rea-agents 1.7.0 → 2.1.0

package/dist/domain/javascriptApplicationVersionItems.js

@@ -0,0 +1,233 @@
+import { createHash } from "node:crypto";
+import canonicalize from "canonicalize";
+import { compareCodePoints, } from "./javascriptApplicationGraph.js";
+/** Classify matched, unmatched, and ambiguous nodes without inventing absence. */
+export const classifyJavaScriptApplicationVersions = (matching, context) => {
+    const pairByLeft = new Map(matching.pairs.map(({ left, right }) => [
+        left.node_id,
+        `pair:${left.node_id}:${right.node_id}`,
+    ]));
+    const pairByRight = new Map(matching.pairs.map(({ left, right }) => [
+        right.node_id,
+        `pair:${left.node_id}:${right.node_id}`,
+    ]));
+    const fullContext = { ...context, pairByLeft, pairByRight };
+    let omittedCandidateReferences = 0;
+    const leftItems = matching.unmatchedLeft.map((node) => {
+        const candidates = matching.candidatesForLeft.get(node.node_id) ?? [];
+        omittedCandidateReferences += Math.max(0, candidates.length - context.maxCandidates);
+        return unmatchedItem(node, "left", candidates.slice(0, context.maxCandidates), fullContext);
+    });
+    const rightItems = matching.unmatchedRight.map((node) => {
+        const candidates = matching.candidatesForRight.get(node.node_id) ?? [];
+        omittedCandidateReferences += Math.max(0, candidates.length - context.maxCandidates);
+        return unmatchedItem(node, "right", candidates.slice(0, context.maxCandidates), fullContext);
+    });
+    return {
+        items: [
+            ...matching.pairs.map((pair) => matchedItem(pair, fullContext)),
+            ...leftItems,
+            ...rightItems,
+        ].sort((left, right) => compareCodePoints(left.item_id, right.item_id)),
+        omittedCandidateReferences,
+    };
+};
+const matchedItem = (pair, context) => {
+    const dimensions = changedDimensions(pair, context);
+    const complete = graphsComplete(context);
+    const observedChange = dimensions.some((dimension) => ["content", "location", "properties"].includes(dimension));
+    const status = observedChange || (complete && dimensions.length > 0)
+        ? "changed"
+        : complete
+            ? "unchanged"
+            : "unknown";
+    const finalDimensions = status === "unknown" && !dimensions.includes("coverage")
+        ? [...dimensions, "coverage"]
+        : dimensions;
+    const semantic = {
+        status,
+        node_kind: pair.left.kind,
+        left_node_id: pair.left.node_id,
+        right_node_id: pair.right.node_id,
+        match: {
+            status: "matched",
+            basis: pair.basis,
+            confidence: pair.confidence,
+            candidate_left_node_ids: [],
+            candidate_right_node_ids: [],
+        },
+        dimensions: finalDimensions,
+        evidence_links: itemEvidenceLinks(pair.left, pair.right, context),
+        limitations: pairLimitations(pair, status),
+    };
+    return itemWithId(semantic);
+};
+const unmatchedItem = (node, side, candidates, context) => {
+    const ambiguous = candidates.length > 0;
+    const oppositeComplete = (side === "left" ? context.rightGraph : context.leftGraph).coverage
+        .status === "complete";
+    const status = ambiguous
+        ? "unknown"
+        : oppositeComplete
+            ? side === "left"
+                ? "removed"
+                : "added"
+            : "unknown";
+    const semantic = {
+        status,
+        node_kind: node.kind,
+        left_node_id: side === "left" ? node.node_id : null,
+        right_node_id: side === "right" ? node.node_id : null,
+        match: {
+            status: ambiguous ? "ambiguous" : "unmatched",
+            basis: "none",
+            confidence: "unknown",
+            candidate_left_node_ids: side === "right" ? [...candidates] : [],
+            candidate_right_node_ids: side === "left" ? [...candidates] : [],
+        },
+        dimensions: [
+            "availability",
+            ...(status === "unknown" && !ambiguous ? ["coverage"] : []),
+        ],
+        evidence_links: itemEvidenceLinks(side === "left" ? node : undefined, side === "right" ? node : undefined, context),
+        limitations: [
+            ...(ambiguous
+                ? [
+                    "Multiple nodes share the same permitted match key; no cross-version pair was selected.",
+                ]
+                : []),
+            ...(status === "unknown" && !ambiguous
+                ? [
+                    "The opposite graph is incomplete, so an unmatched node cannot be classified as added or removed.",
+                ]
+                : []),
+        ],
+    };
+    return itemWithId(semantic);
+};
+const changedDimensions = (pair, context) => {
+    const dimensions = [];
+    const leftContent = contentIdentity(pair.left);
+    const rightContent = contentIdentity(pair.right);
+    if (leftContent !== null &&
+        rightContent !== null &&
+        leftContent !== rightContent)
+        dimensions.push("content");
+    if (canonical(locations(pair.left)) !== canonical(locations(pair.right)))
+        dimensions.push("location");
+    if (canonical(properties(pair.left)) !== canonical(properties(pair.right)))
+        dimensions.push("properties");
+    if (relationshipSignature(pair.left, "left", context) !==
+        relationshipSignature(pair.right, "right", context))
+        dimensions.push("relationships");
+    return dimensions;
+};
+const contentIdentity = (node) => {
+    if (node.identity.strategy === "content-digest")
+        return `content:${node.identity.sha256}`;
+    if (node.kind === "javascript-module")
+        return stringProperty(node, "source_sha256");
+    if (node.kind === "source-module" &&
+        node.identity.strategy === "source-map-original")
+        return node.identity.source_sha256;
+    return null;
+};
+const locations = (node) => node.observations
+    .map(({ evidence }) => evidence.location.available ? evidence.location.value : evidence.location)
+    .sort((left, right) => compareCodePoints(canonical(left), canonical(right)));
+const properties = (node) => node.observations
+    .map(({ label, properties: values }) => ({ label, properties: values }))
+    .sort((left, right) => compareCodePoints(canonical(left), canonical(right)));
+const relationshipSignature = (node, side, context) => {
+    const graph = side === "left" ? context.leftGraph : context.rightGraph;
+    const paired = side === "left" ? context.pairByLeft : context.pairByRight;
+    const nodeById = new Map(graph.nodes.map((value) => [value.node_id, value]));
+    const signatures = graph.edges.flatMap((edge) => {
+        if (edge.source_node_id === node.node_id)
+            return [
+                edgeSignature({
+                    direction: "out",
+                    relation: edge.relation,
+                    neighborId: edge.target_node_id,
+                    paired,
+                    nodeById,
+                }),
+            ];
+        if (edge.target_node_id === node.node_id)
+            return [
+                edgeSignature({
+                    direction: "in",
+                    relation: edge.relation,
+                    neighborId: edge.source_node_id,
+                    paired,
+                    nodeById,
+                }),
+            ];
+        return [];
+    });
+    return canonical(signatures.sort(compareCodePoints));
+};
+const edgeSignature = (context) => {
+    const mapped = context.paired.get(context.neighborId);
+    const neighbor = context.nodeById.get(context.neighborId);
+    return `${context.direction}\0${context.relation}\0${mapped ?? `unmatched:${neighbor?.kind ?? "unknown"}`}`;
+};
+const itemEvidenceLinks = (left, right, context) => [
+    ...new Set([
+        context.leftEvidenceId,
+        context.rightEvidenceId,
+        ...nativeLinks(left, context.leftNativeEvidence),
+        ...nativeLinks(right, context.rightNativeEvidence),
+    ]),
+].sort(compareCodePoints);
+const nativeLinks = (node, evidence) => {
+    const digest = node === undefined
+        ? null
+        : contentIdentity(node)?.replace(/^content:/u, "");
+    return digest === null
+        ? []
+        : evidence
+            .filter(({ subject }) => subject?.digest.sha256 === digest)
+            .map(({ evidence_id: id }) => id);
+};
+const pairLimitations = (pair, status) => [
+    ...(pair.basis === "structural-fingerprint"
+        ? [
+            "Structural fingerprint equality is rename-resistant inference; it is not byte identity or proof of semantic equivalence.",
+        ]
+        : []),
+    ...(pair.basis === "source-map-identity"
+        ? [
+            "Source-map original names identify a candidate source lineage; changed or unavailable source content remains explicit.",
+        ]
+        : []),
+    ...(pair.basis === "semantic-key"
+        ? [
+            "Semantic-key pairing is a deterministic inference and is never promoted to exact identity.",
+        ]
+        : []),
+    ...(status === "unknown"
+        ? ["Incomplete graph coverage prevents a complete node-level conclusion."]
+        : []),
+];
+const itemWithId = (semantic) => ({
+    ...semantic,
+    item_id: `javc_item_${digestCanonical(semantic)}`,
+});
+const stringProperty = (node, key) => {
+    const values = [
+        ...new Set(node.observations
+            .map(({ properties: values }) => values[key])
+            .filter((value) => typeof value === "string")),
+    ];
+    return values.length === 1 ? (values[0] ?? null) : null;
+};
+const graphsComplete = (context) => context.leftGraph.coverage.status === "complete" &&
+    context.rightGraph.coverage.status === "complete";
+const canonical = (value) => {
+    const encoded = canonicalize(value);
+    if (encoded === undefined)
+        throw new TypeError("Application version item could not canonicalize data");
+    return encoded;
+};
+const digestCanonical = (value) => createHash("sha256").update(canonical(value)).digest("hex");

package/dist/domain/javascriptApplicationVersionKeys.js

@@ -0,0 +1,170 @@
+import { compareCodePoints } from "./javascriptApplicationGraph.js";
+const matchTiers = () => [
+    { basis: "exact-content-digest", confidence: "exact", key: contentDigestKey },
+    {
+        basis: "exact-module-source-digest",
+        confidence: "exact",
+        key: moduleSourceDigestKey,
+    },
+    { basis: "exact-node-identity", confidence: "exact", key: nodeIdentityKey },
+    { basis: "source-map-identity", confidence: "high", key: sourceMapKey },
+    {
+        basis: "structural-fingerprint",
+        confidence: "medium",
+        key: structuralFingerprintKey,
+    },
+    { basis: "semantic-key", confidence: "medium", key: semanticKey },
+];
+/** Apply ordered, unique-only matching tiers without fuzzy pairing. */
+export const matchJavaScriptApplicationVersions = (leftNodes, rightNodes) => {
+    const left = new Map(leftNodes.map((node) => [node.node_id, node]));
+    const right = new Map(rightNodes.map((node) => [node.node_id, node]));
+    const leftCandidates = new Map();
+    const rightCandidates = new Map();
+    const pairs = [];
+    for (const tier of matchTiers())
+        applyTier({ left, right, pairs, leftCandidates, rightCandidates, tier });
+    const remainingLeft = sortedNodes(left.values());
+    const remainingRight = sortedNodes(right.values());
+    const leftIds = new Set(remainingLeft.map(({ node_id: id }) => id));
+    const rightIds = new Set(remainingRight.map(({ node_id: id }) => id));
+    return {
+        pairs: pairs.sort((a, b) => compareCodePoints(`${a.left.node_id}\0${a.right.node_id}`, `${b.left.node_id}\0${b.right.node_id}`)),
+        unmatchedLeft: remainingLeft,
+        unmatchedRight: remainingRight,
+        candidatesForLeft: filteredCandidates(leftCandidates, rightIds),
+        candidatesForRight: filteredCandidates(rightCandidates, leftIds),
+    };
+};
+const applyTier = (context) => {
+    const leftByKey = nodesByKey(context.left.values(), context.tier.key);
+    const rightByKey = nodesByKey(context.right.values(), context.tier.key);
+    for (const key of [...leftByKey.keys()].sort(compareCodePoints)) {
+        const leftGroup = leftByKey.get(key) ?? [];
+        const rightGroup = rightByKey.get(key) ?? [];
+        if (rightGroup.length === 0)
+            continue;
+        recordCandidates(leftGroup, rightGroup, context.leftCandidates, context.rightCandidates);
+        if (leftGroup.length !== 1 || rightGroup.length !== 1)
+            continue;
+        const leftNode = leftGroup[0];
+        const rightNode = rightGroup[0];
+        if (leftNode === undefined || rightNode === undefined)
+            continue;
+        context.pairs.push({ left: leftNode, right: rightNode, ...context.tier });
+        context.left.delete(leftNode.node_id);
+        context.right.delete(rightNode.node_id);
+    }
+};
+const nodesByKey = (nodes, keyFor) => {
+    const output = new Map();
+    for (const node of nodes) {
+        const key = keyFor(node);
+        if (key === null)
+            continue;
+        output.set(key, [...(output.get(key) ?? []), node]);
+    }
+    return output;
+};
+const recordCandidates = (left, right, leftCandidates, rightCandidates) => {
+    for (const leftNode of left) {
+        const candidates = leftCandidates.get(leftNode.node_id) ?? new Set();
+        for (const rightNode of right)
+            candidates.add(rightNode.node_id);
+        leftCandidates.set(leftNode.node_id, candidates);
+    }
+    for (const rightNode of right) {
+        const candidates = rightCandidates.get(rightNode.node_id) ?? new Set();
+        for (const leftNode of left)
+            candidates.add(leftNode.node_id);
+        rightCandidates.set(rightNode.node_id, candidates);
+    }
+};
+const filteredCandidates = (candidates, retained) => new Map([...candidates.entries()].flatMap(([nodeId, values]) => {
+    const filtered = [...values]
+        .filter((value) => retained.has(value))
+        .sort(compareCodePoints);
+    return filtered.length === 0 ? [] : [[nodeId, filtered]];
+}));
+const nodeIdentityKey = (node) => `node\0${node.kind}\0${node.node_id}`;
+const contentDigestKey = (node) => node.identity.strategy === "content-digest"
+    ? `content\0${node.kind}\0${node.identity.sha256}`
+    : null;
+const moduleSourceDigestKey = (node) => {
+    if (node.kind !== "javascript-module")
+        return null;
+    const value = uniqueStringProperty(node, "source_sha256");
+    return value === null ? null : `module-source\0${node.kind}\0${value}`;
+};
+const sourceMapKey = (node) => node.kind === "source-module" &&
+    node.identity.strategy === "source-map-original"
+    ? `source-map\0${node.identity.original_source}`
+    : null;
+const structuralFingerprintKey = (node) => {
+    if (node.kind !== "javascript-module")
+        return null;
+    const digest = uniqueStringProperty(node, "structural_fingerprint_sha256");
+    const algorithm = uniqueStringProperty(node, "structural_fingerprint_algorithm");
+    const status = uniqueStringProperty(node, "structural_fingerprint_status");
+    return digest === null || algorithm === null || status !== "complete"
+        ? null
+        : `structural\0${node.kind}\0${algorithm}\0${digest}`;
+};
+const semanticKey = (node) => {
+    if ([
+        "javascript-module",
+        "javascript-chunk",
+        "runtime-script-instance",
+        "unknown",
+    ].includes(node.kind))
+        return null;
+    const properties = firstProperties(node);
+    const value = semanticValue(node, properties);
+    return value === null ? null : `semantic\0${node.kind}\0${value}`;
+};
+const semanticValue = (node, properties) => {
+    if (node.kind === "endpoint")
+        return joined(properties.endpoint_kind, properties.value);
+    if (node.kind === "storage")
+        return joined(properties.storage_kind, properties.name ?? properties.mechanism);
+    if (node.kind === "ipc-channel")
+        return properties.resolution === "dynamic"
+            ? null
+            : (stringValue(properties.channel) ?? firstLabel(node));
+    if (node.kind === "context-bridge-api")
+        return firstLabel(node) ?? stringValue(properties.api_name);
+    if (node.kind === "native-export")
+        return (joined(properties.specifier, stringList(properties.requested_members).join(",")) ?? firstLabel(node));
+    if ([
+        "electron-main",
+        "electron-preload",
+        "electron-renderer",
+        "electron-utility",
+    ].includes(node.kind))
+        return joined(properties.declared_path, properties.resolved_path);
+    if (node.kind === "package")
+        return stringValue(properties.name);
+    return canonicalPath(node) ?? stringValue(properties.path);
+};
+const canonicalPath = (node) => node.identity.strategy === "canonical-path" ? node.identity.path : null;
+const firstProperties = (node) => node.observations[0]?.properties ?? {};
+const firstLabel = (node) => node.observations.find(({ label }) => label !== null)?.label ?? null;
+const uniqueStringProperty = (node, name) => {
+    const values = [
+        ...new Set(node.observations
+            .map(({ properties }) => properties[name])
+            .filter((value) => typeof value === "string")),
+    ];
+    return values.length === 1 ? (values[0] ?? null) : null;
+};
+const joined = (...values) => {
+    const strings = values.map(stringValue);
+    return strings.some((value) => value === null) ? null : strings.join("\0");
+};
+const stringValue = (value) => typeof value === "string" && value !== "" ? value : null;
+const stringList = (value) => Array.isArray(value)
+    ? value
+        .filter((item) => typeof item === "string")
+        .sort(compareCodePoints)
+    : [];
+const sortedNodes = (nodes) => [...nodes].sort((left, right) => compareCodePoints(left.node_id, right.node_id));

package/dist/domain/javascriptExportInstrumentation.js

@@ -0,0 +1,97 @@
+import { createHash } from "node:crypto";
+import { z } from "zod";
+const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+export const javascriptExportInstrumentationInputSchema = z.strictObject({
+    artifact_path: z.string().min(1).max(4_096),
+    artifact_sha256: digestSchema,
+    selection: z.strictObject({
+        byte_start: z.number().int().min(0),
+        byte_end: z.number().int().min(1),
+        selected_sha256: digestSchema,
+        export_name: z.string().regex(/^[A-Za-z_$][A-Za-z0-9_$]{0,199}$/u),
+    }),
+});
+export const javascriptExportTransformationManifestSchema = z.strictObject({
+    schema_version: z.literal(1),
+    kind: z.literal("commonjs-factory-export-v1"),
+    artifact_path: z.string().min(1).max(4_096),
+    original_sha256: digestSchema,
+    original_byte_length: z.number().int().min(0),
+    instrumented_sha256: digestSchema,
+    instrumented_byte_length: z.number().int().min(0),
+    selected_range: z.strictObject({
+        byte_start: z.number().int().min(0),
+        byte_end: z.number().int().min(1),
+        selected_sha256: digestSchema,
+    }),
+    inserted_ranges: z
+        .array(z.strictObject({
+        byte_start: z.number().int().min(0),
+        byte_end: z.number().int().min(1),
+        inserted_sha256: digestSchema,
+        purpose: z.enum(["factory-prefix", "export-binding", "factory-suffix"]),
+    }))
+        .length(3),
+    output_format: z.literal("commonjs-factory"),
+    source_map: z.literal(null),
+});
+/** Instrument one exact UTF-8 expression range without mutating source bytes. */
+export const instrumentJavaScriptExport = (source, rawInput) => {
+    const input = javascriptExportInstrumentationInputSchema.parse(rawInput);
+    if (sha256(source) !== input.artifact_sha256)
+        throw new TypeError("JavaScript instrumentation artifact digest mismatch");
+    const { byte_start: start, byte_end: end } = input.selection;
+    if (end <= start || end > source.byteLength)
+        throw new TypeError("JavaScript instrumentation selection is out of bounds");
+    const selected = source.slice(start, end);
+    if (sha256(selected) !== input.selection.selected_sha256)
+        throw new TypeError("JavaScript instrumentation selection digest mismatch");
+    decodeUtf8(source);
+    decodeUtf8(selected);
+    const prefix = encode("function(module, exports, require) {\n");
+    const binding = encode(`\nmodule.exports[${JSON.stringify(input.selection.export_name)}] = (${decodeUtf8(selected)});\n`);
+    const suffix = encode("}\n");
+    const bytes = concatenate([prefix, source, binding, suffix]);
+    const bindingStart = prefix.byteLength + source.byteLength;
+    const suffixStart = bindingStart + binding.byteLength;
+    const manifest = javascriptExportTransformationManifestSchema.parse({
+        schema_version: 1,
+        kind: "commonjs-factory-export-v1",
+        artifact_path: input.artifact_path,
+        original_sha256: input.artifact_sha256,
+        original_byte_length: source.byteLength,
+        instrumented_sha256: sha256(bytes),
+        instrumented_byte_length: bytes.byteLength,
+        selected_range: {
+            byte_start: start,
+            byte_end: end,
+            selected_sha256: input.selection.selected_sha256,
+        },
+        inserted_ranges: [
+            range(0, prefix, "factory-prefix"),
+            range(bindingStart, binding, "export-binding"),
+            range(suffixStart, suffix, "factory-suffix"),
+        ],
+        output_format: "commonjs-factory",
+        source_map: null,
+    });
+    return { bytes, manifest };
+};
+const range = (start, bytes, purpose) => ({
+    byte_start: start,
+    byte_end: start + bytes.byteLength,
+    inserted_sha256: sha256(bytes),
+    purpose,
+});
+const encode = (value) => new TextEncoder().encode(value);
+const decodeUtf8 = (value) => new TextDecoder("utf-8", { fatal: true }).decode(value);
+const concatenate = (values) => {
+    const output = new Uint8Array(values.reduce((total, value) => total + value.byteLength, 0));
+    let offset = 0;
+    for (const value of values) {
+        output.set(value, offset);
+        offset += value.byteLength;
+    }
+    return output;
+};
+const sha256 = (value) => createHash("sha256").update(value).digest("hex");

package/dist/domain/javascriptFeatureSeed.js

@@ -0,0 +1,140 @@
+import { compareCodePoints } from "./javascriptApplicationGraph.js";
+/** Locate every graph node matching a typed literal seed without regex execution. */
+export const findApplicationFeatureSeeds = (nodes, seed) => nodes
+    .flatMap((node) => seedMatch(node, seed))
+    .sort((left, right) => compareCodePoints(`${left.node_id}\0${left.basis}\0${left.field}`, `${right.node_id}\0${right.basis}\0${right.field}`));
+const seedMatch = (node, seed) => {
+    if (seed.kind === "node-id")
+        return node.node_id === seed.value
+            ? [
+                {
+                    node_id: node.node_id,
+                    kind: node.kind,
+                    basis: "node-id",
+                    field: "node_id",
+                },
+            ]
+            : [];
+    if (!kindMatches(node, seed.kind))
+        return [];
+    const mode = seed.match ?? (seed.kind === "string" ? "contains" : "exact");
+    const query = normalized(seed.value, seed.case_sensitive);
+    const match = candidateFields(node, seed.kind).find((candidate) => {
+        const value = normalized(candidate.value, seed.case_sensitive);
+        return mode === "exact" ? value === query : value.includes(query);
+    });
+    return match === undefined
+        ? []
+        : [
+            {
+                node_id: node.node_id,
+                kind: node.kind,
+                basis: match.basis,
+                field: match.field,
+            },
+        ];
+};
+const kindMatches = (node, kind) => {
+    if (kind === "string")
+        return true;
+    if (kind === "route")
+        return (node.kind === "endpoint" &&
+            node.observations.some(({ properties }) => properties.endpoint_kind === "route"));
+    if (kind === "api")
+        return node.kind === "context-bridge-api";
+    if (kind === "channel")
+        return node.kind === "ipc-channel";
+    if (kind === "module")
+        return ["javascript-asset", "javascript-module", "source-module"].includes(node.kind);
+    return node.kind === "native-export";
+};
+const candidateFields = (node, seedKind) => {
+    const fields = [
+        ...identityFields(node),
+        ...node.observations.flatMap((observation, index) => [
+            ...(observation.label === null
+                ? []
+                : [
+                    {
+                        basis: "label",
+                        field: `observations[${String(index)}].label`,
+                        value: observation.label,
+                    },
+                ]),
+            ...propertyFields(observation.properties, `observations[${String(index)}].properties`),
+        ]),
+    ];
+    if (seedKind === "string")
+        return fields;
+    const names = relevantFields[seedKind];
+    return fields.filter(({ field }) => names.some((name) => field === "identity" || field.endsWith(name)));
+};
+const relevantFields = {
+    route: [".label", ".value", ".path"],
+    api: [".label", ".api_name", ".key", ".methods", ".members"],
+    channel: [".label", ".channel", ".key"],
+    module: [
+        ".label",
+        ".module_key",
+        ".path",
+        ".source",
+        ".original_source",
+        ".exports",
+    ],
+    "native-export": [".label", ".key", ".requested_members", ".members"],
+};
+const identityFields = (node) => {
+    const identity = node.identity;
+    if (identity.strategy === "content-digest")
+        return [{ basis: "identity", field: "identity", value: identity.sha256 }];
+    if (identity.strategy === "source-map-original")
+        return [
+            {
+                basis: "identity",
+                field: "identity.original_source",
+                value: identity.original_source,
+            },
+        ];
+    if (identity.strategy === "canonical-path")
+        return [
+            { basis: "identity", field: "identity.path", value: identity.path },
+        ];
+    if (identity.strategy === "artifact-local-key")
+        return [{ basis: "identity", field: "identity.key", value: identity.key }];
+    if (identity.strategy === "runtime-instance")
+        return [
+            {
+                basis: "identity",
+                field: "identity.runtime_key",
+                value: identity.runtime_key,
+            },
+        ];
+    return [];
+};
+const propertyFields = (value, prefix) => {
+    const output = [];
+    const visit = (current, path, depth) => {
+        if (output.length >= 512 || depth > 6)
+            return;
+        if (typeof current === "string") {
+            output.push({ basis: "property", field: path, value: current });
+            return;
+        }
+        if (Array.isArray(current)) {
+            for (const [index, item] of current.entries())
+                visit(item, `${path}[${String(index)}]`, depth + 1);
+            return;
+        }
+        if (current !== null && typeof current === "object")
+            for (const key of Object.keys(current).sort(compareCodePoints))
+                visit(current[key] ?? null, `${path}.${key}`, depth + 1);
+    };
+    visit(value, prefix, 0);
+    return output;
+};
+const normalized = (value, caseSensitive) => {
+    const normalizedValue = value.normalize("NFKC");
+    return caseSensitive
+        ? normalizedValue
+        : normalizedValue.toLocaleLowerCase("en-US");
+};