rea-agents 6.4.0 → 6.5.0

package/dist/javascript/analysis/JavaScriptAnalysisWorkerProtocol.js

@@ -1,7 +1,8 @@
 import { z } from "zod";
+import { ANALYSIS_RESOURCE_KINDS } from "../../domain/analysisErrorCore.js";
 import { jsonValueSchema } from "../../domain/jsonValue.js";
 import { digestSchema } from "../../domain/digests.js";
-import { JAVASCRIPT_ANALYSIS_RESOURCE_DEFAULTS } from "../../domain/javascript/javascriptAnalysisResourceControls.js";
+import { JAVASCRIPT_ANALYSIS_RESOURCE_DEFAULTS, JAVASCRIPT_SEMANTIC_NODE_MAXIMUM, } from "../../domain/javascript/javascriptAnalysisResourceControls.js";
 import { javaScriptAnalysisTransferDescriptorSchema } from "./JavaScriptAnalysisTransfer.js";
 /** Independent worker execution budget; source length is not an admission rule. */
 export const JAVASCRIPT_ANALYSIS_WORKER_DEFAULTS = {
@@ -12,7 +13,7 @@ export const JAVASCRIPT_ANALYSIS_WORKER_DEFAULTS = {
 /** Caller-selected artifact identity, separate from the decoded source-text digest. */
 export const javaScriptWorkerRequestSchema = z.strictObject({
     id: z.uuid(),
-    node_budget: z.number().int().min(0).max(20_000),
+    node_budget: z.number().int().min(0).max(JAVASCRIPT_SEMANTIC_NODE_MAXIMUM),
     text_sha256: digestSchema,
     file: z.strictObject({
         path: z.string(),
@@ -34,7 +35,8 @@ const identity = { id: z.uuid() };
 export const javaScriptWorkerMessageSchema = z.discriminatedUnion("kind", [
     z.strictObject({
         kind: z.literal("ready"),
-        heap_limit_bytes: z.number().int().positive(),
+        // Null when the worker runtime (Bun) does not enforce V8 heap flags.
+        heap_limit_bytes: z.number().int().positive().nullable(),
     }),
     z.strictObject({
         kind: z.literal("phase"),
@@ -56,7 +58,7 @@ export const javaScriptWorkerMessageSchema = z.discriminatedUnion("kind", [
         kind: z.literal("failure"),
         ...identity,
         reason: z.enum(["resource", "output", "io"]),
-        resource: z.enum(["memory", "cpu", "file-size", "transport"]).nullable(),
+        resource: z.enum(ANALYSIS_RESOURCE_KINDS).nullable(),
         limits: z.record(z.string(), jsonValueSchema).nullable(),
         message: z.string(),
     }),

package/dist/javascript/analysis/JavaScriptAnalysisWorkerSchemas.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { digestSchema } from "../../domain/digests.js";
+import { JAVASCRIPT_AST_FINGERPRINT_ALGORITHM } from "../../domain/javascript/javascriptStaticAnalysisTypes.js";
 import { javaScriptSemanticNodeSchema, javaScriptSemanticRelationSchema, javaScriptSemanticUnknownSchema, javaScriptSemanticFingerprintSchema, javaScriptSemanticEvidenceContextSchema, } from "../../domain/javascript/javascriptSemanticGraphSchemas.js";
 const range = javaScriptSemanticNodeSchema.shape.identity.shape.source_range.unwrap();
 const count = z.number().int().nonnegative();
@@ -11,10 +12,11 @@ const findingContext = {
     location: range,
 };
 const withRuntime = (value) => {
-    const { module_runtime, ...rest } = value;
+    const { module_runtime, resolution_basis, ...rest } = value;
     return {
         ...rest,
         ...(module_runtime === undefined ? {} : { module_runtime }),
+        ...(resolution_basis === undefined ? {} : { resolution_basis }),
     };
 };
 const staticValue = z.discriminatedUnion("status", [
@@ -46,12 +48,16 @@ const locatedHandler = {
 const ipcChannel = (shape) => z.union([
     z.strictObject({
         ...findingContext,
+        invocation_location: range.optional(),
+        resolution_basis: z.literal("wrapper-substitution").optional(),
         ...shape,
         channel: z.string(),
         channel_expression: z.null(),
     }),
     z.strictObject({
         ...findingContext,
+        invocation_location: range.optional(),
+        resolution_basis: z.literal("wrapper-substitution").optional(),
         ...shape,
         channel: z.null(),
         channel_expression: z.string(),
@@ -97,10 +103,12 @@ const ipc = z
     }),
 ])
     .transform((value) => {
-    const { module_runtime, ...rest } = value;
+    const { module_runtime, resolution_basis, invocation_location, ...rest } = value;
     return {
         ...rest,
         ...(module_runtime === undefined ? {} : { module_runtime }),
+        ...(resolution_basis === undefined ? {} : { resolution_basis }),
+        ...(invocation_location === undefined ? {} : { invocation_location }),
     };
 });
 const windowShape = {
@@ -110,6 +118,7 @@ const windowShape = {
     web_preferences: z.array(z.strictObject({ name: z.string(), value: staticValue })),
 };
 const bridgeShape = {
+    resolution_basis: z.literal("wrapper-substitution").optional(),
     ...findingContext,
     world: z.enum(["main", "isolated"]),
     world_id: staticValue.nullable(),
@@ -118,7 +127,36 @@ const bridgeShape = {
     unknown_members: count,
 };
 const utilityShape = { ...findingContext, service_name: z.string().nullable() };
-const electron = z.strictObject({
+const electron = z
+    .strictObject({
+    call_paths: z
+        .array(z.strictObject({
+        entry_kind: z.enum(["bridge-member", "ipc-handler"]),
+        entry: z.string(),
+        entry_path: strings.optional(),
+        channel: z.string().nullable(),
+        terminal: z.string(),
+        resolution: z.literal("candidate"),
+        steps: z.array(z.strictObject({
+            kind: z.enum([
+                "exposure",
+                "factory",
+                "function",
+                "call",
+                "ipc",
+                "terminal",
+            ]),
+            label: z.string(),
+            location: range,
+            module_key: z.string().nullable(),
+            module_runtime: z.string().nullable(),
+        })),
+        conditions: z.array(z.strictObject({ expression: z.string(), location: range })),
+    }))
+        .transform((paths) => paths.map(({ entry_kind, entry, entry_path, ...rest }) => entry_path === undefined
+        ? { entry_kind, entry, ...rest }
+        : { entry_kind, entry, entry_path, ...rest }))
+        .optional(),
     browser_windows: z.array(z.union([
         z
             .strictObject({
@@ -200,7 +238,11 @@ const electron = z.strictObject({
         namespace_access: z.boolean().optional(),
         dynamic_member_access: z.boolean().optional(),
     })),
-});
+})
+    .transform(({ call_paths, ...rest }) => ({
+    ...rest,
+    ...(call_paths === undefined ? {} : { call_paths }),
+}));
 const referenceShape = {
     ...findingContext,
     kind: z.enum([
@@ -238,6 +280,7 @@ export const javaScriptWorkerStaticAnalysisSchema = z
         kind: z.enum(["route", "network"]),
         value: z.string(),
         mechanism: z.string(),
+        interpretation: z.literal("candidate").exactOptional(),
     })),
     storage: z.array(z.strictObject({
         ...findingContext,
@@ -269,7 +312,7 @@ export const javaScriptWorkerStaticAnalysisSchema = z
             exports: strings,
             location: range,
             structural_fingerprint_sha256: digestSchema,
-            structural_fingerprint_algorithm: z.literal("babel-ast-v1"),
+            structural_fingerprint_algorithm: z.literal(JAVASCRIPT_AST_FINGERPRINT_ALGORITHM),
         })),
         location: range,
     })),
@@ -369,7 +412,18 @@ const semanticValue = z.lazy(() => z
         ...(limit === undefined ? {} : { resourceLimit: limit }),
     };
 }));
-const origin = z.strictObject({ specifier: z.string(), importedPath: strings });
+const origin = z
+    .strictObject({
+    specifier: z.string(),
+    importedPath: strings,
+    resolutionMode: z
+        .enum(["import", "require", "compiler-dependent"])
+        .optional(),
+})
+    .transform(({ resolutionMode, ...rest }) => ({
+    ...rest,
+    ...(resolutionMode === undefined ? {} : { resolutionMode }),
+}));
 const provenance = z.discriminatedUnion("status", [
     z.strictObject({
         status: z.literal("module"),
@@ -417,15 +471,30 @@ const coverage = z
         ...(resourceLimits === undefined ? {} : { resourceLimits }),
     };
 });
-const moduleLink = z.strictObject({
-    kind: z.enum(["import", "require", "export", "re-export", "commonjs-export"]),
+const moduleLink = z
+    .strictObject({
+    resolutionMode: z
+        .enum(["import", "require", "compiler-dependent"])
+        .optional(),
+    kind: z.enum([
+        "import",
+        "type-import",
+        "require",
+        "export",
+        "re-export",
+        "commonjs-export",
+    ]),
     specifier: z.string().nullable(),
     importedName: z.string().nullable(),
     localName: z.string().nullable(),
     exportedName: z.string().nullable(),
     callableId: z.string().nullable(),
     location: range,
-});
+})
+    .transform(({ resolutionMode, ...rest }) => ({
+    ...rest,
+    ...(resolutionMode === undefined ? {} : { resolutionMode }),
+}));
 const definitionKind = z.enum([
     "import",
     "variable",

package/dist/javascript/analysis/JavaScriptAnalysisWorkerServer.js

@@ -4,7 +4,8 @@ import { join } from "node:path";
 import { createInterface } from "node:readline";
 import { getHeapStatistics } from "node:v8";
 import { AnalysisResourceConstraintError } from "../../domain/analysisErrorCore.js";
-import { writeJavaScriptAnalysisTransfer } from "./JavaScriptAnalysisTransfer.js";
+import { javaScriptRuntime } from "../../domain/runtimeVersion.js";
+import { javaScriptTransferByteBudget, writeJavaScriptAnalysisTransfer, } from "./JavaScriptAnalysisTransfer.js";
 import { javaScriptWorkerStaticAnalysisSchema } from "./JavaScriptAnalysisWorkerSchemas.js";
 import { JAVASCRIPT_ANALYSIS_WORKER_DEFAULTS as DEFAULTS, javaScriptWorkerRequestSchema, javaScriptWorkerAdmissionSchema, javaScriptWorkerMessageSchema, } from "./JavaScriptAnalysisWorkerProtocol.js";
 const send = async (input) => {
@@ -23,7 +24,9 @@ export const serveJavaScriptAnalysisWorker = async (analyze) => {
     const requests = input[Symbol.asyncIterator]();
     await send({
         kind: "ready",
-        heap_limit_bytes: getHeapStatistics().heap_size_limit,
+        heap_limit_bytes: javaScriptRuntime(process.versions).id === "node"
+            ? getHeapStatistics().heap_size_limit
+            : null,
     });
     try {
         for (;;) {
@@ -48,6 +51,7 @@ export const serveJavaScriptAnalysisWorker = async (analyze) => {
 };
 const analyzeJob = async (root, request, analyze, requests) => {
     try {
+        let resultBudgetBytes = 0;
         const source = await readFile(join(root, `${request.id}.source`), "utf8");
         if (createHash("sha256").update(source).digest("hex") !== request.text_sha256)
             throw new TypeError("JavaScript worker source text digest does not match its request");
@@ -83,13 +87,14 @@ const analyzeJob = async (root, request, analyze, requests) => {
                 const admission = javaScriptWorkerAdmissionSchema.parse(raw);
                 if (admission.id !== request.id)
                     throw new TypeError("JavaScript worker admission names a different source job");
-                return admission.semantic_result_budget_bytes;
+                resultBudgetBytes = admission.semantic_result_budget_bytes;
+                return resultBudgetBytes;
             },
         });
         await send({ kind: "phase", id: request.id, phase: "transfer" });
         const descriptor = result === null
             ? null
-            : await writeJavaScriptAnalysisTransfer(join(root, `${request.id}.records`), result.module, result.projection);
+            : await writeJavaScriptAnalysisTransfer(join(root, `${request.id}.records`), result.module, result.projection, javaScriptTransferByteBudget(resultBudgetBytes));
         await send({ kind: "complete", id: request.id, descriptor });
     }
     catch (cause) {
@@ -110,7 +115,12 @@ const analyzeJob = async (root, request, analyze, requests) => {
             limits: cause instanceof AnalysisResourceConstraintError
                 ? cause.reportedLimits
                 : null,
-            message: cause instanceof Error ? cause.message : String(cause),
+            // The parent owns resource-error formatting; send its canonical reason.
+            message: cause instanceof AnalysisResourceConstraintError
+                ? cause.reason
+                : cause instanceof Error
+                    ? cause.message
+                    : String(cause),
         });
     }
 };

package/dist/javascript/recovery/RecoveryFiles.js

@@ -1,8 +1,9 @@
 import { createHash } from "node:crypto";
 import { constants } from "node:fs";
-import { lstat, open, opendir, writeFile } from "node:fs/promises";
-import { isAbsolute, join } from "node:path";
+import { lstat, mkdir, open, opendir, writeFile } from "node:fs/promises";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { TextDecoder } from "node:util";
+import { normalizeArtifactPath } from "../../artifacts/ArtifactPaths.js";
 import { AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, AnalysisTimeoutError, } from "../../domain/analysisErrorCore.js";
 import { RECOVERY_LIMITS } from "./WakaruRelease.js";
 const OPERATION = "recover_javascript_sources";
@@ -49,13 +50,13 @@ export const readRecoveryFile = async (path, maximum, signal) => {
     const result = await scanRecoveryFile(path, maximum, (chunk) => chunks.push(chunk), signal);
     return Buffer.concat(chunks, result.bytes);
 };
-/** Snapshot one caller-selected UTF-8 script before invoking the engine. */
-export const snapshotRecoveryInput = async (path, snapshotPath, signal) => {
+/** Snapshot one script within the remaining operation-wide input budget. */
+const snapshotRecoveryInput = async (path, snapshotPath, relativePath, maximum, signal) => {
     if (!isAbsolute(path))
         throw recoveryInputFailure("path", "Select an absolute JavaScript file path");
     let bytes;
     try {
-        bytes = await readRecoveryFile(path, RECOVERY_LIMITS.inputBytes, signal);
+        bytes = await readRecoveryFile(path, maximum, signal);
         new TextDecoder("utf-8", { fatal: true }).decode(bytes);
     }
     catch (cause) {
@@ -63,14 +64,58 @@ export const snapshotRecoveryInput = async (path, snapshotPath, signal) => {
             throw cause;
         throw recoveryInputFailure("path", `Cannot snapshot UTF-8 JavaScript input ${path}: ${recoveryFailureMessage(cause)}`, cause);
     }
+    await mkdir(dirname(snapshotPath), { recursive: true, mode: 0o700 });
     await writeFile(snapshotPath, bytes, { flag: "wx", mode: 0o600 });
     return {
         path,
         snapshot_path: snapshotPath,
+        relative_path: relativePath,
         sha256: recoveryDigest(bytes),
         bytes: bytes.length,
     };
 };
+/** Preserve each selected file and its relative input layout without concatenation. */
+export const snapshotRecoveryInputs = async (paths, directory, signal) => {
+    let commonDirectory = dirname(resolve(paths[0]));
+    for (const path of paths) {
+        while (true) {
+            const fromCommon = relative(commonDirectory, resolve(path));
+            if (fromCommon !== ".." &&
+                !fromCommon.startsWith(`..${sep}`) &&
+                !isAbsolute(fromCommon))
+                break;
+            const parent = dirname(commonDirectory);
+            if (parent === commonDirectory)
+                throw recoveryInputFailure("additional_paths", "Selected files must share a filesystem root");
+            commonDirectory = parent;
+        }
+    }
+    const snapshots = [];
+    let remaining = RECOVERY_LIMITS.inputBytes;
+    for (const path of paths) {
+        const relativePath = paths.length === 1
+            ? "bundle.js"
+            : relative(commonDirectory, resolve(path)).split(sep).join("/");
+        try {
+            // Wakaru's multi-input public paths interpret backslashes as separators.
+            if (relativePath.includes("\\"))
+                throw new TypeError("Wakaru cannot preserve literal backslashes in input paths");
+            if (normalizeArtifactPath(relativePath) !== relativePath)
+                throw new TypeError("Input names must already use NFC Unicode spelling");
+        }
+        catch (cause) {
+            throw recoveryInputFailure("path", `Cannot preserve selected input path in published artifacts: ${path}: ${recoveryFailureMessage(cause)}`, cause);
+        }
+        const snapshot = await snapshotRecoveryInput(path, join(directory, relativePath), relativePath, remaining, signal);
+        snapshots.push(snapshot);
+        remaining -= snapshot.bytes;
+    }
+    // The selected-input tuple guarantees a primary snapshot.
+    const [primary, ...additional] = snapshots;
+    if (primary === undefined)
+        throw recoveryInputFailure("path", "Select a JavaScript input");
+    return [primary, ...additional];
+};
 /** Inventory staging without following symlinks or publishing special files. */
 export const inventoryRecoveryFiles = async (root, signal) => {
     const files = [];
@@ -128,6 +173,6 @@ export const checkRecoveryCancellation = (signal) => {
 /** Keep both tool invocations within one operation's execution budget. */
 export const checkRecoveryDeadline = (deadline, signal) => {
     checkRecoveryCancellation(signal);
-    if (Date.now() >= deadline)
+    if (performance.now() >= deadline)
         throw new AnalysisTimeoutError(OPERATION, RECOVERY_LIMITS.timeoutMs);
 };

package/dist/javascript/recovery/WakaruExecution.js

@@ -2,7 +2,7 @@ import { join } from "node:path";
 import { createAnalysisExecution, } from "../../application/AnalysisProvider.js";
 import { AnalysisCapabilityUnavailableError, AnalysisOutputError, } from "../../domain/analysisErrorCore.js";
 import { jsonValueSchema } from "../../domain/jsonValue.js";
-import { fingerprintRecoveryFile, inventoryRecoveryFiles, readRecoveryFile, recoveryDigest, } from "./RecoveryFiles.js";
+import { fingerprintRecoveryFile, inventoryRecoveryFiles, readRecoveryFile, } from "./RecoveryFiles.js";
 import { runWakaruCommand, } from "./WakaruCommand.js";
 import { parseWakaruReports } from "./WakaruReport.js";
 import { publishWakaruArtifacts } from "./WakaruPublication.js";
@@ -16,7 +16,7 @@ const MODES = {
 };
 /** Consume the pinned producer representation in a private workspace. */
 const executeWakaruRecovery = async (context) => {
-    const { root, input, source, engine, environment, launcher, options } = context;
+    const { root, input, sources, engine, environment, launcher, options } = context;
     const staging = join(root, "modules");
     const commandContext = {
         ...engine,
@@ -42,7 +42,7 @@ const executeWakaruRecovery = async (context) => {
         ...commandContext,
         staging,
         arguments: [
-            source.snapshot_path,
+            ...sources.map((source) => source.snapshot_path),
             `--unpack=${MODES[input.extraction_mode]}`,
             `--level=${input.rewrite_level}`,
             "--provenance",
@@ -53,34 +53,39 @@ const executeWakaruRecovery = async (context) => {
         ],
     });
     const files = await inventoryRecoveryFiles(staging, options?.signal);
-    const snapshot = await readRecoveryFile(source.snapshot_path, RECOVERY_LIMITS.inputBytes, options?.signal);
+    const snapshots = new Map();
+    for (const source of sources)
+        snapshots.set(source.snapshot_path, await readRecoveryFile(source.snapshot_path, source.bytes, options?.signal));
     const parsed = await parseWakaruReports({
         execution: run,
         provenancePath: join(staging, "provenance.json"),
-        snapshotPath: source.snapshot_path,
-        sourceBytes: snapshot,
+        snapshots,
         files,
     });
     return { version, admitted, run, parsed };
 };
 /** Publish validated recovery and retain exact source and engine bindings. */
 export const prepareWakaruExecution = async (context) => {
-    const { root, tree, input, source, engine, options } = context;
+    const { root, tree, input, sources, engine, options } = context;
+    const [source] = sources;
     const staging = join(root, "modules");
     const { version, admitted, run, parsed } = await executeWakaruRecovery(context);
     const result = await publishWakaruArtifacts({
         tree,
         staging,
         input,
-        source,
+        sources,
         engine,
         admitted,
         parsed,
         execution: run,
         ...(options?.signal === undefined ? {} : { signal: options.signal }),
     });
-    if (recoveryDigest(await readRecoveryFile(input.path, RECOVERY_LIMITS.inputBytes, options?.signal)) !== source.sha256)
-        throw new AnalysisOutputError(OPERATION, `Original input changed during recovery: ${input.path}`);
+    for (const selected of sources) {
+        const current = await fingerprintRecoveryFile(selected.path, RECOVERY_LIMITS.inputBytes, options?.signal);
+        if (current.sha256 !== selected.sha256 || current.bytes !== selected.bytes)
+            throw new AnalysisOutputError(OPERATION, `Original input changed during recovery: ${selected.path}`);
+    }
     if ((await fingerprintRecoveryFile(engine.command, RECOVERY_LIMITS.outputBytes, options?.signal)).sha256 !== engine.sha256)
         throw new AnalysisOutputError(OPERATION, "Configured engine bytes changed during recovery");
     return createAnalysisExecution(result, { ...WAKARU_PROVIDER_IDENTITY, version: admitted.version }, {
@@ -96,7 +101,10 @@ export const prepareWakaruExecution = async (context) => {
             format: "javascript",
         },
         locations: [
-            { kind: "artifact-path", path: source.path },
+            ...sources.map((selected) => ({
+                kind: "artifact-path",
+                path: selected.path,
+            })),
             ...result.modules.map((module) => ({
                 kind: "artifact-path",
                 path: module.artifact.path,

package/dist/javascript/recovery/WakaruProvider.js

@@ -1,16 +1,16 @@
 import { mkdir, mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import {} from "../../application/AnalysisProvider.js";
 import { SafeOutputTree } from "../../artifacts/SafeOutputTree.js";
 import { SafeOutputTreeCreationFailure } from "../../artifacts/SafeOutputTreeCreationFailure.js";
 import { AnalysisError } from "../../domain/analysisErrorBase.js";
-import { AnalysisOutputError } from "../../domain/analysisErrorCore.js";
+import { AnalysisCancelledError, AnalysisOutputError, } from "../../domain/analysisErrorCore.js";
+import { ArtifactReaderFailure } from "../../artifacts/ArtifactReader.js";
 import { javascriptRecoveryResultSchema, } from "../../domain/javascript/javascriptRecovery.js";
 import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
 import { ProviderCleanupError } from "../../domain/providerCleanupError.js";
 import { err, ok } from "../../domain/result.js";
-import { checkRecoveryCancellation, checkRecoveryDeadline, recoveryFailureMessage, recoveryInputFailure, snapshotRecoveryInput, } from "./RecoveryFiles.js";
+import { checkRecoveryCancellation, checkRecoveryDeadline, recoveryFailureMessage, recoveryInputFailure, snapshotRecoveryInputs, } from "./RecoveryFiles.js";
 import { resolveWakaruCommand, WakaruCleanupFailure, } from "./WakaruCommand.js";
 import { prepareWakaruExecution } from "./WakaruExecution.js";
 import { RECOVERY_LIMITS } from "./WakaruRelease.js";
@@ -27,7 +27,7 @@ export class WakaruProvider {
         this.environment = environment;
         this.launcher = launcher;
     }
-    /** Recover one script using validated upstream reports and verified output bytes. */
+    /** Recover selected scripts using validated reports and verified output bytes. */
     recover(input, options) {
         if (this.#closing)
             return Promise.resolve(err(new ProviderCleanupError("wakaru", [], { reason: "Provider is closing" }, { operation: OPERATION })));
@@ -45,7 +45,7 @@ export class WakaruProvider {
         let tree;
         let failed;
         let execution;
-        const deadline = Date.now() + RECOVERY_LIMITS.timeoutMs;
+        const deadline = performance.now() + RECOVERY_LIMITS.timeoutMs;
         try {
             checkRecoveryCancellation(options?.signal);
             const engine = await resolveWakaruCommand(this.environment);
@@ -54,7 +54,7 @@ export class WakaruProvider {
             const staging = join(root, "modules");
             await mkdir(inputs, { mode: 0o700 });
             await mkdir(staging, { mode: 0o700 });
-            const source = await snapshotRecoveryInput(input.path, join(inputs, "bundle.js"), options?.signal);
+            const sources = await snapshotRecoveryInputs([input.path, ...(input.additional_paths ?? [])], inputs, options?.signal);
             try {
                 tree = await SafeOutputTree.create(input.output_directory);
             }
@@ -67,7 +67,7 @@ export class WakaruProvider {
                 root,
                 tree,
                 input,
-                source,
+                sources,
                 engine,
                 environment: this.environment,
                 launcher: this.launcher,
@@ -78,13 +78,16 @@ export class WakaruProvider {
             await rm(root, { recursive: true, force: true });
             root = undefined;
             checkRecoveryDeadline(deadline, options?.signal);
-            await tree.commit();
+            await tree.commit(options?.signal);
         }
         catch (cause) {
             failed = { cause };
         }
         if (failed !== undefined) {
-            const failure = failed.cause;
+            const failure = failed.cause instanceof ArtifactReaderFailure &&
+                failed.cause.reason === "cancelled"
+                ? new AnalysisCancelledError(OPERATION, { cause: failed.cause })
+                : failed.cause;
             const residuals = [];
             const cleanupFailures = [];
             const cleanupOwner = failure instanceof WakaruCleanupFailure

package/dist/javascript/recovery/WakaruPublication.js

@@ -2,12 +2,12 @@ import { join } from "node:path";
 import { Readable } from "node:stream";
 import { AnalysisOutputError } from "../../domain/analysisErrorCore.js";
 import { javascriptRecoveryResultSchema, } from "../../domain/javascript/javascriptRecovery.js";
-import { readRecoveryFile, recoveryDigest } from "./RecoveryFiles.js";
+import { readRecoveryFile, recoveryDigest, } from "./RecoveryFiles.js";
 import { recoveryRanges, validateRecoverySourceMap, } from "./WakaruReport.js";
 import { RECOVERY_LIMITATIONS, RECOVERY_LIMITS, WAKARU_RELEASE, } from "./WakaruRelease.js";
 /** Write validated artifacts to one exclusively owned, rollback-capable tree. */
 export const publishWakaruArtifacts = async (context) => {
-    const { tree, source, parsed, staging, signal } = context;
+    const { tree, sources, parsed, staging, signal } = context;
     const write = async (path, bytes) => {
         const sha256 = recoveryDigest(bytes);
         const file = await tree.write(path, Readable.from([bytes]), { sha256, bytes: bytes.byteLength }, signal);
@@ -17,10 +17,18 @@ export const publishWakaruArtifacts = async (context) => {
             bytes: file.bytesWritten,
         };
     };
-    const snapshot = await readRecoveryFile(source.snapshot_path, RECOVERY_LIMITS.inputBytes, signal);
-    if (recoveryDigest(snapshot) !== source.sha256)
-        throw new AnalysisOutputError("recover_javascript_sources", "The input snapshot changed during recovery");
-    const publishedCopy = await write("inputs/bundle.js", snapshot);
+    const publishedSources = [];
+    for (const selected of sources) {
+        const { relative_path, ...source } = selected;
+        const snapshot = await readRecoveryFile(source.snapshot_path, source.bytes, signal);
+        if (recoveryDigest(snapshot) !== source.sha256)
+            throw new AnalysisOutputError("recover_javascript_sources", `The input snapshot changed during recovery: ${source.path}`);
+        publishedSources.push({
+            ...source,
+            published_copy: await write(`inputs/${relative_path}`, snapshot),
+        });
+    }
+    const [source, ...additionalSources] = publishedSources;
     const modules = [];
     for (const module of parsed.report.modules) {
         modules.push(await publishModule(context, module, write));
@@ -28,7 +36,10 @@ export const publishWakaruArtifacts = async (context) => {
     const report = await write("reports/stdout.json", Buffer.from(context.execution.stdout));
     const provenance = await write("reports/provenance.json", await readRecoveryFile(join(staging, "provenance.json"), RECOVERY_LIMITS.reportBytes, signal));
     const details = {
-        source: { ...source, published_copy: publishedCopy },
+        source,
+        ...(additionalSources.length === 0
+            ? {}
+            : { additional_sources: additionalSources }),
         engine: {
             id: "wakaru",
             version: context.admitted.version,
@@ -78,7 +89,7 @@ export const publishWakaruArtifacts = async (context) => {
     return javascriptRecoveryResultSchema.parse({ ...details, manifest });
 };
 const publishModule = async (context, module, write) => {
-    const { staging, source, parsed, signal } = context;
+    const { staging, sources, parsed, signal } = context;
     const artifact = await write(`modules/${module.filename}`, await readRecoveryFile(join(staging, module.filename), RECOVERY_LIMITS.outputBytes, signal));
     const mapPath = join(staging, `${module.filename}.map`);
     let sourceMap = null;
@@ -94,6 +105,9 @@ const publishModule = async (context, module, write) => {
     const provenance = parsed.provenance.modules[module.filename];
     if (provenance === undefined)
         throw new AnalysisOutputError("recover_javascript_sources", `Missing module provenance: ${module.filename}`);
+    const origin = sources.find((source) => source.snapshot_path === provenance.input);
+    if (origin === undefined)
+        throw new AnalysisOutputError("recover_javascript_sources", `Unselected module provenance input: ${provenance.input}`);
     return {
         reported_filename: module.filename,
         reported_status: module.status,
@@ -101,8 +115,8 @@ const publishModule = async (context, module, write) => {
         source_map: sourceMap,
         provenance: {
             reported_input: provenance.input,
-            original_path: source.path,
-            original_sha256: source.sha256,
+            original_path: origin.path,
+            original_sha256: origin.sha256,
             extraction: provenance.extraction,
             byte_ranges: recoveryRanges(provenance.ranges),
             context_byte_ranges: recoveryRanges(provenance.context_ranges ?? []),

package/dist/javascript/recovery/WakaruRelease.js

@@ -32,5 +32,5 @@ export const RECOVERY_LIMITATIONS = [
     "Extraction ranges refer to half-open UTF-8 byte offsets in the original input, not rewritten line positions or whole-bundle coverage.",
     "Emitted source maps are preserved as reported by the engine; their mapping accuracy is not independently established.",
     "Inspection mode may produce non-executable regions. No input or recovered application code is executed.",
-    "Linux adapter: one worker, 1 GiB address-space ceiling, 120-second deadline, 64 MiB input, 128 MiB output, 10000 output entries and 8 MiB per diagnostic/report stream. Resource limits are per operation, not aggregate host containment.",
+    "Linux adapter: one worker, 1 GiB address-space ceiling, 120-second deadline, 64 MiB total input, 128 MiB output, 10000 output entries and 8 MiB per diagnostic/report stream. Resource limits are per operation, not aggregate host containment.",
 ];

package/dist/javascript/recovery/WakaruReport.js

@@ -82,7 +82,7 @@ export const parseWakaruReports = async (context) => {
     }
 };
 const validateModuleSet = (report, provenance, context) => {
-    const { files, snapshotPath, sourceBytes } = context;
+    const { files, snapshots } = context;
     const registry = new ArtifactPathRegistry();
     const expected = new Set(["provenance.json"]);
     const observed = new Set(files.map((file) => file.relativePath));
@@ -97,7 +97,8 @@ const validateModuleSet = (report, provenance, context) => {
         if (observed.has(`${path}.map`))
             expected.add(`${path}.map`);
         const entry = provenance.modules[path];
-        if (entry === undefined || entry.input !== snapshotPath)
+        const sourceBytes = entry === undefined ? undefined : snapshots.get(entry.input);
+        if (entry === undefined || sourceBytes === undefined)
             throw new TypeError(`Module provenance does not bind the selected input snapshot: ${path}`);
         validateRanges([...entry.ranges, ...(entry.context_ranges ?? [])], sourceBytes, path);
     }