined || current === null)
+        return null;
+    const root = t.isIdentifier(current)
         ? current.name
-        : current !== undefined && t.isThisExpression(current)
+        : t.isThisExpression(current)
             ? "this"
-            : "";
-    if (properties.length === 0)
-        return root;
-    properties.reverse();
-    const path = root === "" ? [] : [root];
-    for (const property of properties) {
-        if (path.length === 0 && property === "")
-            continue;
-        path.push(property);
-    }
-    return path.join(".");
+            : null;
+    return root === null ? null : [root, ...properties.reverse()];
 };

package/dist/domain/javascript/javascriptAstValues.js

@@ -57,6 +57,38 @@ export const semanticStaticPropertyKey = (property, computed) => {
         return String(property.value);
     return !computed && t.isIdentifier(property) ? property.name : null;
 };
+/** Read exact consumed object-pattern keys, leaving dynamic keys unknown. */
+export const semanticObjectPatternKeys = (pattern) => pattern.properties.flatMap((property) => {
+    if (t.isRestElement(property))
+        return [];
+    const key = semanticStaticPropertyKey(property.key, property.computed);
+    return key === null ? [] : [key];
+});
+/** Visit member write targets in direct and destructuring assignment forms. */
+export function* semanticMemberWriteTargets(root) {
+    const pending = [root];
+    while (pending.length > 0) {
+        const next = pending.pop();
+        if (next === undefined)
+            break;
+        const node = unwrapJavaScriptExpression(next).node;
+        if (t.isMemberExpression(node) || t.isOptionalMemberExpression(node))
+            yield node;
+        else if (t.isRestElement(node))
+            pending.push(node.argument);
+        else if (t.isAssignmentPattern(node))
+            pending.push(node.left);
+        else if (t.isArrayPattern(node)) {
+            for (const element of node.elements.toReversed())
+                if (element !== null)
+                    pending.push(element);
+        }
+        else if (t.isObjectPattern(node)) {
+            for (const property of node.properties.toReversed())
+                pending.push(t.isRestElement(property) ? property.argument : property.value);
+        }
+    }
+}
 /**
  * Display an exact JavaScript string as nonempty label text. Graph labels and
  * artifact-local keys are nonempty, so the legal empty value is shown as `""`;

package/dist/domain/javascript/javascriptElectronMemberWrites.js

@@ -0,0 +1,50 @@
+import * as t from "@babel/types";
+import { semanticStaticPropertyKey, semanticMemberWriteTargets, unwrapJavaScriptExpression, } from "./javascriptAstValues.js";
+import { SemanticPropertyPathCoverage } from "./javascriptSemanticPropertyPaths.js";
+import { traverseJavaScriptAstSteps } from "./javascriptSemanticTraversal.js";
+/** Match Electron's supported module entry points. */
+export const ELECTRON_MODULE = /^electron(?:\/(?:common|main|renderer|utility))?$/u;
+/**
+ * Electron's CommonJS exports define no `default` member, so a leading
+ * `default` segment can only denote the module object itself, as an ES module
+ * default import (`import electron from "electron"`) binds it.
+ */
+export const electronExportPath = (importedPath) => importedPath[0] === "default" ? importedPath.slice(1) : importedPath;
+/** Static identity recovery cannot establish the absence of Electron usage. */
+export const ELECTRON_IDENTITY_LIMITATION = "Electron API identity follows proven lexical module aliases. Reassigned bindings, dynamic selections, and visibly overwritten namespace members are unresolved; missing findings do not establish absence. Arbitrary call side effects and runtime registration are not evaluated.";
+/** Preserve exact property segments instead of flattening literal dotted keys. */
+export const electronMemberPath = (node) => {
+    let root = unwrapJavaScriptExpression(node).node;
+    const members = [];
+    while (t.isMemberExpression(root) || t.isOptionalMemberExpression(root)) {
+        members.push(semanticStaticPropertyKey(root.property, root.computed));
+        root = unwrapJavaScriptExpression(root.object).node;
+    }
+    return { root, members: members.toReversed() };
+};
+/** Index visible writes through proven Electron aliases, without executing them. */
+export function* collectElectronMemberWritesSteps(program, origin) {
+    const writes = new SemanticPropertyPathCoverage();
+    yield* traverseJavaScriptAstSteps(program, {
+        enter: (node) => {
+            const target = t.isAssignmentExpression(node)
+                ? node.left
+                : t.isUpdateExpression(node)
+                    ? node.argument
+                    : t.isUnaryExpression(node, { operator: "delete" })
+                        ? node.argument
+                        : t.isForOfStatement(node) || t.isForInStatement(node)
+                            ? node.left
+                            : undefined;
+            if (target === undefined)
+                return;
+            for (const member of semanticMemberWriteTargets(target)) {
+                const { root, members } = electronMemberPath(member);
+                const exported = origin(root);
+                if (exported !== undefined)
+                    writes.retain([...exported, ...members]);
+            }
+        },
+    });
+    return writes;
+}

package/dist/domain/javascript/javascriptModuleSemanticIr.js

@@ -0,0 +1,15 @@
+/** Retain facts consumed by source-module and export-return composition. */
+export const projectJavaScriptModuleSemantics = (ir) => {
+    const scopes = ir.scopes.filter(({ kind }) => kind === "program");
+    const programScopeId = scopes[0]?.scopeId;
+    const localNames = new Set(ir.moduleLinks.map(({ localName }) => localName));
+    const callableIds = new Set(ir.moduleLinks.map(({ callableId }) => callableId));
+    return {
+        scopes,
+        bindings: ir.bindings.filter(({ name, scopeId }) => scopeId === programScopeId && localNames.has(name)),
+        callables: ir.callables.filter(({ callableId }) => callableIds.has(callableId)),
+        moduleLinks: ir.moduleLinks,
+        coverage: ir.coverage,
+        limitations: ir.limitations,
+    };
+};

package/dist/domain/javascript/javascriptNativeHandoff.js

@@ -69,7 +69,12 @@ const nativeExportNodes = (addon, edges, nodeById) => {
 };
 const requestedExports = (nodes) => {
     const values = nodes.flatMap((node) => node.observations.flatMap((observation) => [
-        ...(observation.label === null ? [] : [observation.label]),
+        // Display labels can summarize several names or namespace access.
+        // Only legacy observations without structured member facts need them.
+        ...(observation.label === null ||
+            Array.isArray(observation.properties.requested_members)
+            ? []
+            : [observation.label]),
         ...stringArray(observation.properties.requested_members),
         ...stringArray(observation.properties.members),
     ]));

package/dist/domain/javascript/javascriptRpcEndpoints.js

@@ -0,0 +1,253 @@
+import * as t from "@babel/types";
+import { unwrapJavaScriptExpression, semanticStaticPropertyKey, } from "./javascriptAstValues.js";
+import { calleeName } from "./javascriptStaticAnalysisHelpers.js";
+// tRPC proxies preserve router and procedure names as property names, so they
+// survive identifier minification. Method names follow @trpc/react-query and
+// @trpc/tanstack-react-query 11.19 documentation; cache-key helpers such as
+// queryKey are excluded because they never issue a request.
+const TRPC_HOOK_METHODS = new Set([
+    "useQuery",
+    "useSuspenseQuery",
+    "useInfiniteQuery",
+    "useSuspenseInfiniteQuery",
+    "usePrefetchQuery",
+    "usePrefetchInfiniteQuery",
+    "useMutation",
+    "useSubscription",
+    "queryOptions",
+    "infiniteQueryOptions",
+    "mutationOptions",
+    "subscriptionOptions",
+]);
+// @trpc/client 11.19 clientCallTypeMap methods; common outside tRPC (Apollo,
+// database pools, stores), so they need corroborating evidence.
+const TRPC_REQUEST_METHODS = new Set(["query", "mutate"]);
+// @trpc/client 11.19 TRPCSubscriptionObserver callbacks; RxJS observers use
+// next/error/complete instead.
+const TRPC_SUBSCRIPTION_CALLBACKS = new Set([
+    "onStarted",
+    "onData",
+    "onError",
+    "onStopped",
+    "onComplete",
+    "onConnectionStateChange",
+]);
+// @trpc/client 11.19 client factories (createTRPCProxyClient is the
+// deprecated alias of createTRPCClient).
+const TRPC_CLIENT_FACTORIES = new Set([
+    "createTRPCClient",
+    "createTRPCProxyClient",
+]);
+// Built-in HTTP links documented by tRPC 11.19 that carry a `url` option.
+const TRPC_URL_LINKS = new Set([
+    "httpLink",
+    "httpBatchLink",
+    "httpBatchStreamLink",
+    "httpSubscriptionLink",
+]);
+// Literals retained by @trpc/client 11.19 bundles (`this.name`, the default
+// accept header key) or by the conventional transport path.
+const TRPC_SOURCE_MARKERS = ["TRPCClientError", "trpc-accept", "/trpc"];
+// Browser-owned roots whose methods share tRPC names, such as
+// navigator.permissions.query.
+const BROWSER_GLOBAL_NAMES = new Set([
+    "window",
+    "self",
+    "globalThis",
+    "document",
+    "navigator",
+    "location",
+    "history",
+    "console",
+    "performance",
+    "screen",
+    "top",
+    "parent",
+    "frames",
+]);
+const PROCEDURE_SEGMENT = /^[A-Za-z_$][\w$]*$/u;
+/** Read a static member path and the expression it starts from. */
+const memberPath = (callee) => {
+    const reversed = [];
+    let current = callee;
+    while (t.isMemberExpression(current) ||
+        t.isOptionalMemberExpression(current)) {
+        const property = semanticStaticPropertyKey(current.property, current.computed);
+        if (property === null || !PROCEDURE_SEGMENT.test(property))
+            return undefined;
+        reversed.push(property);
+        current = current.object;
+    }
+    return { root: current, properties: reversed.reverse() };
+};
+const objectKeys = (node) => t.isObjectExpression(node)
+    ? node.properties.flatMap((property) => {
+        if (!t.isObjectProperty(property) && !t.isObjectMethod(property))
+            return [];
+        const key = semanticStaticPropertyKey(property.key, property.computed);
+        return key === null ? [] : [key];
+    })
+    : [];
+const objectStringProperty = (node, key) => {
+    for (const property of node.properties)
+        if (t.isObjectProperty(property) &&
+            semanticStaticPropertyKey(property.key, property.computed) === key &&
+            t.isStringLiteral(property.value))
+            return property.value.value;
+    return undefined;
+};
+const objectProperty = (node, key) => {
+    for (const property of node.properties)
+        if (t.isObjectProperty(property) &&
+            semanticStaticPropertyKey(property.key, property.computed) === key)
+            return property.value;
+    return undefined;
+};
+const GRAPHQL_OPERATION_TYPES = new Set([
+    "query",
+    "mutation",
+    "subscription",
+]);
+// A named GraphQL operation header (GraphQL October 2021, OperationDefinition):
+// type, name, then variable definitions starting with `$`, a directive, or a
+// selection set starting with a field name.
+const GRAPHQL_OPERATION_HEADER = /^(query|mutation|subscription)[\s,]+([_A-Za-z][_0-9A-Za-z]*)[\s,]*(?:\([\s,]*\$|@[_A-Za-z]|\{[\s,]*[_A-Za-z])/u;
+const isGraphqlIgnoredCharacter = (character) => character === "," || character === "" || /\s/u.test(character);
+/** Recover a named operation from GraphQL document text. */
+export const graphqlOperationFromText = (text) => {
+    // Skip GraphQL ignored tokens: whitespace, commas, BOM and # comments.
+    const limit = text.length;
+    let index = 0;
+    while (index < limit) {
+        const character = text.charAt(index);
+        if (isGraphqlIgnoredCharacter(character))
+            index += 1;
+        else if (character === "#") {
+            while (index < limit && !/[\n\r]/u.test(text.charAt(index)))
+                index += 1;
+        }
+        else
+            break;
+    }
+    if (index >= limit)
+        return undefined;
+    const header = GRAPHQL_OPERATION_HEADER.exec(text.slice(index));
+    const type = header?.[1];
+    const name = header?.[2];
+    return type === undefined || name === undefined
+        ? undefined
+        : { value: name, mechanism: `graphql:${type}` };
+};
+/** Recover a named operation from a precompiled GraphQL document object. */
+export const graphqlOperationFromDocumentNode = (node) => {
+    if (objectStringProperty(node, "kind") !== "OperationDefinition")
+        return undefined;
+    const type = objectStringProperty(node, "operation");
+    if (type === undefined || !GRAPHQL_OPERATION_TYPES.has(type))
+        return undefined;
+    const name = objectProperty(node, "name");
+    if (!t.isObjectExpression(name) ||
+        objectStringProperty(name, "kind") !== "Name")
+        return undefined;
+    const value = objectStringProperty(name, "value");
+    return value === undefined
+        ? undefined
+        : { value, mechanism: `graphql:${type}` };
+};
+/** Bundlers use `(0, imported.factory)` to call an import without a receiver. */
+const rpcFactoryName = (callee) => {
+    let current = unwrapJavaScriptExpression(callee).node;
+    while (t.isSequenceExpression(current)) {
+        const last = current.expressions.at(-1);
+        if (last === undefined)
+            return "";
+        current = unwrapJavaScriptExpression(last).node;
+    }
+    return calleeName(current);
+};
+/** Whether an initializer has the syntax of a documented tRPC client factory. */
+export const isJavaScriptRpcClientFactory = (node) => {
+    const call = unwrapJavaScriptExpression(node).node;
+    return ((t.isCallExpression(call) || t.isOptionalCallExpression(call)) &&
+        TRPC_CLIENT_FACTORIES.has(rpcFactoryName(call.callee).split(".").pop() ?? ""));
+};
+/** Recover the literal `url` option passed to a documented tRPC HTTP link. */
+const trpcLinkUrl = (node) => {
+    const name = rpcFactoryName(node.callee);
+    const factory = name.slice(name.lastIndexOf(".") + 1);
+    if (!TRPC_URL_LINKS.has(factory))
+        return undefined;
+    const options = node.arguments[0];
+    if (!t.isObjectExpression(options))
+        return undefined;
+    const url = objectStringProperty(options, "url");
+    return url === undefined
+        ? undefined
+        : { value: url, mechanism: `trpc:link:${factory}` };
+};
+/**
+ * Create the per-source scan. Hook and option-factory methods are distinctive.
+ * `query`/`mutate` need a root bound to a tRPC client factory, or a tRPC source
+ * marker with a router path of at least two segments; `subscribe` needs the
+ * marker and a tRPC observer argument. `this` roots, browser globals and RTK
+ * Query `endpoints` chains are never procedures.
+ */
+export const createJavaScriptRpcScan = (source, clientRoots) => {
+    let marker;
+    const hasMarker = () => (marker ??= TRPC_SOURCE_MARKERS.some((value) => source.includes(value)));
+    // graphql-tag documents retain their source text in loc.source.body; that
+    // text repeats the OperationDefinition already recovered from the object.
+    const documentSourceBodies = new WeakSet();
+    const procedure = (node) => {
+        const path = memberPath(node.callee);
+        if (path === undefined || t.isThisExpression(path.root))
+            return undefined;
+        if (t.isIdentifier(path.root) && BROWSER_GLOBAL_NAMES.has(path.root.name))
+            return undefined;
+        const method = path.properties[path.properties.length - 1];
+        const segments = path.properties.slice(0, -1);
+        const first = segments[0];
+        if (method === undefined || first === undefined)
+            return undefined;
+        if (BROWSER_GLOBAL_NAMES.has(first) || segments.includes("endpoints"))
+            return undefined;
+        const bound = clientRoots.has(path.root);
+        const recognized = TRPC_HOOK_METHODS.has(method)
+            ? true
+            : TRPC_REQUEST_METHODS.has(method)
+                ? bound || (segments.length >= 2 && hasMarker())
+                : method === "subscribe" &&
+                    (bound || hasMarker()) &&
+                    objectKeys(node.arguments[1]).some((key) => TRPC_SUBSCRIPTION_CALLBACKS.has(key));
+        return recognized
+            ? { value: segments.join("."), mechanism: `trpc:procedure:${method}` }
+            : undefined;
+    };
+    return {
+        inspect: (node) => {
+            if (t.isCallExpression(node) || t.isOptionalCallExpression(node))
+                return trpcLinkUrl(node) ?? procedure(node);
+            if (t.isObjectExpression(node)) {
+                const body = objectProperty(node, "body");
+                if (t.isStringLiteral(body) &&
+                    objectProperty(node, "locationOffset") !== undefined) {
+                    documentSourceBodies.add(body);
+                    return undefined;
+                }
+                return graphqlOperationFromDocumentNode(node);
+            }
+            if (t.isStringLiteral(node))
+                return documentSourceBodies.has(node)
+                    ? undefined
+                    : graphqlOperationFromText(node.value);
+            if (t.isTemplateLiteral(node)) {
+                // A template recovered without a cooked value stays dynamic.
+                const cooked = node.quasis[0]?.value.cooked;
+                return cooked === undefined || cooked === null
+                    ? undefined
+                    : graphqlOperationFromText(cooked);
+            }
+            return undefined;
+        },
+    };
+};

package/dist/domain/javascript/javascriptRuntimeLoadState.js

@@ -25,7 +25,7 @@ const classifyLayer = (layer, runtimeEntities, matches, options) => {
     const layerComplete = options.reconciliationComplete &&
         layer.graph.coverage.status === "complete" &&
         scopedEntities.length > 0 &&
-        scopedEntities.every(({ capture }) => captureScriptsComplete(capture.evidence.evidence_id, runtimeEntities));
+        scopedEntities.every(({ capture }) => capture.scriptsCompleteWithinScope);
     const states = nodes.map((node) => {
         const runtimeNodeIds = uniqueSorted(direct.get(node.node_id) ?? []);
         if (runtimeNodeIds.length > 0)
@@ -85,8 +85,6 @@ const append = (values, key, value) => {
     else
         current.push(value);
 };
-const captureScriptsComplete = (evidenceId, entities) => entities.find(({ capture }) => capture.evidence.evidence_id === evidenceId)
-    ?.capture.scriptsCompleteWithinScope === true;
 const isLoadStateNode = (node) => node.kind === "javascript-asset" ||
     node.kind === "javascript-chunk" ||
     node.kind === "javascript-module";

package/dist/domain/javascript/javascriptRuntimeReconciliationGraph.js

@@ -131,8 +131,13 @@ const graphCoverage = (input, facts, nodeCount) => facts.inputStatus === "comple
         };
 const mergeNodes = (nodes) => {
     const grouped = new Map();
-    for (const node of nodes)
-        grouped.set(node.node_id, [...(grouped.get(node.node_id) ?? []), node]);
+    for (const node of nodes) {
+        const group = grouped.get(node.node_id);
+        if (group === undefined)
+            grouped.set(node.node_id, [node]);
+        else
+            group.push(node);
+    }
     const merged = [...grouped.values()].map((group) => {
         const first = group[0];
         if (first === undefined)

package/dist/domain/javascript/javascriptRuntimeStaticCandidates.js

@@ -1,4 +1,5 @@
 import { posix, relative, win32 } from "node:path";
+import { logicalPathEscapesRoot, normalizeJoinedLogicalPath, } from "../artifactIdentity.js";
 import { uniqueSorted } from "../canonicalOrdering.js";
 import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 /** Index statically reconstructed entities that can receive runtime matches. */
@@ -108,7 +109,7 @@ const nodePaths = (node) => {
             paths.push(observation.evidence.location.value.path);
     }
     return paths
-        .map(normalizeArtifactPath)
+        .map(relativeLogicalPath)
         .filter((path) => path !== null && path !== "artifact-root");
 };
 const candidateDigests = (node) => {
@@ -142,7 +143,7 @@ const pathBelowRoot = (root, value) => {
         portableRemainder === ".." ||
         portableRemainder.startsWith("../"))
         return null;
-    return normalizeArtifactPath(portableRemainder);
+    return relativeLogicalPath(portableRemainder);
 };
 const absoluteFilePathStyle = (path) => {
     if (/^[a-z]:[\\/]/iu.test(path) ||
@@ -166,7 +167,7 @@ const pathBelowUrlPrefix = (prefix, value) => {
         !candidate.pathname.startsWith(base.pathname))
         return null;
     try {
-        return normalizeArtifactPath(decodeURIComponent(candidate.pathname.slice(base.pathname.length)));
+        return relativeLogicalPath(decodeURIComponent(candidate.pathname.slice(base.pathname.length)));
     }
     catch (cause) {
         // Undecodable path segments are represented by the null return.
@@ -190,16 +191,12 @@ const activeArtifactPrefixes = (layer, entities) => {
     return [...prefixes].sort(compareUnicodeCodePoints);
 };
 const pathWithinPrefix = (path, prefix) => prefix === "" || path === prefix || path.startsWith(`${prefix}/`);
-const safeArtifactPath = (prefix, suffix) => normalizeArtifactPath(prefix === "" ? suffix : posix.join(prefix, suffix));
-const normalizeArtifactPath = (value) => {
-    const normalized = posix
-        .normalize(value.replaceAll("\\", "/"))
-        .replace(/^\.\//u, "");
+const safeArtifactPath = (prefix, suffix) => relativeLogicalPath(prefix === "" ? suffix : posix.join(prefix, suffix));
+const relativeLogicalPath = (value) => {
+    const normalized = normalizeJoinedLogicalPath(value);
     return normalized !== "" &&
         normalized !== "." &&
-        normalized !== ".." &&
-        !normalized.startsWith("/") &&
-        !normalized.startsWith("../")
+        !logicalPathEscapesRoot(normalized)
         ? normalized
         : null;
 };