REA / Joplin Markdown export investigation
Date: 2026-10-23

Target: installed Joplin Desktop 3.7.21 Windows program package, resources/app.asar.
Archive SHA-256: 9f793336c679ea3214542587ca42abc77e82184327e3f7677f22d47d8ae23506
Version was read from package.json. The original installed archive, source bundle and selected AST bytes were inspected; no application profile, notes, credentials or settings were opened.

Environment: Windows x64, Node.js 24.15.0, REA 6.7.0. @electron/asar 4.3.1 read archive member bytes. The Babel parser shipped with the local REA dependency tree selected AST boundaries. The analyst chose the named class regions; REA did not automatically recover the entire application.

Actual initial CLI requests (installation path abbreviated):
rea inspect-artifact "[Joplin resources]/app.asar" --format json
rea analyze-javascript-application "[Joplin resources]/app.asar" --source-path InteropServiceHelper.js --source-path commands/exportNotes.js --source-path commands/exportFolders.js --max-heap-mb 2048 --format json

The archive analysis parsed three selected JavaScript files with no parse failures or integrity contradictions. Import and semantic locations linked the command wrappers to InteropService.export. The implementation is bundled rather than available as a loose library module. The shipped main-html.bundle.js.map names InteropService_Exporter_Md.ts; the JavaScript class carries that name in its static naming block.

Bounded bundle inspection:
Two unchanged AST variable-declarator regions were selected from main-html.bundle.js. source-manifest.json binds character offsets, UTF-8 byte offsets, lengths and region hashes to the original bundle and archive. The source map was a locating aid, not a source-content recovery claim.

rea analyze-javascript-application [workspace]/.qa/joplin/selected --source-path service.js --source-path markdown-exporter.js --max-heap-mb 2048 --format json

The directory contains exact service and exporter fragments; omitted surrounding bundle bindings remain outside this analysis. Public exporter.js is byte-identical to the analyzed markdown-exporter.js, with only the publication filename changed.

Actual trace_javascript_semantics requests used the complete canonical selected application Evidence in the application field, then each query below:
{"seed":{"kind":"property","name":"notePaths"},"direction":"forward-influence"}
{"seed":{"kind":"property","name":"destResourcePaths"},"direction":"forward-influence"}
{"seed":{"kind":"property","name":"prepareForProcessingItemType"},"direction":"callers"}

The first two returned ambiguous; the third returned found. Dynamic property/method frontiers are retained. These are static clues, not complete runtime data-flow or binding resolution. The analyst read the matched functions and verified their selected mechanism with the controlled replay.

Controlled replay:
node public/samples/joplin-export/verify.mjs .qa/joplin

Executed original selected InteropService, Markdown exporter, exporter base and filename/uniqueness/escape helpers. Injected synthetic database/model lookup and serialization, exporter selection, filesystem/path adapters and inert function-name annotations. The service's original export method controlled the two-phase preparation/processing and item order. The Markdown exporter used the original path maps and body-rewriting methods. No original desktop UI session was run.

Fixture: two identically titled root notebooks, a nested notebook, three notes including a forward link to a same-title note, and three synthetic SVG resources including duplicate filenames and a title-only resource.

checks.json records nine groups of assertions. All five note/image link destinations resolve to emitted files; all three copied resource digests match their synthetic inputs; resources are copied before note bodies are written. The source manifest and test suite bind the visible website example to a fresh replay of those same shipped-code regions.

Scope: this does not establish file-picker behavior, real profile serialization, every Markdown/path edge case, missing-target behavior, full export/import equivalence or independent installer-signature verification.

Publication:
package-inspection.json and analysis-excerpt files select fields from complete local REA output. Trace files replace local paths. These are readable publication copies, not canonical import bundles. Original evidence IDs refer to the pre-publication results. No path-normalized copy is claimed to preserve all canonical digests. Raw full results are retained locally in ignored .qa/joplin.

The excerpts and controlled replay preserve Joplin attribution and AGPL-3.0-or-later license text. Only selected program code and synthetic inputs are redistributed; the installed app archive is not.