rea-agents 6.3.0 → 6.5.0

package/dist/domain/referenceSourceImportParsing.js

@@ -1,18 +1,18 @@
-import { parse } from "@babel/parser";
 import { traverseJavaScriptAst } from "./javascript/javascriptSemanticTraversal.js";
-import { parserPluginsForPath } from "./javascript/javascriptSourceParser.js";
+import { parseRecoveredJavaScript, parserPluginsForPath, } from "./javascript/javascriptSourceParser.js";
+import { unshadowedReferenceSourceRequireCalls } from "./referenceSourceRequireBindings.js";
+import { isRelativeJavaScriptModuleSpecifier } from "./javascript/javascriptModuleSpecifier.js";
 import { isCallExpression, isExportAllDeclaration, isExportNamedDeclaration, isIdentifier, isImport, isImportDeclaration, isImportExpression, isMemberExpression, isStringLiteral, isTSExternalModuleReference, isTSImportEqualsDeclaration, isTSModuleDeclaration, } from "@babel/types";
-const codeSourceLanguages = new Set(["JavaScript", "TypeScript", "JSX", "TSX"]);
+export const PARSEABLE_REFERENCE_SOURCE_LANGUAGES = new Set(["JavaScript", "TypeScript", "JSX", "TSX"]);
 const safeModuleName = (node) => {
     if (isStringLiteral(node))
         return node.value;
     return undefined;
 };
 const resolveSpecifier = (specifier) => {
-    if (specifier.startsWith(".") || specifier.startsWith("/"))
+    if (isRelativeJavaScriptModuleSpecifier(specifier) ||
+        specifier.startsWith("/"))
         return "internal";
-    if (specifier.startsWith("node:") || specifier.startsWith("data:"))
-        return "external";
     return "external";
 };
 const isModuleExpression = (expression) => isStringLiteral(expression) || isCallExpression(expression);
@@ -114,7 +114,7 @@ const isRequireCallee = (callee) => {
     }
     return false;
 };
-const extractRequireAndDynamicImports = (body, from_path, relationships) => {
+const extractRequireAndDynamicImports = (body, from_path, relationships, unshadowedRequireCalls) => {
     // Single traversal owner: iterative, VISITOR_KEYS-gated, no recursion over
     // loc/comment objects. Survives deeply nested generated member chains that
     // overflowed the previous hand-rolled Object.values walker.
@@ -139,7 +139,9 @@ const extractRequireAndDynamicImports = (body, from_path, relationships) => {
             continue;
         }
         const first = call.arguments[0];
-        if (isRequireCallee(call.callee) && isModuleExpression(first)) {
+        if (isRequireCallee(call.callee) &&
+            unshadowedRequireCalls.has(call) &&
+            isModuleExpression(first)) {
             const result = moduleSpecifierFromExpression(first);
             if (result !== undefined) {
                 appendRelationship(relationships, {
@@ -171,27 +173,30 @@ const parseWithBabel = (path, source, language) => {
     void language;
     const plugins = parserPluginsForPath(path);
     try {
-        const ast = parse(source, {
-            sourceType: "unambiguous",
+        const { file: ast, moduleOnlyErrors } = parseRecoveredJavaScript(source, path, {
             allowImportExportEverywhere: false,
             allowReturnOutsideFunction: true,
             allowUndeclaredExports: true,
-            errorRecovery: true,
             plugins,
         });
-        return { ast, reasons: ast.errors.map((error) => error.message) };
+        return {
+            ast,
+            reasons: ast.errors.map((error) => error.message),
+            moduleOnlyErrors,
+        };
     }
     catch (cause) {
         return {
             ast: undefined,
             reasons: [cause instanceof Error ? cause.message : "Parse failed"],
+            moduleOnlyErrors: [],
         };
     }
 };
 /** Parse ESM/CommonJS imports and dynamic imports from source bytes. */
 export const parseReferenceSourceImports = (path, bytes, language) => {
-    if (language !== null && !codeSourceLanguages.has(language))
-        return { relationships: [], parse_failures: [] };
+    if (language !== null && !PARSEABLE_REFERENCE_SOURCE_LANGUAGES.has(language))
+        return { relationships: [], parse_failures: [], limitations: [] };
     let source;
     try {
         source = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
@@ -206,9 +211,15 @@ export const parseReferenceSourceImports = (path, bytes, language) => {
                     reason: "Source bytes are not valid UTF-8; import targets were not parsed.",
                 },
             ],
+            limitations: [],
         };
     }
-    const { ast, reasons } = parseWithBabel(path, source, language);
+    const { ast, reasons, moduleOnlyErrors } = parseWithBabel(path, source, language);
+    const limitations = moduleOnlyErrors.length === 0
+        ? []
+        : [
+            `Strict-mode errors apply only if this file is an ES module: ${moduleOnlyErrors.join("; ")}`,
+        ];
     const parseFailures = reasons.map((reason) => ({
         path,
         parser: "babel",
@@ -218,11 +229,12 @@ export const parseReferenceSourceImports = (path, bytes, language) => {
         return {
             relationships: [],
             parse_failures: parseFailures,
+            limitations,
         };
     }
     const relationships = [];
     extractImportDeclarations(ast.program.body, path, relationships);
-    extractRequireAndDynamicImports(ast.program.body, path, relationships);
+    extractRequireAndDynamicImports(ast.program.body, path, relationships, unshadowedReferenceSourceRequireCalls(ast, path));
     return {
         relationships: relationships.map((relationship) => ({
             ...relationship,
@@ -231,5 +243,6 @@ export const parseReferenceSourceImports = (path, bytes, language) => {
                 : relationship.parse_state,
         })),
         parse_failures: parseFailures,
+        limitations,
     };
 };

package/dist/domain/referenceSourcePathIdentity.js

@@ -0,0 +1,32 @@
+import { posix } from "node:path";
+/**
+ * Reference inventories retain filesystem spelling. Prefer that exact identity;
+ * canonical Unicode equivalence is a fallback only when it identifies one entry.
+ */
+export const createReferenceSourcePathLookup = (paths) => {
+    const exact = new Set(paths);
+    const canonical = new Map();
+    for (const path of exact) {
+        const key = path.normalize("NFC");
+        canonical.set(key, canonical.has(key) ? null : path);
+    }
+    const equivalent = (path) => canonical.get(path.normalize("NFC")) ?? undefined;
+    const resolve = (path) => exact.has(path) ? path : equivalent(path);
+    return {
+        resolve,
+        resolveCandidates: (candidates) => candidates.find((path) => exact.has(path)) ??
+            candidates.map(equivalent).find((path) => path !== undefined),
+        resolveAncestor: (path) => {
+            for (let candidate = path; candidate !== "." && candidate !== "/"; candidate = posix.dirname(candidate)) {
+                const found = resolve(candidate);
+                if (found !== undefined)
+                    return found;
+            }
+            return undefined;
+        },
+    };
+};
+/** Symlink evidence can originate on a different OS from the graph reader. */
+export const isPortableAbsoluteReferenceTarget = (target) => target.startsWith("/") ||
+    /^[A-Za-z]:[\\/]/u.test(target) ||
+    /^\\\\[^\\/]+[\\/][^\\/]+/u.test(target);

package/dist/domain/referenceSourceRequireBindings.js

@@ -0,0 +1,130 @@
+import * as t from "@babel/types";
+import { analyzeParsedJavaScriptReferences } from "./javascript/javascriptSemanticAnalysis.js";
+import { semanticBindingId, semanticScopeId, } from "./javascript/javascriptSemanticState.js";
+import { traverseJavaScriptAst } from "./javascript/javascriptSemanticTraversal.js";
+import { isExplicitModuleSourcePath, } from "./javascript/javascriptSourceParser.js";
+/**
+ * Keep calls that resolve either to Node's CommonJS wrapper loader or to a
+ * direct ESM `createRequire(import.meta.url)` binding. The shared lexical
+ * analyzer supplies binding ownership; this boundary accounts for the two
+ * Node loader bindings without evaluating arbitrary values.
+ */
+export const unshadowedReferenceSourceRequireCalls = (file, path) => {
+    const references = new Map(analyzeParsedJavaScriptReferences(file).map((reference) => [
+        `${reference.location.start.line}:${reference.location.start.column}`,
+        reference,
+    ]));
+    const programRequireBinding = semanticBindingId(semanticScopeId("program", file.program), "require");
+    // Syntax alone cannot establish Node's runtime mode: `.js` depends on its
+    // package scope, and `.ts` may be compiled with a CommonJS module target.
+    // Keep unmarked paths runtime-unknown and preserve candidate require edges.
+    const allowsUnboundRequire = !isExplicitModuleSourcePath(path);
+    const hasTopLevelVarRequire = allowsUnboundRequire && hasUninitializedTopLevelVarRequire(file.program);
+    const createRequireBinding = directCreateRequireBinding(file.program, references);
+    const requireLoaderWasWritten = [...references.values()].some((reference) => reference.name === "require" &&
+        reference.role === "write" &&
+        (reference.resolution === "unbound" ||
+            reference.bindingId === programRequireBinding));
+    const calls = new Set();
+    traverseJavaScriptAst(file.program, {
+        enter: (node, _parent, readAncestors) => {
+            if (!t.isCallExpression(node))
+                return;
+            const identifier = requireCalleeIdentifier(node.callee);
+            const start = identifier?.loc?.start;
+            if (start === undefined)
+                return;
+            if (readAncestors().some((ancestor) => t.isWithStatement(ancestor) && contains(ancestor.body, node)))
+                return;
+            const reference = references.get(`${start.line}:${start.column}`);
+            if ((allowsUnboundRequire &&
+                !requireLoaderWasWritten &&
+                reference?.resolution === "unbound") ||
+                (((hasTopLevelVarRequire && !requireLoaderWasWritten) ||
+                    createRequireBinding) &&
+                    reference?.resolution === "resolved" &&
+                    reference.bindingId === programRequireBinding))
+                calls.add(node);
+        },
+    });
+    return calls;
+};
+const contains = (container, node) => typeof container.start === "number" &&
+    typeof container.end === "number" &&
+    typeof node.start === "number" &&
+    typeof node.end === "number" &&
+    container.start <= node.start &&
+    node.end <= container.end;
+const hasUninitializedTopLevelVarRequire = (program) => {
+    let found = false;
+    let initialized = false;
+    traverseJavaScriptAst(program, {
+        enter: (node, _parent, readAncestors) => {
+            if (!t.isVariableDeclaration(node, { kind: "var" }))
+                return;
+            if (readAncestors().some((ancestor) => t.isFunction(ancestor) || t.isStaticBlock(ancestor)))
+                return;
+            for (const declaration of node.declarations) {
+                if (!Object.hasOwn(t.getBindingIdentifiers(declaration.id), "require"))
+                    continue;
+                found = true;
+                initialized ||= declaration.init !== null;
+            }
+        },
+    });
+    return found && !initialized;
+};
+const directCreateRequireBinding = (program, references) => {
+    const programScope = semanticScopeId("program", program);
+    const importedNames = new Set();
+    for (const declaration of program.body) {
+        if (!t.isImportDeclaration(declaration) ||
+            (declaration.source.value !== "node:module" &&
+                declaration.source.value !== "module"))
+            continue;
+        for (const specifier of declaration.specifiers) {
+            if (t.isImportSpecifier(specifier) &&
+                t.isIdentifier(specifier.imported, { name: "createRequire" }))
+                importedNames.add(specifier.local.name);
+        }
+    }
+    return program.body.some((statement) => t.isVariableDeclaration(statement, { kind: "const" }) &&
+        statement.declarations.some((declaration) => {
+            if (!t.isIdentifier(declaration.id, { name: "require" }) ||
+                !t.isCallExpression(declaration.init) ||
+                !t.isIdentifier(declaration.init.callee) ||
+                !importedNames.has(declaration.init.callee.name) ||
+                !isImportMetaUrl(declaration.init.arguments[0]))
+                return false;
+            const start = declaration.init.callee.loc?.start;
+            if (start === undefined)
+                return false;
+            const reference = references.get(`${start.line}:${start.column}`);
+            return (reference?.resolution === "resolved" &&
+                reference.bindingId ===
+                    semanticBindingId(programScope, declaration.init.callee.name));
+        }));
+};
+const isImportMetaUrl = (node) => t.isMemberExpression(node) &&
+    !node.computed &&
+    t.isIdentifier(node.property, { name: "url" }) &&
+    t.isMetaProperty(node.object) &&
+    t.isIdentifier(node.object.meta, { name: "import" }) &&
+    t.isIdentifier(node.object.property, { name: "meta" });
+const requireCalleeIdentifier = (callee) => {
+    if (t.isIdentifier(callee, { name: "require" }))
+        return callee;
+    if (!t.isMemberExpression(callee) ||
+        !t.isIdentifier(callee.object, { name: "require" }) ||
+        ((!t.isIdentifier(callee.property) || callee.computed) &&
+            !t.isStringLiteral(callee.property)))
+        return undefined;
+    const propertyName = t.isIdentifier(callee.property)
+        ? callee.property.name
+        : t.isStringLiteral(callee.property)
+            ? callee.property.value
+            : undefined;
+    return propertyName === "resolve" || propertyName === "main"
+        ? callee.object
+        : undefined;
+};

package/dist/domain/referenceSourceSummary.js

@@ -0,0 +1,92 @@
+import { createHistoricalSourceManifest, } from "./referenceSourceGraph.js";
+const outlineEntry = (entry) => {
+    if (entry.kind !== "file")
+        return entry;
+    return {
+        path: entry.path,
+        kind: entry.kind,
+        language: entry.language,
+        size: entry.size,
+        content_state: entry.content_state,
+        classifications: entry.classifications,
+        limitations: entry.limitations,
+    };
+};
+/** Project one committed inventory without rereading or reinterpreting source. */
+export const createHistoricalSourceSummary = (graph, outlineDepth) => {
+    const manifest = createHistoricalSourceManifest(graph);
+    const counts = {
+        entries: graph.entries.length,
+        files: 0,
+        directories: 0,
+        symlinks: 0,
+        unknown: 0,
+        relationships: graph.relationships.length,
+        parse_failures: graph.parse_failures.length,
+        exclusions: graph.exclusions.length,
+    };
+    const contentStates = {
+        hashed: 0,
+        "redacted-secret": 0,
+        excluded: 0,
+        unreadable: 0,
+        unknown: 0,
+    };
+    const treeStates = {
+        enumerated: 0,
+        partial: 0,
+        excluded: 0,
+        unreadable: 0,
+        unknown: 0,
+    };
+    let knownBytes = 0n;
+    let unknownSizeFiles = 0;
+    const outline = [];
+    for (const entry of graph.entries) {
+        if (entry.kind === "file") {
+            counts.files += 1;
+            contentStates[entry.content_state] += 1;
+            if (entry.size === null)
+                unknownSizeFiles += 1;
+            else
+                knownBytes += BigInt(entry.size);
+        }
+        else if (entry.kind === "directory") {
+            counts.directories += 1;
+            treeStates[entry.tree_state] += 1;
+        }
+        else if (entry.kind === "symlink")
+            counts.symlinks += 1;
+        else
+            counts.unknown += 1;
+        // Canonical entries already use Unicode code-point order; filtering preserves it.
+        if (entry.path.split("/").length <= outlineDepth)
+            outline.push(outlineEntry(entry));
+    }
+    return {
+        schema: "HistoricalSourceSummary",
+        authority: graph.authority,
+        root_alias: graph.root_alias,
+        manifest,
+        inventory_state: graph.inventory_state,
+        provenance: graph.provenance,
+        vcs: graph.vcs,
+        languages: graph.languages,
+        manifests: graph.manifests,
+        counts,
+        file_content_states: contentStates,
+        directory_tree_states: treeStates,
+        file_sizes: {
+            // Decimal text keeps large totals exact; this covers only known inventoried sizes.
+            known_bytes: knownBytes.toString(),
+            unknown_file_count: unknownSizeFiles,
+        },
+        exclusions: graph.exclusions,
+        limitations: graph.limitations,
+        outline: {
+            depth: outlineDepth,
+            entries: outline,
+            omitted_entry_count: graph.entries.length - outline.length,
+        },
+    };
+};

package/dist/domain/relationshipCoverage.js

@@ -0,0 +1,44 @@
+import { z } from "zod";
+const diagnostics = z.array(z.string().min(1)).min(1).exactOptional();
+const completeCoverage = z.strictObject({
+    status: z.literal("complete"),
+    diagnostics,
+});
+const limitedDirections = z.union([
+    z.tuple([z.literal("callers")]).check(z.minLength(1), z.maxLength(1)),
+    z.tuple([z.literal("callees")]).check(z.minLength(1), z.maxLength(1)),
+    z
+        .tuple([z.literal("callers"), z.literal("callees")])
+        .check(z.minLength(2), z.maxLength(2)),
+]);
+const partialCoverage = z.strictObject({
+    status: z.literal("partial"),
+    limitations: z.array(z.string().min(1)).min(1),
+    limited_directions: limitedDirections.exactOptional(),
+    diagnostics,
+});
+const unknownCoverage = z.strictObject({
+    status: z.literal("unknown"),
+    reason: z.string().min(1),
+    limited_directions: limitedDirections.exactOptional(),
+    diagnostics,
+});
+/** Explicit coverage state for a provider's observed caller/callee set. */
+export const relationshipCoverageSchema = z.discriminatedUnion("status", [
+    completeCoverage,
+    partialCoverage,
+    unknownCoverage,
+]);
+/** Reasons the observed relationship inventory cannot establish completeness. */
+export const relationshipCoverageLimitations = (coverage) => {
+    switch (coverage?.status) {
+        case undefined:
+            return ["Provider did not report relationship coverage."];
+        case "complete":
+            return [];
+        case "partial":
+            return coverage.limitations;
+        case "unknown":
+            return [coverage.reason];
+    }
+};

package/dist/domain/residualUnknown.js

@@ -3,10 +3,11 @@ import canonicalize from "canonicalize";
 import { z } from "zod";
 import { compareUnicodeCodePoints, compositeKey, } from "./unicodeCodePointOrder.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
+import { functionComparisonDimensionNameSchema } from "./functionComparisonSchemas.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const unknownIdSchema = prefixedDigestSchema("unk");
 const text = z.string().trim().min(1);
-const environmentRequirementSchema = z.object({
+const environmentRequirementSchema = z.strictObject({
     id: z.string().min(1).nullable(),
     platform: z.string().min(1).nullable(),
     architecture: z.string().min(1).nullable(),
@@ -14,28 +15,53 @@ const environmentRequirementSchema = z.object({
         .enum(["none", "process", "container", "virtual-machine"])
         .nullable(),
 });
-const probeSchema = z.object({
+const stableUnknownId = (question, domain, scopeDigest, comparisonConclusionScope) => `unk_${createHash("sha256")
+    .update(canonicalJson({
+    domain: domain.trim(),
+    question: question.replace(/\s+/gu, " ").trim(),
+    scope_digest: scopeDigest,
+    ...(comparisonConclusionScope === undefined
+        ? {}
+        : { comparison_conclusion_scope: comparisonConclusionScope }),
+}))
+    .digest("hex")}`;
+const probeSchema = z.strictObject({
     operation: z.string().min(1),
     rationale: text,
 });
-const relationshipSchema = z.object({
+const comparisonConclusionScopeSchema = z
+    .object({
+    comparison_evidence_id: evidenceIdSchema,
+    dimensions: z
+        .array(z.union([z.literal("overall"), functionComparisonDimensionNameSchema]))
+        .min(1),
+})
+    .strict()
+    .superRefine(({ dimensions }, context) => {
+    if (!sameOrderedValues(dimensions, sortedUnique(dimensions)))
+        context.addIssue({
+            code: "custom",
+            message: "Comparison dimensions must be sorted and unique",
+        });
+});
+const relationshipSchema = z.strictObject({
     type: z.enum(["depends-on", "related-to", "contradicts"]),
     unknown_id: unknownIdSchema,
 });
 const resolutionSchema = z.discriminatedUnion("disposition", [
-    z.object({
+    z.strictObject({
         disposition: z.literal("verified"),
         rationale: text,
         evidence_ids: z.array(evidenceIdSchema).min(1),
     }),
-    z.object({
+    z.strictObject({
         disposition: z.enum(["withdrawn", "out-of-scope"]),
         rationale: text,
         evidence_ids: z.array(evidenceIdSchema),
     }),
 ]);
 /** Strict durable record for one unresolved or evidence-qualified question. */
-const residualUnknownObjectSchema = z.object({
+const residualUnknownObjectSchema = z.strictObject({
     unknown_id: unknownIdSchema,
     revision: z.number().int().min(1),
     previous_revision_digest: z
@@ -57,6 +83,7 @@ const residualUnknownObjectSchema = z.object({
     ]),
     severity: z.enum(["low", "medium", "high", "critical"]),
     domain: text,
+    comparison_conclusion_scope: comparisonConclusionScopeSchema.exactOptional(),
     supporting_evidence_ids: z.array(evidenceIdSchema),
     contradicting_evidence_ids: z.array(evidenceIdSchema),
     required_authority: z
@@ -75,12 +102,13 @@ const residualUnknownObjectSchema = z.object({
     resolution: resolutionSchema.nullable(),
     mutation_evidence_ids: z.array(evidenceIdSchema).min(1),
 });
-export const residualUnknownSchema = residualUnknownObjectSchema.superRefine((value, context) => {
-    if (computeRevisionDigest(value) !== value.revision_digest)
+const refineRevision = (value, context) => {
+    if (value.unknown_id !==
+        stableUnknownId(value.question, value.domain, value.scope_digest, value.comparison_conclusion_scope))
         context.addIssue({
             code: "custom",
-            message: "Residual unknown revision digest does not match",
-            path: ["revision_digest"],
+            message: "Residual unknown ID does not match its immutable identity",
+            path: ["unknown_id"],
         });
     if ((value.revision === 1) !== (value.previous_revision_digest === null))
         context.addIssue({
@@ -117,6 +145,23 @@ export const residualUnknownSchema = residualUnknownObjectSchema.superRefine((va
                 code: "custom",
                 message: "Evidence IDs must be unique",
             });
+    if (value.comparison_conclusion_scope !== undefined &&
+        ![
+            ...value.supporting_evidence_ids,
+            ...value.contradicting_evidence_ids,
+        ].includes(value.comparison_conclusion_scope.comparison_evidence_id))
+        context.addIssue({
+            code: "custom",
+            message: "Scoped comparison Evidence must support or contradict the unknown",
+            path: ["comparison_conclusion_scope"],
+        });
+    if (value.comparison_conclusion_scope !== undefined &&
+        value.domain !== "function-comparison")
+        context.addIssue({
+            code: "custom",
+            message: "Comparison conclusion scope requires function-comparison domain",
+            path: ["comparison_conclusion_scope"],
+        });
     const contradictingEvidence = new Set(value.contradicting_evidence_ids);
     if (value.supporting_evidence_ids.some((id) => contradictingEvidence.has(id)))
         context.addIssue({
@@ -130,7 +175,20 @@ export const residualUnknownSchema = residualUnknownObjectSchema.superRefine((va
             message: "Relationships must be unique",
             path: ["relationships"],
         });
+};
+const residualUnknownValidatedSchema = residualUnknownObjectSchema.superRefine((value, context) => {
+    if (computeRevisionDigest(value) !== value.revision_digest)
+        context.addIssue({
+            code: "custom",
+            message: "Residual unknown revision digest does not match",
+            path: ["revision_digest"],
+        });
+    refineRevision(value, context);
 });
+export const residualUnknownSchema = residualUnknownValidatedSchema;
+const generatedRevisionSchema = residualUnknownObjectSchema
+    .omit({ revision_digest: true })
+    .superRefine(refineRevision);
 /** Input for deterministic creation of one residual unknown. */
 export const recordUnknownInputSchema = residualUnknownObjectSchema
     .omit({
@@ -167,28 +225,30 @@ export const updateUnknownInputSchema = z.strictObject({
 });
 /** Create stable identity from immutable question and domain fields. */
 export const createResidualUnknown = (input, mutationEvidenceId, scopeDigest) => {
-    const question = input.question.replace(/\s+/gu, " ");
-    const identity = canonicalJson({
-        domain: input.domain,
-        question,
-        scope_digest: scopeDigest,
-    });
+    const question = input.question.replace(/\s+/gu, " ").trim();
+    const domain = input.domain.trim();
+    const comparisonConclusionScope = input.comparison_conclusion_scope === undefined
+        ? undefined
+        : {
+            comparison_evidence_id: input.comparison_conclusion_scope.comparison_evidence_id,
+            dimensions: input.comparison_conclusion_scope.dimensions,
+        };
     const revision = {
-        unknown_id: `unk_${createHash("sha256").update(identity).digest("hex")}`,
+        unknown_id: stableUnknownId(question, domain, scopeDigest, comparisonConclusionScope),
         revision: 1,
         previous_revision_digest: null,
         scope_digest: scopeDigest,
         question,
         status: input.contradicting_evidence_ids.length > 0 ? "contradicted" : "open",
-        domain: input.domain,
+        domain,
+        ...(comparisonConclusionScope === undefined
+            ? {}
+            : { comparison_conclusion_scope: comparisonConclusionScope }),
         ...projectRevisionDetails(input),
         resolution: null,
         mutation_evidence_ids: [mutationEvidenceId],
     };
-    return residualUnknownSchema.parse({
-        ...revision,
-        revision_digest: computeRevisionDigest(revision),
-    });
+    return createRevision(revision);
 };
 /** Apply a complete, revision-guarded replacement while preserving identity. */
 export const updateResidualUnknown = (current, input, mutationEvidenceId) => {
@@ -200,6 +260,9 @@ export const updateResidualUnknown = (current, input, mutationEvidenceId) => {
         question: current.question,
         status: input.status,
         domain: current.domain,
+        ...(current.comparison_conclusion_scope === undefined
+            ? {}
+            : { comparison_conclusion_scope: current.comparison_conclusion_scope }),
         ...projectRevisionDetails(input),
         resolution: input.resolution,
         mutation_evidence_ids: sortedUnique([
@@ -207,10 +270,12 @@ export const updateResidualUnknown = (current, input, mutationEvidenceId) => {
             mutationEvidenceId,
         ]),
     };
-    return residualUnknownSchema.parse({
-        ...revision,
-        revision_digest: computeRevisionDigest(revision),
-    });
+    return createRevision(revision);
+};
+/** Validate and normalize owned revision fields before computing their digest. */
+const createRevision = (value) => {
+    const revision = generatedRevisionSchema.parse(value);
+    return { ...revision, revision_digest: computeRevisionDigest(revision) };
 };
 const projectRevisionDetails = (input) => ({
     severity: input.severity,
@@ -234,4 +299,6 @@ const canonicalJson = (value) => {
     return serialized;
 };
 const sortedUnique = (values) => [...new Set(values)].sort(compareUnicodeCodePoints);
+const sameOrderedValues = (left, right) => left.length === right.length &&
+    left.every((value, index) => value === right[index]);
 const sortedRelationships = (values) => [...values].sort((left, right) => compareUnicodeCodePoints(compositeKey([left.type, left.unknown_id]), compositeKey([right.type, right.unknown_id])));

package/dist/domain/reverseEngineering.js

@@ -0,0 +1,31 @@
+import { z } from "zod";
+const objdumpArtifactInputSchema = z
+    .object({
+    path: z.string().min(1),
+    operation: z.enum([
+        "file_headers",
+        "section_headers",
+        "symbols",
+        "relocations",
+        "dwarf",
+        "disassemble",
+        "disassemble_all",
+    ]),
+    follow_debug_links: z.boolean().default(false),
+})
+    .strict();
+/** Caller-selected artifact facet or pathless provider capability query. */
+export const objdumpInputSchema = z.discriminatedUnion("operation", [
+    objdumpArtifactInputSchema,
+    z.strictObject({ operation: z.literal("architectures") }),
+]);
+/** Caller-selected Rizin command against one local artifact. */
+export const rizinInputSchema = z
+    .object({
+    path: z.string().min(1),
+    command: z
+        .string()
+        .min(1)
+        .refine((value) => !/[\r\n\u0000]/u.test(value), "A single command line is required"),
+})
+    .strict();