rea-agents 1.6.0 → 2.0.0

package/dist/domain/javascriptApplicationGraphSchemas.js

@@ -0,0 +1,139 @@
+import { z } from "zod";
+import { applicationCoverageSchema, applicationGraphEvidenceSchema, applicationNodeIdentitySchema, } from "./javascriptApplicationEvidenceSchemas.js";
+import { isJsonWithinLimits } from "./jsonLimits.js";
+import { jsonValueSchema } from "./jsonValue.js";
+const boundedTextSchema = z.string().min(1).max(4_096);
+/** Node kinds admitted by JavaScript Application Graph v1. */
+export const JAVASCRIPT_APPLICATION_NODE_KINDS = [
+    "package",
+    "installer",
+    "artifact",
+    "asar-entry",
+    "electron-main",
+    "electron-preload",
+    "electron-renderer",
+    "electron-utility",
+    "javascript-asset",
+    "javascript-chunk",
+    "javascript-module",
+    "source-map",
+    "source-module",
+    "browser-window",
+    "frame",
+    "target",
+    "context-bridge-api",
+    "ipc-channel",
+    "ipc-handler",
+    "worker",
+    "service-worker",
+    "endpoint",
+    "storage",
+    "native-addon",
+    "native-export",
+    "managed-assembly",
+    "managed-module",
+    "managed-type",
+    "managed-method",
+    "managed-field",
+    "managed-pinvoke-import",
+    "managed-native-implementation",
+    "runtime-script-instance",
+    "unknown",
+];
+/** Provider-neutral application entity categories. */
+const applicationNodeKindSchema = z.enum(JAVASCRIPT_APPLICATION_NODE_KINDS);
+/** Directed relations admitted by JavaScript Application Graph v1. */
+export const JAVASCRIPT_APPLICATION_RELATIONS = [
+    "contains",
+    "loads",
+    "imports",
+    "maps_to",
+    "exposes",
+    "sends",
+    "invokes",
+    "handles",
+    "calls",
+    "persists_to",
+    "observed_as",
+    "changed_from",
+];
+/** Provider-neutral relation categories. */
+const applicationRelationSchema = z.enum(JAVASCRIPT_APPLICATION_RELATIONS);
+const applicationPropertiesSchema = z
+    .record(z.string().min(1).max(128), jsonValueSchema)
+    .superRefine((properties, context) => {
+    if (Object.keys(properties).length > 64)
+        context.addIssue({
+            code: "custom",
+            message: "Application graph properties exceed 64 keys",
+        });
+    if (!isJsonWithinLimits(properties, {
+        maxDepth: 6,
+        maxNodes: 512,
+        maxStringLength: 4_096,
+    }))
+        context.addIssue({
+            code: "custom",
+            message: "Application graph properties exceed structural limits",
+        });
+});
+/** One node observation before its semantic identifier is derived. */
+const applicationNodeObservationInputSchema = z.strictObject({
+    label: z.string().min(1).max(1_024).nullable(),
+    properties: applicationPropertiesSchema,
+    evidence: applicationGraphEvidenceSchema,
+});
+/** One immutable, evidence-bearing observation attached to an entity. */
+export const applicationNodeObservationSchema = applicationNodeObservationInputSchema.extend({
+    observation_id: z.string().regex(/^jag_observation_[a-f0-9]{64}$/u),
+    identifier_strategy: z.strictObject({
+        strategy: z.literal("semantic-content-sha256"),
+        stability: z.literal("observation-exact"),
+    }),
+});
+/** One application entity before its stable identifier is derived. */
+export const applicationNodeInputSchema = z.strictObject({
+    kind: applicationNodeKindSchema,
+    identity: applicationNodeIdentitySchema,
+    observations: z.array(applicationNodeObservationInputSchema).min(1).max(64),
+});
+/** One stable application entity with one or more bounded observations. */
+export const applicationNodeSchema = z.strictObject({
+    node_id: z.string().regex(/^jag_node_[a-f0-9]{64}$/u),
+    kind: applicationNodeKindSchema,
+    identity: applicationNodeIdentitySchema,
+    observations: z.array(applicationNodeObservationSchema).min(1).max(64),
+});
+/** One directed relationship before its semantic identifier is derived. */
+export const applicationEdgeInputSchema = z.strictObject({
+    source_node_id: z.string().regex(/^jag_node_[a-f0-9]{64}$/u),
+    target_node_id: z.string().regex(/^jag_node_[a-f0-9]{64}$/u),
+    relation: applicationRelationSchema,
+    properties: applicationPropertiesSchema,
+    evidence: applicationGraphEvidenceSchema,
+});
+/** One directed, evidence-bearing application relationship. */
+export const applicationEdgeSchema = applicationEdgeInputSchema.extend({
+    edge_id: z.string().regex(/^jag_edge_[a-f0-9]{64}$/u),
+    identifier_strategy: z.strictObject({
+        strategy: z.literal("semantic-content-sha256"),
+        stability: z.literal("relationship-exact"),
+    }),
+});
+/** Graph content before its top-level semantic identifier is derived. */
+export const javascriptApplicationGraphInputSchema = z.strictObject({
+    schema: z.literal("JavaScriptApplicationGraph"),
+    schema_version: z.literal(1),
+    root_node_ids: z
+        .array(z.string().regex(/^jag_node_[a-f0-9]{64}$/u))
+        .min(1)
+        .max(1_000),
+    nodes: z.array(applicationNodeSchema).min(1).max(100_000),
+    edges: z.array(applicationEdgeSchema).max(200_000),
+    coverage: applicationCoverageSchema,
+    limitations: z.array(boundedTextSchema).max(1_000),
+});
+/** Strict stored shape for JavaScript Application Graph v1. */
+export const javascriptApplicationGraphRecordSchema = javascriptApplicationGraphInputSchema.extend({
+    graph_id: z.string().regex(/^jag_[a-f0-9]{64}$/u),
+});

package/dist/domain/javascriptApplicationVersionComparison.js

@@ -0,0 +1,116 @@
+import { createHash } from "node:crypto";
+import canonicalize from "canonicalize";
+import { buildJavaScriptApplicationChangeGraph } from "./javascriptApplicationChangeGraph.js";
+import { applicationVersionComparisonResultSchema, } from "./javascriptApplicationVersionComparisonSchemas.js";
+import { compareCodePoints } from "./javascriptApplicationGraph.js";
+import { classifyJavaScriptApplicationVersions } from "./javascriptApplicationVersionItems.js";
+import { matchJavaScriptApplicationVersions } from "./javascriptApplicationVersionKeys.js";
+/** Compare application entities with ordered unique-only identity tiers. */
+export const compareJavaScriptApplicationVersions = (input) => {
+    const matching = matchJavaScriptApplicationVersions(input.left.graph.nodes, input.right.graph.nodes);
+    const projection = classifyJavaScriptApplicationVersions(matching, {
+        leftGraph: input.left.graph,
+        rightGraph: input.right.graph,
+        leftEvidenceId: input.left.evidenceId,
+        rightEvidenceId: input.right.evidenceId,
+        leftNativeEvidence: input.leftNativeEvidence,
+        rightNativeEvidence: input.rightNativeEvidence,
+        maxCandidates: input.limits.max_candidate_nodes,
+    });
+    const items = projection.items.slice(0, input.limits.max_comparison_items);
+    const omittedComparisonItems = projection.items.length - items.length;
+    const changeGraph = buildJavaScriptApplicationChangeGraph({
+        left: input.left.graph,
+        right: input.right.graph,
+        leftEvidenceId: input.left.evidenceId,
+        rightEvidenceId: input.right.evidenceId,
+        items,
+        omittedComparisonItems,
+        limits: input.limits,
+    });
+    const evidenceLinks = uniqueSorted(projection.items.flatMap(({ evidence_links: links }) => links));
+    const omissions = {
+        omitted_comparison_items: omittedComparisonItems,
+        omitted_candidate_references: projection.omittedCandidateReferences,
+        omitted_graph_nodes: changeGraph.omittedNodes,
+        omitted_graph_edges: changeGraph.omittedEdges,
+        omitted_graph_observations: changeGraph.omittedObservations,
+    };
+    const semantic = {
+        schema_version: 1,
+        left: {
+            evidence_id: input.left.evidenceId,
+            graph_id: input.left.graph.graph_id,
+            root_artifact_sha256: input.left.rootArtifactSha256,
+        },
+        right: {
+            evidence_id: input.right.evidenceId,
+            graph_id: input.right.graph.graph_id,
+            root_artifact_sha256: input.right.rootArtifactSha256,
+        },
+        summary: summary(projection.items),
+        matching: matchingSummary(projection.items),
+        items,
+        graph: changeGraph.graph,
+        coverage: {
+            status: comparisonCoverageStatus(input, omissions),
+            left_graph_status: input.left.graph.coverage.status,
+            right_graph_status: input.right.graph.coverage.status,
+            ...omissions,
+        },
+        evidence_links: evidenceLinks,
+        limitations: comparisonLimitations(input, omissions),
+    };
+    return applicationVersionComparisonResultSchema.parse({
+        ...semantic,
+        comparison_id: `javc_${digestCanonical(semantic)}`,
+    });
+};
+const summary = (items) => ({
+    unchanged: countStatus(items, "unchanged"),
+    added: countStatus(items, "added"),
+    removed: countStatus(items, "removed"),
+    changed: countStatus(items, "changed"),
+    unknown: countStatus(items, "unknown"),
+});
+const countStatus = (items, status) => items.filter((item) => item.status === status).length;
+const matchingSummary = (items) => ({
+    exact_node_identity: countBasis(items, "exact-node-identity"),
+    exact_content_digest: countBasis(items, "exact-content-digest"),
+    exact_module_source_digest: countBasis(items, "exact-module-source-digest"),
+    source_map_identity: countBasis(items, "source-map-identity"),
+    structural_fingerprint: countBasis(items, "structural-fingerprint"),
+    semantic_key: countBasis(items, "semantic-key"),
+    ambiguous: items.filter(({ match }) => match.status === "ambiguous").length,
+    unmatched: items.filter(({ match }) => match.status === "unmatched").length,
+});
+const countBasis = (items, basis) => items.filter(({ match }) => match.basis === basis).length;
+const comparisonCoverageStatus = (input, omissions) => Object.values(omissions).some((value) => value > 0)
+    ? "truncated"
+    : input.left.graph.coverage.status === "complete" &&
+        input.right.graph.coverage.status === "complete"
+        ? "complete-within-inputs"
+        : "partial";
+const comparisonLimitations = (input, omissions) => uniqueSorted([
+    "Application comparison never uses bundler module ordinals as persistent identity and performs no fuzzy pairing.",
+    "Exact digest equality proves byte identity only; source-map, structural-fingerprint, and semantic-key matches retain inferred confidence.",
+    "Minified names and chunk locations are not assumed stable across versions.",
+    "The comparison reads retained graphs and Evidence only; it does not execute either application.",
+    "Native Evidence is linked only by exact subject digest; provider snapshot reuse remains target/provider/profile exact.",
+    ...(input.left.graph.coverage.status === "complete" &&
+        input.right.graph.coverage.status === "complete"
+        ? []
+        : [
+            "At least one source graph is incomplete; unmatched entities on the opposite side remain unknown rather than added or removed.",
+        ]),
+    ...(Object.values(omissions).some((value) => value > 0)
+        ? ["Comparison output was truncated at explicit caller limits."]
+        : []),
+]);
+const digestCanonical = (value) => {
+    const encoded = canonicalize(value);
+    if (encoded === undefined)
+        throw new TypeError("Application version comparison could not canonicalize data");
+    return createHash("sha256").update(encoded).digest("hex");
+};
+const uniqueSorted = (values) => [...new Set(values)].sort(compareCodePoints);

package/dist/domain/javascriptApplicationVersionComparisonSchemas.js

@@ -0,0 +1,139 @@
+import { z } from "zod";
+import { evidenceSchema } from "./evidence.js";
+import { javascriptApplicationGraphSchema } from "./javascriptApplicationGraph.js";
+import { JAVASCRIPT_APPLICATION_NODE_KINDS } from "./javascriptApplicationGraphSchemas.js";
+const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
+const nodeIdSchema = z.string().regex(/^jag_node_[a-f0-9]{64}$/u);
+const boundedTextSchema = z.string().min(1).max(4_096);
+const comparisonLimitsSchema = z.strictObject({
+    max_comparison_items: z.number().int().min(1).max(50_000).default(20_000),
+    max_candidate_nodes: z.number().int().min(1).max(1_000).default(100),
+    max_graph_nodes: z.number().int().min(1).max(100_000).default(20_000),
+    max_graph_edges: z.number().int().min(1).max(200_000).default(40_000),
+});
+/** Two authenticated application versions and deterministic output bounds. */
+export const compareApplicationVersionsInputSchema = z
+    .strictObject({
+    left: evidenceSchema,
+    right: evidenceSchema,
+    left_native_observations: z.array(evidenceSchema).max(64).default([]),
+    right_native_observations: z.array(evidenceSchema).max(64).default([]),
+    limits: comparisonLimitsSchema.default({
+        max_comparison_items: 20_000,
+        max_candidate_nodes: 100,
+        max_graph_nodes: 20_000,
+        max_graph_edges: 40_000,
+    }),
+    unknown_registry_approved: z.literal(true).optional(),
+})
+    .superRefine((input, context) => {
+    if (input.left.evidence_id === input.right.evidence_id)
+        context.addIssue({
+            code: "custom",
+            path: ["right"],
+            message: "Application version Evidence must be distinct",
+        });
+    for (const side of [
+        "left_native_observations",
+        "right_native_observations",
+    ]) {
+        const ids = input[side].map(({ evidence_id: id }) => id);
+        if (new Set(ids).size !== ids.length)
+            context.addIssue({
+                code: "custom",
+                path: [side],
+                message: "Native observations must be unique on each side",
+            });
+    }
+});
+const applicationVersionMatchBasisSchema = z.enum([
+    "exact-node-identity",
+    "exact-content-digest",
+    "exact-module-source-digest",
+    "source-map-identity",
+    "structural-fingerprint",
+    "semantic-key",
+    "none",
+]);
+const comparisonItemSchema = z.strictObject({
+    item_id: z.string().regex(/^javc_item_[a-f0-9]{64}$/u),
+    status: z.enum(["unchanged", "added", "removed", "changed", "unknown"]),
+    node_kind: z.enum(JAVASCRIPT_APPLICATION_NODE_KINDS),
+    left_node_id: nodeIdSchema.nullable(),
+    right_node_id: nodeIdSchema.nullable(),
+    match: z.strictObject({
+        status: z.enum(["matched", "unmatched", "ambiguous"]),
+        basis: applicationVersionMatchBasisSchema,
+        confidence: z.enum(["exact", "high", "medium", "unknown"]),
+        candidate_left_node_ids: z.array(nodeIdSchema).max(1_000),
+        candidate_right_node_ids: z.array(nodeIdSchema).max(1_000),
+    }),
+    dimensions: z
+        .array(z.enum([
+        "content",
+        "location",
+        "properties",
+        "relationships",
+        "availability",
+        "coverage",
+    ]))
+        .max(6),
+    evidence_links: z.array(evidenceIdSchema).min(2).max(130),
+    limitations: z.array(boundedTextSchema).max(100),
+});
+/** Tiered module/entity matching plus a bounded cross-version change graph. */
+export const applicationVersionComparisonResultSchema = z.strictObject({
+    schema_version: z.literal(1),
+    comparison_id: z.string().regex(/^javc_[a-f0-9]{64}$/u),
+    left: z.strictObject({
+        evidence_id: evidenceIdSchema,
+        graph_id: z.string().regex(/^jag_[a-f0-9]{64}$/u),
+        root_artifact_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
+    }),
+    right: z.strictObject({
+        evidence_id: evidenceIdSchema,
+        graph_id: z.string().regex(/^jag_[a-f0-9]{64}$/u),
+        root_artifact_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
+    }),
+    summary: z.strictObject({
+        unchanged: z.number().int().min(0),
+        added: z.number().int().min(0),
+        removed: z.number().int().min(0),
+        changed: z.number().int().min(0),
+        unknown: z.number().int().min(0),
+    }),
+    matching: z.strictObject({
+        exact_node_identity: z.number().int().min(0),
+        exact_content_digest: z.number().int().min(0),
+        exact_module_source_digest: z.number().int().min(0),
+        source_map_identity: z.number().int().min(0),
+        structural_fingerprint: z.number().int().min(0),
+        semantic_key: z.number().int().min(0),
+        ambiguous: z.number().int().min(0),
+        unmatched: z.number().int().min(0),
+    }),
+    items: z.array(comparisonItemSchema).max(50_000),
+    graph: javascriptApplicationGraphSchema,
+    coverage: z.strictObject({
+        status: z.enum(["complete-within-inputs", "partial", "truncated"]),
+        left_graph_status: z.enum([
+            "complete",
+            "partial",
+            "unknown",
+            "unavailable",
+        ]),
+        right_graph_status: z.enum([
+            "complete",
+            "partial",
+            "unknown",
+            "unavailable",
+        ]),
+        omitted_comparison_items: z.number().int().min(0),
+        omitted_candidate_references: z.number().int().min(0),
+        omitted_graph_nodes: z.number().int().min(0),
+        omitted_graph_edges: z.number().int().min(0),
+        omitted_graph_observations: z.number().int().min(0),
+    }),
+    evidence_links: z.array(evidenceIdSchema).min(2).max(130),
+    limitations: z.array(boundedTextSchema).max(1_000),
+});

package/dist/domain/javascriptApplicationVersionItems.js

@@ -0,0 +1,221 @@
+import { createHash } from "node:crypto";
+import canonicalize from "canonicalize";
+import { compareCodePoints, } from "./javascriptApplicationGraph.js";
+/** Classify matched, unmatched, and ambiguous nodes without inventing absence. */
+export const classifyJavaScriptApplicationVersions = (matching, context) => {
+    const pairByLeft = new Map(matching.pairs.map(({ left, right }) => [
+        left.node_id,
+        `pair:${left.node_id}:${right.node_id}`,
+    ]));
+    const pairByRight = new Map(matching.pairs.map(({ left, right }) => [
+        right.node_id,
+        `pair:${left.node_id}:${right.node_id}`,
+    ]));
+    const fullContext = { ...context, pairByLeft, pairByRight };
+    let omittedCandidateReferences = 0;
+    const leftItems = matching.unmatchedLeft.map((node) => {
+        const candidates = matching.candidatesForLeft.get(node.node_id) ?? [];
+        omittedCandidateReferences += Math.max(0, candidates.length - context.maxCandidates);
+        return unmatchedItem(node, "left", candidates.slice(0, context.maxCandidates), fullContext);
+    });
+    const rightItems = matching.unmatchedRight.map((node) => {
+        const candidates = matching.candidatesForRight.get(node.node_id) ?? [];
+        omittedCandidateReferences += Math.max(0, candidates.length - context.maxCandidates);
+        return unmatchedItem(node, "right", candidates.slice(0, context.maxCandidates), fullContext);
+    });
+    return {
+        items: [
+            ...matching.pairs.map((pair) => matchedItem(pair, fullContext)),
+            ...leftItems,
+            ...rightItems,
+        ].sort((left, right) => compareCodePoints(left.item_id, right.item_id)),
+        omittedCandidateReferences,
+    };
+};
+const matchedItem = (pair, context) => {
+    const dimensions = changedDimensions(pair, context);
+    const complete = graphsComplete(context);
+    const observedChange = dimensions.some((dimension) => ["content", "location", "properties"].includes(dimension));
+    const status = observedChange || (complete && dimensions.length > 0)
+        ? "changed"
+        : complete
+            ? "unchanged"
+            : "unknown";
+    const finalDimensions = status === "unknown" && !dimensions.includes("coverage")
+        ? [...dimensions, "coverage"]
+        : dimensions;
+    const semantic = {
+        status,
+        node_kind: pair.left.kind,
+        left_node_id: pair.left.node_id,
+        right_node_id: pair.right.node_id,
+        match: {
+            status: "matched",
+            basis: pair.basis,
+            confidence: pair.confidence,
+            candidate_left_node_ids: [],
+            candidate_right_node_ids: [],
+        },
+        dimensions: finalDimensions,
+        evidence_links: itemEvidenceLinks(pair.left, pair.right, context),
+        limitations: pairLimitations(pair, status),
+    };
+    return itemWithId(semantic);
+};
+const unmatchedItem = (node, side, candidates, context) => {
+    const ambiguous = candidates.length > 0;
+    const oppositeComplete = (side === "left" ? context.rightGraph : context.leftGraph).coverage
+        .status === "complete";
+    const status = ambiguous
+        ? "unknown"
+        : oppositeComplete
+            ? side === "left"
+                ? "removed"
+                : "added"
+            : "unknown";
+    const semantic = {
+        status,
+        node_kind: node.kind,
+        left_node_id: side === "left" ? node.node_id : null,
+        right_node_id: side === "right" ? node.node_id : null,
+        match: {
+            status: ambiguous ? "ambiguous" : "unmatched",
+            basis: "none",
+            confidence: "unknown",
+            candidate_left_node_ids: side === "right" ? [...candidates] : [],
+            candidate_right_node_ids: side === "left" ? [...candidates] : [],
+        },
+        dimensions: [
+            "availability",
+            ...(status === "unknown" && !ambiguous ? ["coverage"] : []),
+        ],
+        evidence_links: itemEvidenceLinks(side === "left" ? node : undefined, side === "right" ? node : undefined, context),
+        limitations: [
+            ...(ambiguous
+                ? [
+                    "Multiple nodes share the same permitted match key; no cross-version pair was selected.",
+                ]
+                : []),
+            ...(status === "unknown" && !ambiguous
+                ? [
+                    "The opposite graph is incomplete, so an unmatched node cannot be classified as added or removed.",
+                ]
+                : []),
+        ],
+    };
+    return itemWithId(semantic);
+};
+const changedDimensions = (pair, context) => {
+    const dimensions = [];
+    const leftContent = contentIdentity(pair.left);
+    const rightContent = contentIdentity(pair.right);
+    if (leftContent !== null &&
+        rightContent !== null &&
+        leftContent !== rightContent)
+        dimensions.push("content");
+    if (canonical(locations(pair.left)) !== canonical(locations(pair.right)))
+        dimensions.push("location");
+    if (canonical(properties(pair.left)) !== canonical(properties(pair.right)))
+        dimensions.push("properties");
+    if (relationshipSignature(pair.left, "left", context) !==
+        relationshipSignature(pair.right, "right", context))
+        dimensions.push("relationships");
+    return dimensions;
+};
+const contentIdentity = (node) => {
+    if (node.identity.strategy === "content-digest")
+        return `content:${node.identity.sha256}`;
+    if (node.kind === "javascript-module")
+        return stringProperty(node, "source_sha256");
+    if (node.kind === "source-module" &&
+        node.identity.strategy === "source-map-original")
+        return node.identity.source_sha256;
+    return null;
+};
+const locations = (node) => node.observations
+    .map(({ evidence }) => evidence.location.available ? evidence.location.value : evidence.location)
+    .sort((left, right) => compareCodePoints(canonical(left), canonical(right)));
+const properties = (node) => node.observations
+    .map(({ label, properties: values }) => ({ label, properties: values }))
+    .sort((left, right) => compareCodePoints(canonical(left), canonical(right)));
+const relationshipSignature = (node, side, context) => {
+    const graph = side === "left" ? context.leftGraph : context.rightGraph;
+    const paired = side === "left" ? context.pairByLeft : context.pairByRight;
+    const nodeById = new Map(graph.nodes.map((value) => [value.node_id, value]));
+    const signatures = graph.edges.flatMap((edge) => {
+        if (edge.source_node_id === node.node_id)
+            return [
+                edgeSignature("out", edge.relation, edge.target_node_id, paired, nodeById),
+            ];
+        if (edge.target_node_id === node.node_id)
+            return [
+                edgeSignature("in", edge.relation, edge.source_node_id, paired, nodeById),
+            ];
+        return [];
+    });
+    return canonical(signatures.sort(compareCodePoints));
+};
+const edgeSignature = (direction, relation, neighborId, paired, nodeById) => {
+    const mapped = paired.get(neighborId);
+    const neighbor = nodeById.get(neighborId);
+    return `${direction}\0${relation}\0${mapped ?? `unmatched:${neighbor?.kind ?? "unknown"}`}`;
+};
+const itemEvidenceLinks = (left, right, context) => [
+    ...new Set([
+        context.leftEvidenceId,
+        context.rightEvidenceId,
+        ...nativeLinks(left, context.leftNativeEvidence),
+        ...nativeLinks(right, context.rightNativeEvidence),
+    ]),
+].sort(compareCodePoints);
+const nativeLinks = (node, evidence) => {
+    const digest = node === undefined
+        ? null
+        : contentIdentity(node)?.replace(/^content:/u, "");
+    return digest === null
+        ? []
+        : evidence
+            .filter(({ subject }) => subject?.digest.sha256 === digest)
+            .map(({ evidence_id: id }) => id);
+};
+const pairLimitations = (pair, status) => [
+    ...(pair.basis === "structural-fingerprint"
+        ? [
+            "Structural fingerprint equality is rename-resistant inference; it is not byte identity or proof of semantic equivalence.",
+        ]
+        : []),
+    ...(pair.basis === "source-map-identity"
+        ? [
+            "Source-map original names identify a candidate source lineage; changed or unavailable source content remains explicit.",
+        ]
+        : []),
+    ...(pair.basis === "semantic-key"
+        ? [
+            "Semantic-key pairing is a deterministic inference and is never promoted to exact identity.",
+        ]
+        : []),
+    ...(status === "unknown"
+        ? ["Incomplete graph coverage prevents a complete node-level conclusion."]
+        : []),
+];
+const itemWithId = (semantic) => ({
+    ...semantic,
+    item_id: `javc_item_${digestCanonical(semantic)}`,
+});
+const stringProperty = (node, key) => {
+    const values = [
+        ...new Set(node.observations
+            .map(({ properties: values }) => values[key])
+            .filter((value) => typeof value === "string")),
+    ];
+    return values.length === 1 ? (values[0] ?? null) : null;
+};
+const graphsComplete = (context) => context.leftGraph.coverage.status === "complete" &&
+    context.rightGraph.coverage.status === "complete";
+const canonical = (value) => {
+    const encoded = canonicalize(value);
+    if (encoded === undefined)
+        throw new TypeError("Application version item could not canonicalize data");
+    return encoded;
+};
+const digestCanonical = (value) => createHash("sha256").update(canonical(value)).digest("hex");