rea-agents 6.3.0 → 6.5.0

package/dist/domain/browserSession.js

@@ -1,10 +1,10 @@
 import { z } from "zod";
-import { browserAllowedOriginsSchema, browserEndpointSchema, } from "./browserObservation.js";
+import { browserAllowedOriginsSchema, browserObservationEndpointSchema, } from "./browserObservation.js";
 import { browserCompletenessSchema } from "./browserCompleteness.js";
 import { browserVersionSchema } from "./browserObservationSchemas.js";
 /** Input for a navigation-aware browser observation window. */
 export const observeWebSessionInputSchema = z.strictObject({
-    cdp_endpoint: browserEndpointSchema,
+    cdp_endpoint: browserObservationEndpointSchema,
     allowed_origins: browserAllowedOriginsSchema,
     target_id: z.string().trim().min(1),
     observation_ms: z.number().int().min(1).default(10_000),

package/dist/domain/bundleComparison.js

@@ -71,11 +71,7 @@ export const compareBundles = (leftInput, rightInput, recordPairs = []) => {
     const changes = [...recordResult.changes, ...unknownResult.changes].sort(compareChanges);
     const unresolved = changes.filter(({ conclusion_kind: kind }) => kind !== "observed_change").length;
     return bundleComparisonResultSchema.parse({
-        status: leftDigest === rightDigest && changes.length === 0
-            ? "unchanged"
-            : unresolved > 0
-                ? "unknown"
-                : "changed",
+        status: unresolved > 0 ? "unknown" : changes.length > 0 ? "changed" : "unchanged",
         left_bundle_sha256: leftDigest,
         right_bundle_sha256: rightDigest,
         summary: {

package/dist/domain/callPath.js

@@ -1,5 +1,7 @@
+import { relationshipCoverageLimitations } from "./relationshipCoverage.js";
 import { callPathInputSchema, callPathResultSchema, parseCallPathAddress, } from "./callPathSchemas.js";
 import { parseFunctionEvidence, } from "./functionDossierEvidence.js";
+import { isCallerOnlyIncompleteCoverage } from "./functionCallCoverage.js";
 import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 /** Minimal directed caller-to-callee adjacency for call-path search. */
 class CallGraph {
@@ -163,16 +165,51 @@ const inspectSearch = ({ graph, snapshots, start, goal, }) => {
     const reached = new Map([[start, 0]]);
     const queue = [start];
     const limitations = [];
+    let incompleteExpandedCoverage = false;
     for (let index = 0; index < queue.length; index += 1) {
         const node = queue[index];
         if (node === undefined)
             continue;
         const depth = reached.get(node) ?? 0;
-        if (node === goal)
-            continue;
         const snapshot = snapshots.get(node);
+        if (snapshot !== undefined) {
+            const coverage = snapshot.evidence.relationship_coverage;
+            for (const limitation of snapshot.limitations)
+                limitations.push(limitation);
+            if (coverage !== null) {
+                for (const limitation of relationshipCoverageLimitations(coverage))
+                    limitations.push(limitation);
+                for (const diagnostic of coverage.diagnostics ?? [])
+                    limitations.push(diagnostic);
+            }
+            // The requested goal is a terminal for this search. Its outgoing edges
+            // cannot add a path to the goal, so its dossier limits are contextual
+            // but do not make the searched start-to-goal closure incomplete.
+            if (node === goal)
+                continue;
+            const callees = snapshot.dossier.facet_availability?.callees;
+            if (callees?.available === false) {
+                limitations.push(callees.reason);
+                incompleteExpandedCoverage = true;
+            }
+            // Explicit, Evidence-bound relationship coverage owns completeness;
+            // generic provider/dossier limitations remain contextual. Legacy Evidence
+            // without that metadata retains its conservative limitation-based rule.
+            // The search only expands callee edges, so coverage that is unknown
+            // solely because callers are unobservable does not make the searched
+            // callee closure incomplete; the caller caveat stays in limitations.
+            if (coverage === null
+                ? snapshot.limitations.length > 0
+                : coverage.status !== "complete" &&
+                    !isCallerOnlyIncompleteCoverage(coverage))
+                incompleteExpandedCoverage = true;
+        }
+        else if (node === goal) {
+            continue;
+        }
         if (snapshot === undefined) {
             limitations.push(`No analyze_function Evidence covers reachable function ${node}`);
+            incompleteExpandedCoverage = true;
             continue;
         }
         const neighbors = graph.outNeighbors(node).sort(compareUnicodeCodePoints);
@@ -186,7 +223,7 @@ const inspectSearch = ({ graph, snapshots, start, goal, }) => {
         graph,
         snapshots,
         reached,
-        exhaustive: limitations.length === 0,
+        exhaustive: !incompleteExpandedCoverage,
         limitations,
     };
 };

package/dist/domain/canonicalJsonDigestSteps.js

@@ -4,6 +4,9 @@ export function* canonicalJsonDigestSteps(value) {
     const hash = createHash("sha256");
     const ancestors = new Set();
     const stack = [{ kind: "value", value }];
+    const encodedKeys = new Map();
+    // Keep reusable key encodings within one existing digest-buffer quantum.
+    let remainingKeyCodeUnits = 8192;
     let buffered = "";
     let flushed = false;
     const emit = (part) => {
@@ -46,21 +49,22 @@ export function* canonicalJsonDigestSteps(value) {
                 stack.push(frame);
                 continue;
             }
+            let item;
             if (frame.kind === "array") {
                 if (frame.index === frame.length) {
                     emit("]");
                     ancestors.delete(frame.value);
                     continue;
                 }
-                const item = frame.value[frame.index];
-                if (item === undefined)
+                const element = frame.value[frame.index];
+                if (element === undefined)
                     throw new TypeError("Canonical JSON digest requires dense JSON arrays");
                 if (frame.index++ > 0)
                     emit(",");
-                stack.push(frame, { kind: "value", value: item });
-                continue;
+                stack.push(frame);
+                item = element;
             }
-            if (frame.kind === "object") {
+            else if (frame.kind === "object") {
                 if (frame.index === frame.keys.length) {
                     emit("}");
                     ancestors.delete(frame.value);
@@ -69,22 +73,39 @@ export function* canonicalJsonDigestSteps(value) {
                 const key = frame.keys[frame.index++];
                 if (key === undefined)
                     throw new TypeError("Canonical JSON object changed during hashing");
-                const item = frame.value[key];
-                if (item === undefined)
+                const property = frame.value[key];
+                if (property === undefined) {
+                    stack.push(frame);
                     continue;
+                }
                 if (frame.written++ > 0)
                     emit(",");
                 if (key.length > 8192) {
                     emit('"');
-                    stack.push(frame, { kind: "value", value: item }, { kind: "separator" }, { kind: "string", value: key, index: 0 });
+                    stack.push(frame, { kind: "value", value: property }, { kind: "separator" }, { kind: "string", value: key, index: 0 });
                     continue;
                 }
-                emit(JSON.stringify(key));
+                let encodedKey = encodedKeys.get(key);
+                if (encodedKey === undefined) {
+                    encodedKey = JSON.stringify(key);
+                    if (encodedKey.length <= remainingKeyCodeUnits) {
+                        encodedKeys.set(key, encodedKey);
+                        remainingKeyCodeUnits -= encodedKey.length;
+                    }
+                }
+                emit(encodedKey);
                 emit(":");
-                stack.push(frame, { kind: "value", value: item });
-                continue;
+                stack.push(frame);
+                item = property;
+            }
+            else {
+                item = frame.value;
+            }
+            // Resume containers directly; scalar members need no temporary value frame.
+            if (flushed) {
+                flushed = false;
+                yield;
             }
-            const item = frame.value;
             if (typeof item === "string" && item.length > 8192) {
                 emit('"');
                 stack.push({ kind: "string", value: item, index: 0 });
@@ -128,6 +149,7 @@ export function* canonicalJsonDigestSteps(value) {
     finally {
         stack.length = 0;
         ancestors.clear();
+        encodedKeys.clear();
         buffered = "";
     }
 }

package/dist/domain/captures/packetCapture.js

@@ -0,0 +1,138 @@
+import { z } from "zod";
+import { localPathStringSchema } from "../localPath.js";
+const argument = z
+    .string()
+    .min(1)
+    .max(8192)
+    .refine((value) => !value.includes("\0"), "NUL is not an argument character");
+const captureInputShape = z.strictObject({
+    path: localPathStringSchema.describe("Absolute local capture path"),
+    fields: z
+        .array(argument)
+        .max(1024)
+        .min(1)
+        .describe("TShark field names to return, e.g. ip.addr, usb.endpoint_address, btatt.opcode; frame.number is always included"),
+    display_filter: argument
+        .nullable()
+        .default(null)
+        .describe("Optional Wireshark display filter (-Y), applied within the read limit"),
+    decode_as: z
+        .array(argument)
+        .max(1024)
+        .default([])
+        .describe("Explicit TShark decode-as selections, e.g. tcp.port==8888,http"),
+    packet_limit: z
+        .number()
+        .int()
+        .positive()
+        .max(2147483647)
+        .nullable()
+        .default(null)
+        .describe("Maximum input packets to read before filtering; omitted scans to EOF within resource limits"),
+    two_pass: z
+        .boolean()
+        .default(true)
+        .describe("Use two-pass analysis for fields requiring later packets; false requests a single pass"),
+    match_offset: z
+        .number()
+        .int()
+        .nonnegative()
+        .default(0)
+        .describe("Skip this many matching packets after filtering; default 0"),
+    match_limit: z
+        .number()
+        .int()
+        .positive()
+        .nullable()
+        .default(50)
+        .describe("Return at most this many matching packets after filtering; default 50. Null explicitly returns all remaining matches within producer resource limits."),
+});
+// Bound UTF-8 selector text, terminators, option names and 64-bit argv pointers
+// before Set/flatMap expansion. 32 KiB reserves headroom below Linux execve's
+// 32-page argv+environment floor; ambient environments can still exhaust it.
+export const withinPacketCaptureSelectorBudget = (input) => {
+    if (input.fields.length > 1024 || input.decode_as.length > 1024)
+        return false;
+    let bytes = 0;
+    for (const selections of [input.fields, input.decode_as])
+        for (const value of selections) {
+            bytes += Buffer.byteLength(value, "utf8") + 20;
+            if (bytes > 32768)
+                return false;
+        }
+    if (input.display_filter !== null)
+        bytes += Buffer.byteLength(input.display_filter, "utf8") + 20;
+    return bytes <= 32768;
+};
+export const packetCaptureSelectorBudgetIssue = {
+    message: "Packet selectors exceed the 32 KiB encoded argument budget; reduce fields, decode-as rules or filter text.",
+};
+export const inspectPacketCaptureInputSchema = captureInputShape.refine(withinPacketCaptureSelectorBudget, packetCaptureSelectorBudgetIssue);
+export const packetCaptureOptionsSchema = captureInputShape
+    .omit({ path: true })
+    .refine(withinPacketCaptureSelectorBudget, packetCaptureSelectorBudgetIssue);
+/** Values remain strings; repeated occurrences remain ordered arrays. */
+export const packetFieldsSchema = z
+    .object({
+    "frame.number": z.tuple([z.string().regex(/^[1-9][0-9]*$/)]),
+})
+    .catchall(z.array(z.string()));
+export const packetCaptureSchema = z
+    .strictObject({
+    artifact: z.strictObject({
+        path: z.string(),
+        sha256: z.string().regex(/^[a-f0-9]{64}$/),
+        bytes: z.number().int().nonnegative(),
+    }),
+    selection: inspectPacketCaptureInputSchema,
+    packets: z.array(packetFieldsSchema),
+    output_window: z.strictObject({
+        matching_packets: z
+            .number()
+            .int()
+            .nonnegative()
+            .describe("Matches in the completed producer output within the indicated input read scope, not total capture packets"),
+        returned_packets: z.number().int().nonnegative(),
+        has_more: z.boolean(),
+    }),
+    read_scope: z.enum(["to-eof", "up-to-input-packet-limit"]),
+    diagnostics: z.string(),
+    tool: z.strictObject({
+        configured_path: z.string(),
+        path: z.string(),
+        sha256: z.string().regex(/^[a-f0-9]{64}$/),
+        version_banner: z.string(),
+        version_diagnostics: z.string(),
+        arguments: z.array(z.string()),
+    }),
+    configuration: z.literal("private-empty-personal-profile"),
+    resource_limiter: z.strictObject({
+        configured_path: z.string(),
+        path: z.string(),
+        sha256: z.string().regex(/^[a-f0-9]{64}$/),
+        arguments: z.array(z.string()),
+    }),
+    limits: z.strictObject({
+        input_bytes: z.number().int().positive(),
+        output_bytes: z.number().int().positive(),
+        command_timeout_ms: z.number().int().positive(),
+        address_space_bytes: z.number().int().nonnegative(),
+        file_bytes: z.number().int().nonnegative(),
+        cpu_seconds: z.number().int().nonnegative(),
+    }),
+    hardware_acquisition: z.literal("not-performed"),
+})
+    .superRefine((report, context) => {
+    const remaining = Math.max(report.output_window.matching_packets - report.selection.match_offset, 0);
+    const expected = report.selection.match_limit === null
+        ? remaining
+        : Math.min(remaining, report.selection.match_limit);
+    if (report.packets.length !== expected ||
+        report.output_window.returned_packets !== expected ||
+        report.output_window.has_more !== remaining > expected)
+        context.addIssue({
+            code: "custom",
+            path: ["output_window"],
+            message: "Returned packet window must match examined matches and caller-selected offset/limit",
+        });
+});

package/dist/domain/captures/packetFields.js

@@ -0,0 +1,81 @@
+import { z } from "zod";
+import { packetCaptureSchema } from "./packetCapture.js";
+export const inspectPacketFieldsInputSchema = z.strictObject({
+    kind: z
+        .enum(["protocols", "fields"])
+        .default("protocols")
+        .describe("Return protocol registrations or field definitions; defaults to protocols"),
+    protocol: z
+        .string()
+        .min(1)
+        .max(8192)
+        .nullable()
+        .default(null)
+        .describe("Exact protocol abbreviation; selects that protocol or its registered fields"),
+    query: z
+        .string()
+        .max(8192)
+        .default("")
+        .describe("Case-insensitive literal substring in name, abbreviation or field description"),
+    offset: z
+        .number()
+        .int()
+        .nonnegative()
+        .max(Number.MAX_SAFE_INTEGER)
+        .default(0)
+        .describe("Number of matching records to skip; defaults to 0"),
+    limit: z
+        .number()
+        .int()
+        .positive()
+        .max(Number.MAX_SAFE_INTEGER)
+        .nullable()
+        .default(50)
+        .describe("Maximum matches returned; null requests all remaining within the record budget"),
+});
+export const packetFieldRecordSchema = z.strictObject({
+    source_line: z.number().int().positive(),
+    kind: z.enum(["protocol", "field"]),
+    name: z.string(),
+    abbreviation: z.string(),
+    field_type: z.string().nullable(),
+    parent_protocol: z.string().nullable(),
+    display_base: z.string().nullable(),
+    bitmask: z.string().nullable(),
+    description: z.string().nullable(),
+});
+export const packetFieldsCatalogSchema = z
+    .strictObject({
+    selection: inspectPacketFieldsInputSchema,
+    records: z.array(packetFieldRecordSchema),
+    output_window: z.strictObject({
+        examined: z.number().int().nonnegative(),
+        matching: z.number().int().nonnegative(),
+        returned: z.number().int().nonnegative(),
+        has_more: z.boolean(),
+    }),
+    diagnostics: z.string(),
+    tool: packetCaptureSchema.shape.tool,
+    resource_limiter: packetCaptureSchema.shape.resource_limiter,
+    limits: packetCaptureSchema.shape.limits.extend({
+        record_budget_bytes: z.literal(8388608),
+    }),
+    configuration: z.literal("private-empty-personal-profile"),
+    hardware_acquisition: z.literal("not-performed"),
+})
+    .superRefine((report, context) => {
+    const w = report.output_window;
+    const remaining = Math.max(0, w.matching - report.selection.offset);
+    const expected = Math.min(remaining, report.selection.limit ?? remaining);
+    if (w.matching > w.examined ||
+        w.returned !== expected ||
+        report.records.length !== expected ||
+        w.has_more !== remaining > expected ||
+        report.records.some((row) => row.kind !==
+            (report.selection.kind === "protocols" ? "protocol" : "field")))
+        context.addIssue({
+            code: "custom",
+            path: ["output_window"],
+            message: "Field discovery coverage must match the selected page and record kind",
+        });
+});

package/dist/domain/changedBehavior.js

@@ -2,7 +2,7 @@ import { z } from "zod";
 import { artifactComparisonResultSchema } from "./artifactComparison.js";
 import { uniqueSorted } from "./canonicalOrdering.js";
 import { compositeKey, compareUnicodeCodePoints, } from "./unicodeCodePointOrder.js";
-import { comparisonSourceEvidenceIds } from "./comparisonSourceEvidence.js";
+import { assertComparisonFindingLinks, comparisonSourceEvidenceIds, } from "./comparisonSourceEvidence.js";
 import { evidenceSchema, parseEvidence } from "./evidence.js";
 import { functionComparisonResultSchema } from "./functionComparisonSchemas.js";
 import { PROCESS_PROVIDER, isProcessEvidenceProvider, } from "./process/processEvidenceProvider.js";
@@ -85,18 +85,24 @@ const EXPECTED_PROVIDERS = {
     },
 };
 const acceptsPredicate = (expected, actual) => expected.some((predicate) => predicate === actual);
-/** Find observed runtime changes and separately report static change candidates. */
-export const findChangedBehavior = (comparisonsInput) => {
-    const parsedInput = changedBehaviorInputSchema.parse({
-        comparisons: comparisonsInput,
-    });
-    const comparisons = parsedInput.comparisons;
+export const findChangedBehavior = (input) => {
+    // The public input schema remains available to clients; this internal
+    // admission only checks the list shape because parseEvidence below owns
+    // validation and authentication of each retained Evidence item.
+    const { comparisons } = z
+        .strictObject({ comparisons: z.array(z.unknown()).min(1) })
+        .parse(input);
     const evidence = comparisons.map(parseComparisonEvidence);
-    assertUnique(evidence.map(({ evidence_id: id }) => id), "comparison Evidence");
+    assertUnique(evidence.map(({ evidence: { evidence_id: id } }) => id), "comparison Evidence");
     const findings = evidence.flatMap(findingsFor).sort(compareFindings);
-    const runtimeStatuses = evidence.flatMap(runtimeStatus);
-    const links = uniqueSorted(evidence.flatMap((item) => [item.evidence_id, ...item.evidence_links]));
-    return changedBehaviorResultSchema.parse({
+    const runtimeStatuses = evidence.flatMap((comparison) => comparison.operation === "compare_process_captures"
+        ? [comparison.result.status]
+        : []);
+    const links = uniqueSorted(evidence.flatMap(({ evidence: item }) => [
+        item.evidence_id,
+        ...item.evidence_links,
+    ]));
+    const result = changedBehaviorResultSchema.parse({
         behavior_status: behaviorStatus(runtimeStatuses),
         summary: {
             observed_changes: count(findings, "observed_change"),
@@ -109,7 +115,7 @@ export const findChangedBehavior = (comparisonsInput) => {
         },
         evidence_links: links,
         limitations: uniqueSorted([
-            ...evidence.flatMap(({ limitations }) => limitations),
+            ...evidence.flatMap(({ evidence: item }) => item.limitations),
             ...(evidence.some(({ operation }) => operation !== "compare_process_captures")
                 ? [
                     "Static differences are behavior candidates, not runtime observations.",
@@ -120,6 +126,10 @@ export const findChangedBehavior = (comparisonsInput) => {
                 : []),
         ]),
     });
+    return {
+        result,
+        comparisonEvidenceIds: evidence.map(({ evidence: { evidence_id } }) => evidence_id),
+    };
 };
 const parseComparisonEvidence = (input) => {
     const evidence = parseEvidence(input);
@@ -145,39 +155,34 @@ const parseComparisonEvidence = (input) => {
         throw new TypeError("Comparison Evidence operation, predicate, and provider disagree");
     if (!comparisonSourceEvidenceIds(evidence).every((id) => evidence.evidence_links.includes(id)))
         throw new TypeError("Comparison Evidence must cite both selected source observations");
-    parseResult(evidence);
-    return evidence;
+    return parseResult(evidence, operation);
 };
-const parseResult = (evidence) => {
-    if (evidence.operation === "compare_process_captures") {
+const parseResult = (evidence, operation) => {
+    if (operation === "compare_process_captures") {
         const result = processCaptureComparisonSchema.parse(evidence.normalized_result);
         const expected = deriveProcessComparisonStatus(PROCESS_COMPARISON_DIMENSIONS.map((dimension) => result[dimension]));
         if (result.status !== expected)
             throw new TypeError("Process comparison status contradicts its dimensions");
-        return;
+        return { operation, evidence, result };
     }
-    if (evidence.operation === "compare_functions") {
+    if (operation === "compare_functions") {
         const result = functionComparisonResultSchema.parse(evidence.normalized_result);
-        assertNestedLinks(evidence, result.dimensions.flatMap(({ evidence_links: links }) => links));
-        return;
+        assertComparisonFindingLinks(evidence, result.dimensions.flatMap(({ evidence_links: links }) => links));
+        return { operation, evidence, result };
     }
     const result = artifactComparisonResultSchema.parse(evidence.normalized_result);
-    assertNestedLinks(evidence, result.changes.flatMap(({ evidence_links: links }) => links));
-};
-const assertNestedLinks = (evidence, nestedLinks) => {
-    const topLevel = new Set(evidence.evidence_links);
-    if (nestedLinks.some((evidenceId) => !topLevel.has(evidenceId)))
-        throw new TypeError("Comparison finding cites Evidence outside its top-level closure");
+    assertComparisonFindingLinks(evidence, result.changes.flatMap(({ evidence_links: links }) => links));
+    return { operation, evidence, result };
 };
-const findingsFor = (evidence) => {
-    if (evidence.operation === "compare_process_captures")
-        return processFindings(evidence);
-    if (evidence.operation === "compare_functions")
-        return functionFindings(evidence);
-    return artifactFindings(evidence);
+const findingsFor = (comparison) => {
+    if (comparison.operation === "compare_process_captures")
+        return processFindings(comparison);
+    if (comparison.operation === "compare_functions")
+        return functionFindings(comparison);
+    return artifactFindings(comparison);
 };
-const processFindings = (evidence) => {
-    const result = processCaptureComparisonSchema.parse(evidence.normalized_result);
+const processFindings = (comparison) => {
+    const { evidence, result } = comparison;
     const dimensions = [
         ["terminal", result.terminal, "runtime"],
         ["interaction", result.interaction, "runtime"],
@@ -200,8 +205,8 @@ const processFindings = (evidence) => {
             }),
         ]);
 };
-const functionFindings = (evidence) => {
-    const result = functionComparisonResultSchema.parse(evidence.normalized_result);
+const functionFindings = (comparison) => {
+    const { evidence, result } = comparison;
     return result.dimensions.flatMap((dimension) => dimension.status === "unchanged"
         ? []
         : [
@@ -218,8 +223,8 @@ const functionFindings = (evidence) => {
             }),
         ]);
 };
-const artifactFindings = (evidence) => {
-    const result = artifactComparisonResultSchema.parse(evidence.normalized_result);
+const artifactFindings = (comparison) => {
+    const { evidence, result } = comparison;
     const changes = result.changes.map((change) => makeFinding({
         evidence,
         dimension: `artifact:${change.logical_path}`,
@@ -260,9 +265,6 @@ const makeFinding = (input) => findingSchema.parse({
     ]),
     limitations: uniqueSorted(input.limitations),
 });
-const runtimeStatus = (evidence) => evidence.operation === "compare_process_captures"
-    ? [processCaptureComparisonSchema.parse(evidence.normalized_result).status]
-    : [];
 const behaviorStatus = (statuses) => {
     if (statuses.length === 0)
         return "unknown";

package/dist/domain/compactStringIdentity.js

@@ -0,0 +1,9 @@
+import { digestCanonicalValue } from "./canonicalDigest.js";
+/** Retain short exact string keys or commit their value in a reserved digest namespace. */
+export const compactStringIdentityKey = (value) => {
+    const prefix = "value-sha256:";
+    const digestKey = `${prefix}${digestCanonicalValue(value, "String identity")}`;
+    return value.length <= digestKey.length && !value.startsWith(prefix)
+        ? value
+        : digestKey;
+};

package/dist/domain/comparisonSourceEvidence.js

@@ -38,3 +38,9 @@ export const comparisonSourceEvidenceIds = (evidence) => {
     const sides = comparisonSourceEvidenceSides(evidence);
     return uniqueSorted([...sides.left, ...sides.right]);
 };
+/** Preserve the source closure when consuming nested comparison findings. */
+export const assertComparisonFindingLinks = (evidence, nestedLinks) => {
+    const closure = new Set(evidence.evidence_links);
+    if (nestedLinks.some((id) => !closure.has(id)))
+        throw new TypeError("Comparison finding cites Evidence outside its top-level closure");
+};

package/dist/domain/dosCom.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { err, ok } from "./result.js";
-/** Headerless DOS COM interpretation explicitly selected by the caller. */
-export const executableFormatHintSchema = z.literal("dos-com");
+/** Headerless executable interpretation explicitly selected by the caller. */
+export const executableFormatHintSchema = z.enum(["dos-com", "raw-binary"]);
 /** Validate the single 64 KiB COM segment, excluding its 256-byte PSP prefix. */
 export const validateDosComLength = (length) => Number.isSafeInteger(length) && length >= 1 && length <= 0xff00
     ? ok(null)