rea-agents 6.3.0 → 6.4.0

package/dist/domain/referenceSourceGraph.js

@@ -2,6 +2,7 @@ import { posix } from "node:path";
 import { z } from "zod";
 import { canonicalJson } from "./comparisonSemantics.js";
 import { digestCanonicalValue } from "./canonicalDigest.js";
+import { createReferenceSourcePathLookup, isPortableAbsoluteReferenceTarget, } from "./referenceSourcePathIdentity.js";
 import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 import { digestSchema } from "./../domain/digests.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
@@ -67,13 +68,10 @@ const sourceDirectorySchema = z.strictObject({
 const symlinkTargetSchema = z
     .string()
     .min(1)
-    .refine((target) => isPortableAbsoluteSymlinkTarget(target) ||
+    .refine((target) => isPortableAbsoluteReferenceTarget(target) ||
     (!target.startsWith("/") &&
         !target.includes("\\") &&
         posix.normalize(target) === target), "Expected a normalized POSIX symlink target");
-const isPortableAbsoluteSymlinkTarget = (target) => target.startsWith("/") ||
-    /^[A-Za-z]:[\\/]/u.test(target) ||
-    /^\\\\[^\\/]+[\\/][^\\/]+/u.test(target);
 const sourceSymlinkSchema = z.union([
     z.strictObject({
         ...entryBaseShape,
@@ -105,15 +103,22 @@ const parseFailureSchema = z.strictObject({
     parser: z.string().min(1),
     reason: boundedTextSchema,
 });
-const exclusionSchema = z.strictObject({
-    path: relativePathSchema,
-    reason: z.enum([
-        "configured-secret",
-        "symlink-escape",
-        "unreadable",
-        "caller-excluded",
-    ]),
-});
+const exclusionSchema = z.discriminatedUnion("reason", [
+    z.strictObject({
+        path: relativePathSchema,
+        reason: z.enum([
+            "configured-secret",
+            "project-ignored",
+            "default-ignored",
+            "caller-excluded",
+        ]),
+        pattern: boundedTextSchema,
+    }),
+    z.strictObject({
+        path: relativePathSchema,
+        reason: z.enum(["symlink-escape", "unreadable"]),
+    }),
+]);
 const vcsSchema = z
     .discriminatedUnion("kind", [
     z.strictObject({
@@ -229,12 +234,13 @@ const checkRelationships = (graph, paths, context) => {
     }
 };
 const checkSymlinks = (graph, paths, context) => {
+    const lookupPath = createReferenceSourcePathLookup(paths);
     for (const [index, entry] of graph.entries.entries()) {
         if (entry.kind !== "symlink")
             continue;
         if (entry.target === null)
             continue;
-        const absolute = isPortableAbsoluteSymlinkTarget(entry.target);
+        const absolute = isPortableAbsoluteReferenceTarget(entry.target);
         if ((entry.target_state === "external" && !absolute) ||
             (entry.target_state === "internal" && absolute))
             context.addIssue({
@@ -245,7 +251,10 @@ const checkSymlinks = (graph, paths, context) => {
         if (entry.target_state !== "internal")
             continue;
         const resolved = posix.normalize(posix.join(posix.dirname(entry.path), entry.target));
-        if (resolved.startsWith("../") || resolved === ".." || !paths.has(resolved))
+        if (resolved.startsWith("../") ||
+            resolved === ".." ||
+            // The inventory root is implicit rather than an entry with path ".".
+            (resolved !== "." && lookupPath.resolve(resolved) === undefined))
             context.addIssue({
                 code: "custom",
                 message: "Internal symlink target must resolve to an inventoried entry",
@@ -282,7 +291,7 @@ function checkGraphInvariants(graph, context) {
     checkSortedUnique(graph.manifests, "manifests", context);
     checkSortedUnique(graph.relationships.map(relationshipKey), "relationships", context);
     checkSortedUnique(graph.parse_failures.map(historicalSourceParseFailureKey), "parse_failures", context);
-    checkSortedUnique(graph.exclusions.map(({ path, reason }) => `${path}\u0000${reason}`), "exclusions", context);
+    checkSortedUnique(graph.exclusions.map((exclusion) => `${exclusion.path}\u0000${exclusion.reason}\u0000${"pattern" in exclusion ? exclusion.pattern : ""}`), "exclusions", context);
     if (canonicalJson(graph.languages, "Reference source graph") !==
         canonicalJson(historicalSourceLanguages(graph.entries), "Reference source graph"))
         context.addIssue({

package/dist/domain/referenceSourceImportParsing.js

@@ -1,6 +1,7 @@
 import { parse } from "@babel/parser";
 import { traverseJavaScriptAst } from "./javascript/javascriptSemanticTraversal.js";
 import { parserPluginsForPath } from "./javascript/javascriptSourceParser.js";
+import { unshadowedReferenceSourceRequireCalls } from "./referenceSourceRequireBindings.js";
 import { isCallExpression, isExportAllDeclaration, isExportNamedDeclaration, isIdentifier, isImport, isImportDeclaration, isImportExpression, isMemberExpression, isStringLiteral, isTSExternalModuleReference, isTSImportEqualsDeclaration, isTSModuleDeclaration, } from "@babel/types";
 const codeSourceLanguages = new Set(["JavaScript", "TypeScript", "JSX", "TSX"]);
 const safeModuleName = (node) => {
@@ -114,7 +115,7 @@ const isRequireCallee = (callee) => {
     }
     return false;
 };
-const extractRequireAndDynamicImports = (body, from_path, relationships) => {
+const extractRequireAndDynamicImports = (body, from_path, relationships, unshadowedRequireCalls) => {
     // Single traversal owner: iterative, VISITOR_KEYS-gated, no recursion over
     // loc/comment objects. Survives deeply nested generated member chains that
     // overflowed the previous hand-rolled Object.values walker.
@@ -139,7 +140,9 @@ const extractRequireAndDynamicImports = (body, from_path, relationships) => {
             continue;
         }
         const first = call.arguments[0];
-        if (isRequireCallee(call.callee) && isModuleExpression(first)) {
+        if (isRequireCallee(call.callee) &&
+            unshadowedRequireCalls.has(call) &&
+            isModuleExpression(first)) {
             const result = moduleSpecifierFromExpression(first);
             if (result !== undefined) {
                 appendRelationship(relationships, {
@@ -222,7 +225,7 @@ export const parseReferenceSourceImports = (path, bytes, language) => {
     }
     const relationships = [];
     extractImportDeclarations(ast.program.body, path, relationships);
-    extractRequireAndDynamicImports(ast.program.body, path, relationships);
+    extractRequireAndDynamicImports(ast.program.body, path, relationships, unshadowedReferenceSourceRequireCalls(ast, path));
     return {
         relationships: relationships.map((relationship) => ({
             ...relationship,

package/dist/domain/referenceSourcePathIdentity.js

@@ -0,0 +1,22 @@
+/**
+ * Reference inventories retain filesystem spelling. Prefer that exact identity;
+ * canonical Unicode equivalence is a fallback only when it identifies one entry.
+ */
+export const createReferenceSourcePathLookup = (paths) => {
+    const exact = new Set(paths);
+    const canonical = new Map();
+    for (const path of exact) {
+        const key = path.normalize("NFC");
+        canonical.set(key, canonical.has(key) ? null : path);
+    }
+    const equivalent = (path) => canonical.get(path.normalize("NFC")) ?? undefined;
+    return {
+        resolve: (path) => (exact.has(path) ? path : equivalent(path)),
+        resolveCandidates: (candidates) => candidates.find((path) => exact.has(path)) ??
+            candidates.map(equivalent).find((path) => path !== undefined),
+    };
+};
+/** Symlink evidence can originate on a different OS from the graph reader. */
+export const isPortableAbsoluteReferenceTarget = (target) => target.startsWith("/") ||
+    /^[A-Za-z]:[\\/]/u.test(target) ||
+    /^\\\\[^\\/]+[\\/][^\\/]+/u.test(target);

package/dist/domain/referenceSourceRequireBindings.js

@@ -0,0 +1,137 @@
+import * as t from "@babel/types";
+import { analyzeParsedJavaScriptReferences } from "./javascript/javascriptSemanticAnalysis.js";
+import { semanticBindingId, semanticScopeId, } from "./javascript/javascriptSemanticState.js";
+import { traverseJavaScriptAst } from "./javascript/javascriptSemanticTraversal.js";
+/**
+ * Keep calls that resolve either to Node's CommonJS wrapper loader or to a
+ * direct ESM `createRequire(import.meta.url)` binding. The shared lexical
+ * analyzer supplies binding ownership; this boundary accounts for the two
+ * Node loader bindings without evaluating arbitrary values.
+ */
+export const unshadowedReferenceSourceRequireCalls = (file, path) => {
+    const references = new Map(analyzeParsedJavaScriptReferences(file).map((reference) => [
+        `${reference.location.start.line}:${reference.location.start.column}`,
+        reference,
+    ]));
+    const programRequireBinding = semanticBindingId(semanticScopeId("program", file.program), "require");
+    const allowsUnboundRequire = !isExplicitModuleSource(path);
+    const hasTopLevelVarRequire = allowsUnboundRequire && hasUninitializedTopLevelVarRequire(file.program);
+    const createRequireBinding = directCreateRequireBinding(file.program, references);
+    const requireLoaderWasWritten = [...references.values()].some((reference) => reference.name === "require" &&
+        reference.role === "write" &&
+        (reference.resolution === "unbound" ||
+            reference.bindingId === programRequireBinding));
+    const calls = new Set();
+    traverseJavaScriptAst(file.program, {
+        enter: (node, _parent, readAncestors) => {
+            if (!t.isCallExpression(node))
+                return;
+            const identifier = requireCalleeIdentifier(node.callee);
+            const start = identifier?.loc?.start;
+            if (start === undefined)
+                return;
+            if (readAncestors().some((ancestor) => t.isWithStatement(ancestor) && contains(ancestor.body, node)))
+                return;
+            const reference = references.get(`${start.line}:${start.column}`);
+            if ((allowsUnboundRequire &&
+                !requireLoaderWasWritten &&
+                reference?.resolution === "unbound") ||
+                (((hasTopLevelVarRequire && !requireLoaderWasWritten) ||
+                    createRequireBinding) &&
+                    reference?.resolution === "resolved" &&
+                    reference.bindingId === programRequireBinding))
+                calls.add(node);
+        },
+    });
+    return calls;
+};
+const contains = (container, node) => typeof container.start === "number" &&
+    typeof container.end === "number" &&
+    typeof node.start === "number" &&
+    typeof node.end === "number" &&
+    container.start <= node.start &&
+    node.end <= container.end;
+const isExplicitModuleSource = (path) => {
+    const lower = path.toLowerCase();
+    if (lower.endsWith(".mjs") || lower.endsWith(".mts"))
+        return true;
+    if (lower.endsWith(".cjs") || lower.endsWith(".cts"))
+        return false;
+    // Syntax alone cannot establish Node's runtime mode: `.js` depends on its
+    // package scope, and `.ts` may be compiled with a CommonJS module target.
+    // Keep unmarked paths runtime-unknown and preserve candidate require edges.
+    return false;
+};
+const hasUninitializedTopLevelVarRequire = (program) => {
+    let found = false;
+    let initialized = false;
+    traverseJavaScriptAst(program, {
+        enter: (node, _parent, readAncestors) => {
+            if (!t.isVariableDeclaration(node, { kind: "var" }))
+                return;
+            if (readAncestors().some((ancestor) => t.isFunction(ancestor) || t.isStaticBlock(ancestor)))
+                return;
+            for (const declaration of node.declarations) {
+                if (!Object.hasOwn(t.getBindingIdentifiers(declaration.id), "require"))
+                    continue;
+                found = true;
+                initialized ||= declaration.init !== null;
+            }
+        },
+    });
+    return found && !initialized;
+};
+const directCreateRequireBinding = (program, references) => {
+    const programScope = semanticScopeId("program", program);
+    const importedNames = new Set();
+    for (const declaration of program.body) {
+        if (!t.isImportDeclaration(declaration) ||
+            (declaration.source.value !== "node:module" &&
+                declaration.source.value !== "module"))
+            continue;
+        for (const specifier of declaration.specifiers) {
+            if (t.isImportSpecifier(specifier) &&
+                t.isIdentifier(specifier.imported, { name: "createRequire" }))
+                importedNames.add(specifier.local.name);
+        }
+    }
+    return program.body.some((statement) => t.isVariableDeclaration(statement, { kind: "const" }) &&
+        statement.declarations.some((declaration) => {
+            if (!t.isIdentifier(declaration.id, { name: "require" }) ||
+                !t.isCallExpression(declaration.init) ||
+                !t.isIdentifier(declaration.init.callee) ||
+                !importedNames.has(declaration.init.callee.name) ||
+                !isImportMetaUrl(declaration.init.arguments[0]))
+                return false;
+            const start = declaration.init.callee.loc?.start;
+            if (start === undefined)
+                return false;
+            const reference = references.get(`${start.line}:${start.column}`);
+            return (reference?.resolution === "resolved" &&
+                reference.bindingId ===
+                    semanticBindingId(programScope, declaration.init.callee.name));
+        }));
+};
+const isImportMetaUrl = (node) => t.isMemberExpression(node) &&
+    !node.computed &&
+    t.isIdentifier(node.property, { name: "url" }) &&
+    t.isMetaProperty(node.object) &&
+    t.isIdentifier(node.object.meta, { name: "import" }) &&
+    t.isIdentifier(node.object.property, { name: "meta" });
+const requireCalleeIdentifier = (callee) => {
+    if (t.isIdentifier(callee, { name: "require" }))
+        return callee;
+    if (!t.isMemberExpression(callee) ||
+        !t.isIdentifier(callee.object, { name: "require" }) ||
+        ((!t.isIdentifier(callee.property) || callee.computed) &&
+            !t.isStringLiteral(callee.property)))
+        return undefined;
+    const propertyName = t.isIdentifier(callee.property)
+        ? callee.property.name
+        : t.isStringLiteral(callee.property)
+            ? callee.property.value
+            : undefined;
+    return propertyName === "resolve" || propertyName === "main"
+        ? callee.object
+        : undefined;
+};

package/dist/domain/webBundleAnalyzerInspection.js

@@ -2,11 +2,12 @@ import { parse } from "@babel/parser";
 import * as t from "@babel/types";
 import { sanitizeEndpointCandidate } from "./browserObservation.js";
 import { compositeKey } from "./unicodeCodePointOrder.js";
-import { traverseJavaScriptAst } from "./javascript/javascriptSemanticTraversal.js";
-import { classifyParsedJavaScriptOpenReceivers } from "./javascript/javascriptSemanticAnalysis.js";
+import { completeSemanticSteps, traverseJavaScriptAst, } from "./javascript/javascriptSemanticTraversal.js";
+import { classifyParsedJavaScriptOpenReceivers, classifyParsedJavaScriptRpcClientRootsSteps, } from "./javascript/javascriptSemanticAnalysis.js";
 import { semanticStaticPropertyName } from "./javascript/javascriptAstValues.js";
 import { calleeName, endpointArgument, stringValue, } from "./javascript/javascriptStaticAnalysisHelpers.js";
 import { location, locationFields, objectString, objectValue, resolveSpecifier, isUrlLikeModuleSpecifier, } from "./webBundleAnalyzerAst.js";
+import { createJavaScriptRpcScan } from "./javascript/javascriptRpcEndpoints.js";
 export const analyzeScript = (script, accumulator) => {
     let file;
     try {
@@ -25,10 +26,21 @@ export const analyzeScript = (script, accumulator) => {
     accumulator.parsedScripts += 1;
     detectVendorFingerprints(script, accumulator);
     const openReceiverFacts = classifyParsedJavaScriptOpenReceivers(file);
+    const rpc = createJavaScriptRpcScan(script.source.artifact.text, completeSemanticSteps(classifyParsedJavaScriptRpcClientRootsSteps(file)));
     traverseJavaScriptAst(file, {
         enter: (node) => {
             accumulator.visitedNodes += 1;
             inspectNode(script, node, accumulator, openReceiverFacts);
+            const endpoint = rpc.inspect(node);
+            if (endpoint !== undefined)
+                addFinding({
+                    collection: accumulator.endpoints,
+                    script,
+                    rawValue: endpoint.value,
+                    mechanism: endpoint.mechanism,
+                    node,
+                    accumulator,
+                });
         },
     });
 };

package/dist/domain/webCaptureDiff.js

@@ -24,7 +24,7 @@ export const compareWebCaptures = (input) => {
         dimensions,
         limitations: [
             "A changed status proves an observed difference; an unknown status means absence could not be established from capture completeness.",
-            "Network comparison covers only activity observed after each CDP attachment.",
+            "Network comparison covers only activity observed after each CDP attachment. WebSocket connections with the same URL are compared as an unordered collection of ordered frame streams, retaining connection counts; their individual identities are not stable across captures.",
             "Accessibility roles, ignored state, text, and hierarchy are compared only when the accessibility tree was fully captured and text capture was selected and not truncated.",
             "Storage key inventories are compared only when selected and complete; usage and quota are compared only when reported. Redacted content is compared through complete SHA-256 fingerprints.",
         ],
@@ -106,9 +106,11 @@ const keyed = (values, identity) => new Map(values.map((value) => [identity(valu
 const bodyShapesSelected = (inspection) => !inspection.completeness.excluded.some(({ section, reason }) => section === "json_body_shapes" && reason === "not_approved") &&
     (inspection.network.requests.length === 0 ||
         inspection.network.requests.some(({ body_shapes }) => body_shapes.status !== "not_approved"));
+const webSocketShapesSelected = (inspection) => !inspection.completeness.excluded.some(({ section, reason }) => section === "websocket_shapes" && reason === "not_approved");
 const networkIdentity = (request) => `net_${digestCanonicalValue({ method: request.method, url: request.url, resource_type: request.resource_type })}`;
 const networkDimension = (before, after) => {
     const selected = bodyShapesSelected(before) && bodyShapesSelected(after);
+    const webSocketShapes = webSocketShapesSelected(before) && webSocketShapesSelected(after);
     const sources = new Map();
     if (selected) {
         const observedSources = (inspection) => {
@@ -137,9 +139,29 @@ const networkDimension = (before, after) => {
     const shapesComplete = !selected ||
         [before, after].every((inspection) => sectionsComplete(inspection, ["json_body_shapes"]) &&
             inspection.network.requests.every(({ body_shapes }) => body_shapes.status === "included"));
-    return compareDimension(networkMap(before, sources), networkMap(after, sources), sectionsComplete(before, ["network_requests"]) &&
-        sectionsComplete(after, ["network_requests"]) &&
-        shapesComplete, "Network capture or selected JSON body-shape coverage is attach-window limited, unavailable, or incomplete.");
+    const webSocketShapesComplete = !webSocketShapes ||
+        [before, after].every((inspection) => sectionsComplete(inspection, ["websocket_shapes"]) &&
+            inspection.network.websocket_connections.every((connection) => connection.events.every((event) => event.payload_shape !== null)));
+    const webSocketPayloadBytesComplete = [before, after].every((inspection) => inspection.network.websocket_connections.every((connection) => connection.events.every((event) => event.payload_bytes !== null)));
+    const beforeWebSockets = webSocketGroups(before);
+    const afterWebSockets = webSocketGroups(after);
+    const [beforeWebSocketPayload, afterWebSocketPayload] = webSocketPayloadMaps(beforeWebSockets, afterWebSockets, webSocketShapes);
+    return compareDimension(new Map([
+        ...networkMap(before, sources),
+        ...webSocketMetadataMap(beforeWebSockets),
+        ...beforeWebSocketPayload,
+    ]), new Map([
+        ...networkMap(after, sources),
+        ...webSocketMetadataMap(afterWebSockets),
+        ...afterWebSocketPayload,
+    ]), [before, after].every((inspection) => sectionsComplete(inspection, [
+        "network_requests",
+        "websocket_connections",
+        "websocket_frames",
+    ])) &&
+        shapesComplete &&
+        webSocketPayloadBytesComplete &&
+        webSocketShapesComplete, "Network capture or selected HTTP/WebSocket payload-shape coverage is attach-window limited, unavailable, or incomplete.");
 };
 const networkMap = (inspection, sources) => {
     const grouped = new Map();
@@ -167,6 +189,82 @@ const networkMap = (inspection, sources) => {
         digestCanonicalValue(values.map((value) => digestCanonicalValue(value)).sort()),
     ]));
 };
+const webSocketGroups = (inspection) => {
+    const groups = new Map();
+    for (const connection of inspection.network.websocket_connections) {
+        const stream = digestCanonicalValue(connection.events.map(({ direction, opcode }) => ({
+            direction,
+            opcode,
+        })));
+        const key = digestCanonicalValue({ url: connection.url, stream });
+        const previous = groups.get(key);
+        if (previous !== undefined)
+            previous.connections.push(connection);
+        else
+            groups.set(key, {
+                url: connection.url,
+                stream,
+                connections: [connection],
+            });
+    }
+    return groups;
+};
+const webSocketMetadataMap = (groups) => {
+    const byUrl = new Map();
+    for (const group of groups.values()) {
+        const streams = byUrl.get(group.url) ?? [];
+        for (let index = 0; index < group.connections.length; index += 1)
+            streams.push(group.stream);
+        byUrl.set(group.url, streams);
+    }
+    return new Map([...byUrl].map(([url, streams]) => [
+        `ws_${digestCanonicalValue(url)}`,
+        digestCanonicalValue(streams.sort(compareUnicodeCodePoints)),
+    ]));
+};
+const webSocketPayloadMaps = (beforeGroups, afterGroups, selected) => {
+    const left = new Map();
+    const right = new Map();
+    for (const [groupKey, beforeGroup] of beforeGroups) {
+        const afterGroup = afterGroups.get(groupKey);
+        if (afterGroup === undefined ||
+            beforeGroup.connections.length !== afterGroup.connections.length)
+            continue;
+        const eventCount = beforeGroup.connections[0]?.events.length ?? 0;
+        const comparableBytes = new Set();
+        const comparableShapes = new Set();
+        for (let index = 0; index < eventCount; index += 1) {
+            if (beforeGroup.connections.every((connection) => connection.events[index]?.payload_bytes !== null) &&
+                afterGroup.connections.every((connection) => connection.events[index]?.payload_bytes !== null))
+                comparableBytes.add(index);
+            // Compare only when every same-metadata connection has shape evidence
+            // on both sides; this avoids assigning an unknown shape to a known one.
+            if (selected &&
+                beforeGroup.connections.every((connection) => connection.events[index]?.payload_shape !== null) &&
+                afterGroup.connections.every((connection) => connection.events[index]?.payload_shape !== null))
+                comparableShapes.add(index);
+        }
+        if (comparableBytes.size === 0 && comparableShapes.size === 0)
+            continue;
+        const project = (group) => digestCanonicalValue(group.connections
+            .map((connection) => connection.events.map((event, index) => {
+            const comparablePayload = {};
+            if (comparableBytes.has(index))
+                comparablePayload.payload_bytes = event.payload_bytes;
+            if (comparableShapes.has(index))
+                comparablePayload.payload_shape = event.payload_shape;
+            return Object.keys(comparablePayload).length === 0
+                ? null
+                : comparablePayload;
+        }))
+            .map((stream) => digestCanonicalValue(stream))
+            .sort(compareUnicodeCodePoints));
+        const identity = `wss_${groupKey}`;
+        left.set(identity, project(beforeGroup));
+        right.set(identity, project(afterGroup));
+    }
+    return [left, right];
+};
 const webMcpMap = (discovery) => discovery === null
     ? new Map()
     : keyed(discovery.tools.items, (tool) => tool.tool_key);

package/dist/domain/webScriptExportError.js

@@ -4,10 +4,16 @@ export class WebScriptExportError extends ArtifactOperationError {
     userMessage;
     cleanupIncomplete;
     cleanupResources;
-    constructor(reason, target, diagnostic, residualPaths = []) {
-        super("export_web_scripts", reason);
+    constructor(reason, target, diagnostic, options = {}) {
+        super("export_web_scripts", reason, undefined, undefined, options);
         this.userMessage = `Script export failed for ${target}: ${diagnostic}`;
-        this.cleanupResources = residualPaths;
-        this.cleanupIncomplete = residualPaths.length > 0;
+        this.cleanupResources = [
+            ...new Set([
+                ...(options.cleanup?.resources ?? []),
+                ...(options.residualPaths ?? []),
+            ]),
+        ];
+        this.cleanupIncomplete =
+            options.cleanup !== undefined || (options.residualPaths?.length ?? 0) > 0;
     }
 }

package/dist/domain/webScriptExportPlan.js

@@ -18,7 +18,7 @@ export const planWebScriptExport = (scripts) => {
             };
         const candidate = candidates[index];
         const reason = conflicts.has(index)
-            ? "Captured paths collide by content version, case, or file/directory prefix."
+            ? "Captured paths collide by content version or file/directory prefix."
             : (candidate?.reason ?? null);
         const path = reason === null ? candidate?.path : undefined;
         return {
@@ -74,8 +74,9 @@ const candidatePath = (script) => {
             : null,
     };
 };
-// Register every prefix so case collisions in parent directories and a file
-// conflicting with a directory isolate all affected sources, not just the last.
+// Register every exact prefix so a repeated path, or a file that is also a
+// directory prefix, isolates every affected source. Case-distinct spellings
+// stay distinct until the destination filesystem reports a collision.
 const conflictingPaths = (candidates) => {
     const prefixes = new Map();
     candidates.forEach(({ path }, index) => {
@@ -84,23 +85,16 @@ const conflictingPaths = (candidates) => {
         const parts = path.split("/");
         parts.forEach((_, position) => {
             const spelling = parts.slice(0, position + 1).join("/");
-            const key = spelling.toLowerCase();
-            const entry = prefixes.get(key) ?? {
-                spellings: new Set(),
-                indices: [],
-                files: [],
-            };
-            entry.spellings.add(spelling);
+            const entry = prefixes.get(spelling) ?? { indices: [], files: [] };
             entry.indices.push(index);
             if (position === parts.length - 1)
                 entry.files.push(index);
-            prefixes.set(key, entry);
+            prefixes.set(spelling, entry);
         });
     });
     const conflicts = new Set();
     for (const entry of prefixes.values())
-        if (entry.spellings.size > 1 ||
-            entry.files.length > 1 ||
+        if (entry.files.length > 1 ||
             (entry.files.length > 0 && entry.indices.length > entry.files.length))
             for (const index of entry.indices)
                 conflicts.add(index);

package/dist/domain/zipPackageFormat.js

@@ -17,7 +17,8 @@ export const zipPackageFormatForPath = (path) => {
         return "zip";
     if (lower.endsWith(".ipa"))
         return "ipa";
-    if (lower.endsWith(".apk") || lower.endsWith(".aab"))
+    // An Android App Bundle is a ZIP archive, not a standalone APK.
+    if (lower.endsWith(".apk"))
         return "apk";
     if (lower.endsWith(".msix") || lower.endsWith(".msixbundle"))
         return "msix";
@@ -25,3 +26,5 @@ export const zipPackageFormatForPath = (path) => {
         return "appx";
     return undefined;
 };
+/** Inventory cannot see bytes that are not central-directory entries. */
+export const ZIP_NON_ENTRY_TAIL_LIMITATION = "ZIP inventory lists central-directory entries only. Bytes after the central directory, including an APK Signing Block or a ZIP comment, are not occurrences.";

package/dist/domain/zodCollectionSteps.js

@@ -0,0 +1,24 @@
+import { z } from "zod";
+/**
+ * An array schema's own constraints, such as a minimum length, without its
+ * element schema. Pair it with {@link parseElementSteps} to validate a large
+ * collection in cooperative steps.
+ */
+export const arrayContainerSchema = (array) => array.clone({ ...array.def, element: z.unknown() });
+/** Elements validated between yields, in the issues and paths a whole-array parse reports. */
+export function* parseElementSteps(element, values, path, issues) {
+    const parsed = [];
+    for (const [index, value] of values.entries()) {
+        if (index % 64 === 0)
+            yield;
+        const result = element.safeParse(value);
+        if (result.success)
+            parsed.push(result.data);
+        else
+            issues.push(...result.error.issues.map((issue) => ({
+                ...issue,
+                path: [...path, index, ...issue.path],
+            })));
+    }
+    return parsed;
+}