rea-agents 6.4.0 → 6.7.0

package/dist/domain/javascript/javascriptPackageImportAliases.js

@@ -0,0 +1,58 @@
+/**
+ * Exact package-private import-alias lookup. Node resolves `#` specifiers
+ * against the importer's enclosing package `imports` map; this module owns the
+ * specifier and exact-key rules. Condition, array, and null target selection
+ * stay with the shared package-target machinery. Wildcard keys, recursive
+ * `#` targets, and external-package targets remain explicit unknowns.
+ */
+/**
+ * Classify a `#` module specifier before any package-scope walk.
+ * `#` and names ending in `/` are invalid. Other literal keys, including
+ * `#/…`, participate in exact lookup; wildcard expansion remains unsupported.
+ */
+export const classifyPackageImportSpecifier = (specifier) => {
+    if (specifier === "#" || specifier.endsWith("/"))
+        return { kind: "invalid" };
+    if (specifier.includes("*"))
+        return { kind: "pattern" };
+    return { kind: "exact", key: specifier };
+};
+/** True when an `imports` key is a pattern rather than an exact alias. */
+export const isPackageImportPatternKey = (key) => key.includes("*") || key.endsWith("/");
+/**
+ * Look up one exact `#` key in a package `imports` value.
+ * A missing exact key is reported as missing when every declared key is also
+ * exact; if the map contains pattern keys, the miss stays pattern-unresolved
+ * rather than claiming the specifier is undefined.
+ */
+export const lookupExactPackageImport = (imports, key) => {
+    if (typeof imports !== "object" || imports === null || Array.isArray(imports))
+        return { kind: "undefined-map" };
+    const declared = Object.keys(imports);
+    if (Object.hasOwn(imports, key) && !isPackageImportPatternKey(key))
+        return {
+            kind: "found",
+            target: Reflect.get(imports, key),
+            declared,
+        };
+    return declared.some(isPackageImportPatternKey)
+        ? { kind: "pattern-unresolved", declared }
+        : { kind: "missing-key", declared };
+};
+/**
+ * Classify a selected string import target. Only package-local `./` paths are
+ * resolved as files; recursive `#` aliases and bare packages stay unknown.
+ * Parent-relative, absolute, and URL targets are invalid, allowing array
+ * selection to skip them before choosing a package-local fallback.
+ */
+export const classifyPackageImportTargetString = (target) => {
+    if (target.startsWith("./"))
+        return { kind: "relative", target };
+    if (target.startsWith("../") ||
+        target.startsWith("/") ||
+        URL.canParse(target))
+        return { kind: "invalid", target };
+    if (target.startsWith("#"))
+        return { kind: "recursive", target };
+    return { kind: "external-package", target };
+};

package/dist/domain/javascript/javascriptRecovery.js

@@ -2,9 +2,14 @@ import { z } from "zod";
 import { digestSchema } from "../digests.js";
 import { analyzeJavaScriptApplicationInputSchema } from "./javascriptApplicationAnalysis.js";
 import { localPathStringSchema } from "../localPath.js";
-/** Recover derived readable modules from one explicitly selected local script. */
+/** Recover derived readable modules from explicitly selected local scripts. */
 export const javascriptRecoveryInputSchema = z.strictObject({
     path: localPathStringSchema.describe("Absolute path to a UTF-8 JavaScript file; never executed"),
+    additional_paths: z
+        .array(localPathStringSchema)
+        .max(16)
+        .optional()
+        .describe("Additional absolute UTF-8 JavaScript files recovered together with path; each is snapshotted separately so imports can resolve across related chunks. All inputs share a 64 MiB total budget"),
     output_directory: localPathStringSchema.describe("Absolute absent output directory; parent must exist"),
     extraction_mode: z
         .enum(["structural", "heuristic", "inspection"])
@@ -24,12 +29,14 @@ const rangeSchema = z.strictObject({
     start: z.number().int().nonnegative(),
     end: z.number().int().nonnegative(),
 });
+const sourceSchema = fileSchema.extend({
+    snapshot_path: z.string().min(1),
+    published_copy: fileSchema,
+});
 /** Complete published artifacts and exact producer provenance for source recovery. */
 export const javascriptRecoveryResultSchema = z.strictObject({
-    source: fileSchema.extend({
-        snapshot_path: z.string().min(1),
-        published_copy: fileSchema,
-    }),
+    source: sourceSchema,
+    additional_sources: z.array(sourceSchema).optional(),
     engine: z.strictObject({
         id: z.string().min(1),
         version: z.string().min(1),

package/dist/domain/javascript/javascriptRpcEndpoints.js

@@ -1,6 +1,7 @@
 import * as t from "@babel/types";
-import { unwrapJavaScriptExpression, semanticStaticPropertyKey, } from "./javascriptAstValues.js";
+import { unwrapJavaScriptExpression, semanticStaticPropertyKey, semanticFinalObjectStringProperty, } from "./javascriptAstValues.js";
 import { calleeName } from "./javascriptStaticAnalysisHelpers.js";
+import { createJavaScriptGraphqlScan } from "./javascriptGraphqlOperations.js";
 // tRPC proxies preserve router and procedure names as property names, so they
 // survive identifier minification. Method names follow @trpc/react-query and
 // @trpc/tanstack-react-query 11.19 documentation; cache-key helpers such as
@@ -88,72 +89,6 @@ const objectKeys = (node) => t.isObjectExpression(node)
         return key === null ? [] : [key];
     })
     : [];
-const objectStringProperty = (node, key) => {
-    for (const property of node.properties)
-        if (t.isObjectProperty(property) &&
-            semanticStaticPropertyKey(property.key, property.computed) === key &&
-            t.isStringLiteral(property.value))
-            return property.value.value;
-    return undefined;
-};
-const objectProperty = (node, key) => {
-    for (const property of node.properties)
-        if (t.isObjectProperty(property) &&
-            semanticStaticPropertyKey(property.key, property.computed) === key)
-            return property.value;
-    return undefined;
-};
-const GRAPHQL_OPERATION_TYPES = new Set([
-    "query",
-    "mutation",
-    "subscription",
-]);
-// A named GraphQL operation header (GraphQL October 2021, OperationDefinition):
-// type, name, then variable definitions starting with `$`, a directive, or a
-// selection set starting with a field name.
-const GRAPHQL_OPERATION_HEADER = /^(query|mutation|subscription)[\s,]+([_A-Za-z][_0-9A-Za-z]*)[\s,]*(?:\([\s,]*\$|@[_A-Za-z]|\{[\s,]*[_A-Za-z])/u;
-const isGraphqlIgnoredCharacter = (character) => character === "," || character === "" || /\s/u.test(character);
-/** Recover a named operation from GraphQL document text. */
-export const graphqlOperationFromText = (text) => {
-    // Skip GraphQL ignored tokens: whitespace, commas, BOM and # comments.
-    const limit = text.length;
-    let index = 0;
-    while (index < limit) {
-        const character = text.charAt(index);
-        if (isGraphqlIgnoredCharacter(character))
-            index += 1;
-        else if (character === "#") {
-            while (index < limit && !/[\n\r]/u.test(text.charAt(index)))
-                index += 1;
-        }
-        else
-            break;
-    }
-    if (index >= limit)
-        return undefined;
-    const header = GRAPHQL_OPERATION_HEADER.exec(text.slice(index));
-    const type = header?.[1];
-    const name = header?.[2];
-    return type === undefined || name === undefined
-        ? undefined
-        : { value: name, mechanism: `graphql:${type}` };
-};
-/** Recover a named operation from a precompiled GraphQL document object. */
-export const graphqlOperationFromDocumentNode = (node) => {
-    if (objectStringProperty(node, "kind") !== "OperationDefinition")
-        return undefined;
-    const type = objectStringProperty(node, "operation");
-    if (type === undefined || !GRAPHQL_OPERATION_TYPES.has(type))
-        return undefined;
-    const name = objectProperty(node, "name");
-    if (!t.isObjectExpression(name) ||
-        objectStringProperty(name, "kind") !== "Name")
-        return undefined;
-    const value = objectStringProperty(name, "value");
-    return value === undefined
-        ? undefined
-        : { value, mechanism: `graphql:${type}` };
-};
 /** Bundlers use `(0, imported.factory)` to call an import without a receiver. */
 const rpcFactoryName = (callee) => {
     let current = unwrapJavaScriptExpression(callee).node;
@@ -180,7 +115,7 @@ const trpcLinkUrl = (node) => {
     const options = node.arguments[0];
     if (!t.isObjectExpression(options))
         return undefined;
-    const url = objectStringProperty(options, "url");
+    const url = semanticFinalObjectStringProperty(options, "url");
     return url === undefined
         ? undefined
         : { value: url, mechanism: `trpc:link:${factory}` };
@@ -192,12 +127,10 @@ const trpcLinkUrl = (node) => {
  * marker and a tRPC observer argument. `this` roots, browser globals and RTK
  * Query `endpoints` chains are never procedures.
  */
-export const createJavaScriptRpcScan = (source, clientRoots) => {
+export const createJavaScriptRpcScan = (source, clientRoots, index) => {
     let marker;
     const hasMarker = () => (marker ??= TRPC_SOURCE_MARKERS.some((value) => source.includes(value)));
-    // graphql-tag documents retain their source text in loc.source.body; that
-    // text repeats the OperationDefinition already recovered from the object.
-    const documentSourceBodies = new WeakSet();
+    const graphql = createJavaScriptGraphqlScan(index);
     const procedure = (node) => {
         const path = memberPath(node.callee);
         if (path === undefined || t.isThisExpression(path.root))
@@ -227,27 +160,8 @@ export const createJavaScriptRpcScan = (source, clientRoots) => {
         inspect: (node) => {
             if (t.isCallExpression(node) || t.isOptionalCallExpression(node))
                 return trpcLinkUrl(node) ?? procedure(node);
-            if (t.isObjectExpression(node)) {
-                const body = objectProperty(node, "body");
-                if (t.isStringLiteral(body) &&
-                    objectProperty(node, "locationOffset") !== undefined) {
-                    documentSourceBodies.add(body);
-                    return undefined;
-                }
-                return graphqlOperationFromDocumentNode(node);
-            }
-            if (t.isStringLiteral(node))
-                return documentSourceBodies.has(node)
-                    ? undefined
-                    : graphqlOperationFromText(node.value);
-            if (t.isTemplateLiteral(node)) {
-                // A template recovered without a cooked value stays dynamic.
-                const cooked = node.quasis[0]?.value.cooked;
-                return cooked === undefined || cooked === null
-                    ? undefined
-                    : graphqlOperationFromText(cooked);
-            }
-            return undefined;
+            return graphql.inspect(node);
         },
+        finish: graphql.finish,
     };
 };

package/dist/domain/javascript/javascriptRuntimeLoadState.js

@@ -14,11 +14,19 @@ export const classifyStaticLoadStates = (layers, runtimeEntities, matches, optio
 const classifyLayer = (layer, runtimeEntities, matches, options) => {
     const nodes = layer.graph.nodes.filter(isLoadStateNode);
     const direct = new Map();
+    const ambiguous = new Set();
+    const incomplete = new Set();
     for (const match of matches)
         if (match.status === "matched" &&
             match.static_layer_id === layer.layerId &&
             match.static_node_id !== null)
             append(direct, match.static_node_id, match.runtime_node_id);
+        else if (match.status === "ambiguous" || match.status === "unknown") {
+            const uncertain = match.status === "ambiguous" ? ambiguous : incomplete;
+            for (const candidate of match.candidate_static_nodes)
+                if (candidate.static_layer_id === layer.layerId)
+                    uncertain.add(candidate.static_node_id);
+        }
     const resident = residentNodes(layer, new Set(direct.keys()));
     const runtimeScope = createStaticRuntimeScope(layer, runtimeEntities);
     const scopedEntities = runtimeEntities.filter((entity) => mappedRuntimePaths(layer, entity).length > 0);
@@ -40,6 +48,14 @@ const classifyLayer = (layer, runtimeEntities, matches, options) => {
                 runtimeNodeIds: [],
                 reason: "containing-asset-was-loaded",
             });
+        if (incomplete.has(node.node_id) || ambiguous.has(node.node_id))
+            return state(layer, node, {
+                status: "unknown",
+                runtimeNodeIds: [],
+                reason: incomplete.has(node.node_id)
+                    ? "static-or-runtime-coverage-incomplete"
+                    : "ambiguous-runtime-candidate",
+            });
         const nodeWithinScope = staticNodeWithinRuntimeScope(node, runtimeScope);
         if (layerComplete && nodeWithinScope)
             return state(layer, node, {

package/dist/domain/javascript/javascriptRuntimeObservation.js

@@ -62,7 +62,10 @@ export const javascriptRuntimeTargetLocationSchema = z.union([
 const javascriptRuntimeTargetSchema = z.strictObject({
     target_id: z.string().min(1),
     protocol_type: z.string().min(1),
-    attached: z.boolean(),
+    attached: z
+        .boolean()
+        .nullable()
+        .describe("Discovery-reported debugger attachment state; null means unknown"),
     location: javascriptRuntimeTargetLocationSchema,
 });
 /** Complete V8 Inspector target inventory exposed by the selected endpoint. */

package/dist/domain/javascript/javascriptRuntimeReconciliationCaptureParsing.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { browserAllowedOriginsSchema, browserEndpointSchema, } from "../browserObservation.js";
+import { browserAllowedOriginsSchema, browserEndpointSchema, recordedBrowserObservationEndpointSchema, } from "../browserObservation.js";
 import { webPageInspectionSchema, } from "../browserObservationSchemas.js";
 import { classifyBrowserCompleteness, } from "../browserCompleteness.js";
 import { electronPageInspectionSchema, } from "./electronObservation.js";
@@ -142,8 +142,10 @@ const normalizeV8Inspection = (result) => ({
         })),
     },
     workers: [],
+    // Route exclusions as CdpCaptureCompleteness does: denied locations are
+    // policy filtered, while invalid protocol values leave scripts unavailable.
     completeness: classifyBrowserCompleteness({
-        policyFilteredSections: new Set(excludedV8Scripts(result) > 0 ? ["scripts"] : []),
+        policyFilteredSections: new Set(result.scripts.excluded.unsupported_location > 0 ? ["scripts"] : []),
         attachLimitedSections: new Set([
             "frames",
             "scripts",
@@ -151,16 +153,15 @@ const normalizeV8Inspection = (result) => ({
             "workers",
         ]),
         truncatedSections: new Set(result.capture.truncated ? ["scripts"] : []),
-        unavailableSections: new Set(["frames", "script_sources", "workers"]),
-        excluded: excludedV8Scripts(result) === 0
-            ? []
-            : [
-                {
-                    section: "scripts",
-                    reason: "out_of_target_scope",
-                    count: excludedV8Scripts(result),
-                },
-            ],
+        unavailableSections: new Set([
+            "frames",
+            "script_sources",
+            "workers",
+            ...(result.scripts.excluded.invalid_protocol_value > 0
+                ? ["scripts"]
+                : []),
+        ]),
+        excluded: v8ScriptExclusions(result),
         droppedEvents: {
             scripts: result.capture.events_dropped,
             network_requests: 0,
@@ -181,16 +182,41 @@ const runtimeLocation = (location) => {
         return { url: location.sanitized_url };
     return { url: location.specifier };
 };
-const excludedV8Scripts = (result) => Object.values(result.scripts.excluded).reduce((total, count) => total + count, 0);
+const v8ScriptExclusions = (result) => {
+    const { unsupported_location, invalid_protocol_value } = result.scripts.excluded;
+    return [
+        ...(unsupported_location > 0
+            ? [
+                {
+                    section: "scripts",
+                    reason: "out_of_target_scope",
+                    count: unsupported_location,
+                },
+            ]
+            : []),
+        ...(invalid_protocol_value > 0
+            ? [
+                {
+                    section: "scripts",
+                    reason: "invalid_protocol_value",
+                    count: invalid_protocol_value,
+                },
+            ]
+            : []),
+    ];
+};
 const assertRuntimeParameters = (evidence, expected, path) => {
     const common = {
         target_id: z.string().trim().min(1),
-        cdp_endpoint: browserEndpointSchema,
         include_script_sources: z.boolean(),
     };
     if (expected.kind === "browser") {
         const parameters = parseAtPath((value) => z
-            .object({ ...common, allowed_origins: browserAllowedOriginsSchema })
+            .object({
+            ...common,
+            cdp_endpoint: recordedBrowserObservationEndpointSchema,
+            allowed_origins: browserAllowedOriginsSchema,
+        })
             .passthrough()
             .parse(value), evidence.parameters, [...path, "parameters"]);
         if (parameters.target_id !== expected.targetId)
@@ -201,7 +227,10 @@ const assertRuntimeParameters = (evidence, expected, path) => {
             throw invalidInput([...path, "parameters", "include_script_sources"], "Runtime Evidence contains source without source-capture selection");
         return;
     }
-    const parameters = parseAtPath((value) => z.object(common).passthrough().parse(value), evidence.parameters, [...path, "parameters"]);
+    const parameters = parseAtPath((value) => z
+        .object({ ...common, cdp_endpoint: browserEndpointSchema })
+        .passthrough()
+        .parse(value), evidence.parameters, [...path, "parameters"]);
     if (parameters.target_id !== expected.targetId)
         throw invalidInput([...path, "parameters", "target_id"], "Runtime Evidence target disagrees with its captured result");
     if (expected.sourceIncluded && !parameters.include_script_sources)

package/dist/domain/javascript/javascriptRuntimeReconciliationMatching.js

@@ -23,51 +23,8 @@ const reconcileEntity = (entity, index, layers) => {
             candidates: [],
         });
     const locations = candidatesWithLocation(entity, index, layers);
-    if (entity.sourceSha256 !== null) {
-        const content = index.byCategoryDigest.get(categoryDigestKey(entity.staticKind, entity.sourceSha256)) ?? [];
-        const locatedKeys = new Set(locations.map(({ candidate }) => candidateKey(candidate)));
-        const combined = content.filter((candidate) => locatedKeys.has(candidateKey(candidate)));
-        const combinedCandidate = combined.at(0);
-        if (combined.length === 1 && combinedCandidate !== undefined)
-            return matched(entity, combinedCandidate, {
-                basis: "content-and-location",
-                confidence: "high",
-                reason: "content-and-location-match",
-            });
-        const contentCandidate = content.at(0);
-        if (content.length === 1 && contentCandidate !== undefined) {
-            const candidate = contentCandidate;
-            const digestBasis = candidate.digests.find(({ sha256 }) => sha256 === entity.sourceSha256)?.basis;
-            return matched(entity, candidate, {
-                basis: digestBasis ?? "content-sha256",
-                confidence: "high",
-                reason: "unique-content-match",
-            });
-        }
-        if (content.length > 1)
-            return unresolved(entity, {
-                status: "ambiguous",
-                basis: "none",
-                confidence: "unknown",
-                reason: "ambiguous-static-candidates",
-                candidates: content,
-            });
-        if (locations.length > 0)
-            return unresolved(entity, {
-                status: "unmatched",
-                basis: strongestLocationBasis(locations),
-                confidence: "high",
-                reason: "captured-content-disagrees-with-static-location",
-                candidates: locations.map(({ candidate }) => candidate),
-            });
-        return unresolved(entity, {
-            status: "unmatched",
-            basis: "none",
-            confidence: "high",
-            reason: "no-static-content-match",
-            candidates: [],
-        });
-    }
+    if (entity.sourceSha256 !== null)
+        return reconcileCapturedSource(entity, entity.sourceSha256, locations, index);
     const location = locations.at(0);
     if (locations.length === 1 && location !== undefined) {
         const located = location;
@@ -96,11 +53,68 @@ const reconcileEntity = (entity, index, layers) => {
         candidates: [],
     });
 };
+const reconcileCapturedSource = (entity, sourceSha256, locations, index) => {
+    // A known mapped candidate owns the comparison. Unrelated equal bytes cannot
+    // repair a disagreement or establish the content of a candidate without a digest.
+    const content = locations.length > 0
+        ? locations
+            .map(({ candidate }) => candidate)
+            .filter(({ digests }) => digests.some(({ sha256 }) => sha256 === sourceSha256))
+        : (index.byCategoryDigest.get(categoryDigestKey(entity.staticKind, sourceSha256)) ?? []);
+    const candidate = content.at(0);
+    if (content.length === 1 && candidate !== undefined)
+        return matched(entity, candidate, {
+            basis: locations.length > 0
+                ? "content-and-location"
+                : (candidate.digests.find(({ sha256 }) => sha256 === sourceSha256)
+                    ?.basis ?? "content-sha256"),
+            confidence: "high",
+            reason: locations.length > 0
+                ? "content-and-location-match"
+                : "unique-content-match",
+        });
+    if (content.length > 1)
+        return unresolved(entity, {
+            status: "ambiguous",
+            basis: locations.length > 0 ? "content-and-location" : "none",
+            confidence: "unknown",
+            reason: "ambiguous-static-candidates",
+            candidates: content,
+        });
+    if (locations.length > 0) {
+        const digestUnavailable = locations.some(({ candidate: { digests } }) => digests.length === 0);
+        return unresolved(entity, {
+            status: digestUnavailable ? "unknown" : "unmatched",
+            basis: strongestLocationBasis(locations),
+            confidence: digestUnavailable ? "unknown" : "high",
+            reason: digestUnavailable
+                ? "static-or-runtime-coverage-incomplete"
+                : "captured-content-disagrees-with-static-location",
+            candidates: locations.map(({ candidate: located }) => located),
+        });
+    }
+    return unresolved(entity, {
+        status: "unmatched",
+        basis: "none",
+        confidence: "high",
+        reason: "no-static-content-match",
+        candidates: [],
+    });
+};
 const candidatesWithLocation = (entity, index, layers) => {
     const located = new Map();
     for (const layer of layers)
         for (const mapping of mappedRuntimePaths(layer, entity))
-            for (const candidate of index.byLayerCategoryPath.get(layerCategoryPathKey(layer.layerId, entity.staticKind, mapping.path)) ?? []) {
+            for (const candidate of [
+                ...(index.byLayerCategoryPath.get(layerCategoryPathKey(layer.layerId, entity.staticKind, mapping.path)) ?? []),
+                ...(mapping.fileStyle === null || mapping.nativeRelativePath === null
+                    ? []
+                    : (index.byNativeDeclarationPath.get(`${mapping.fileStyle}\0${layerCategoryPathKey(layer.layerId, entity.staticKind, mapping.nativeRelativePath)}`) ?? [])
+                        .filter(({ sourcePath }) => mapping.artifactPrefix === "" ||
+                        (sourcePath !== null &&
+                            sourcePath.startsWith(`${mapping.artifactPrefix}/`)))
+                        .map(({ candidate }) => candidate)),
+            ]) {
                 const key = candidateKey(candidate);
                 if (!located.has(key))
                     located.set(key, { candidate, mapping });
@@ -110,13 +124,17 @@ const candidatesWithLocation = (entity, index, layers) => {
 const indexCandidates = (candidates) => {
     const byCategoryDigest = new Map();
     const byLayerCategoryPath = new Map();
+    const byNativeDeclarationPath = new Map();
     for (const candidate of candidates) {
         for (const { sha256 } of candidate.digests)
             appendIndex(byCategoryDigest, categoryDigestKey(candidate.category, sha256), candidate);
         for (const path of candidate.paths)
             appendIndex(byLayerCategoryPath, layerCategoryPathKey(candidate.layer.layerId, candidate.category, path), candidate);
+        for (const style of ["posix", "windows"])
+            for (const { path, sourcePath } of candidate.nativeDeclarationPaths[style])
+                appendIndex(byNativeDeclarationPath, `${style}\0${layerCategoryPathKey(candidate.layer.layerId, candidate.category, path)}`, { candidate, sourcePath });
     }
-    return { byCategoryDigest, byLayerCategoryPath };
+    return { byCategoryDigest, byLayerCategoryPath, byNativeDeclarationPath };
 };
 const appendIndex = (index, key, candidate) => {
     const values = index.get(key);

package/dist/domain/javascript/javascriptRuntimeReconciliationResult.js

@@ -1,4 +1,3 @@
-import {} from "./javascriptApplicationGraph.js";
 import { digestCanonicalValue } from "../canonicalDigest.js";
 import { uniqueSorted } from "../canonicalOrdering.js";
 import { javascriptRuntimeReconciliationResultSchema, } from "./javascriptRuntimeReconciliationSchemas.js";

package/dist/domain/javascript/javascriptRuntimeReconciliationSchemas.js

@@ -1,18 +1,19 @@
 import { z } from "zod";
 import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
+import { logicalPathEscapesRoot } from "../artifactIdentity.js";
 import { evidenceSchema } from "../evidence.js";
 import { javascriptRuntimeUnresolvedLocationSchema } from "./javascriptRuntimeObservation.js";
 import { javascriptApplicationGraphSchema } from "./javascriptApplicationGraph.js";
 import { digestSchema } from "../digests.js";
 import { prefixedDigestSchema } from "../digests.js";
+import { urlDeclaresQueryOrFragment } from "../urlComponents.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const nodeIdSchema = prefixedDigestSchema("jag_node");
 const boundedTextSchema = z.string().min(1);
 const safePrefixSchema = z
     .string()
     .refine((value) => value === "" ||
-    (!value.startsWith("/") &&
-        !value.includes("\\") &&
+    (!logicalPathEscapesRoot(value) &&
         value.split("/").every((part) => !["", ".", ".."].includes(part))), "Artifact prefix must be empty or a safe relative POSIX path");
 const runtimeFileMappingSchema = z.strictObject({
     kind: z.literal("file-root"),
@@ -41,8 +42,7 @@ const normalizeRuntimeUrlPrefix = (value) => {
     if (!["http:", "https:"].includes(url.protocol) ||
         url.username !== "" ||
         url.password !== "" ||
-        url.search !== "" ||
-        url.hash !== "")
+        urlDeclaresQueryOrFragment(url))
         return null;
     if (!url.pathname.endsWith("/"))
         url.pathname += "/";
@@ -191,6 +191,7 @@ const staticLoadStateSchema = z.strictObject({
         "not-observed-in-bounded-capture",
         "layer-outside-runtime-scope",
         "static-or-runtime-coverage-incomplete",
+        "ambiguous-runtime-candidate",
     ]),
 });
 /** Deterministic static/passive-runtime reconciliation with a combined JAG. */