rea-agents 1.7.0 → 2.1.0

package/dist/application/ElectronBoundaryGraphWindows.js

@@ -0,0 +1,223 @@
+import { artifactLocalIdentity, createElectronRoleNode, javascriptAnalysisCoverage, linkElectronRoleToAsset, } from "./JavaScriptArtifactGraphContext.js";
+import { astObservationEvidence } from "./JavaScriptArtifactGraphEvidence.js";
+import { addElectronAstEdge, addElectronInferenceEdge, electronFindingSourceNode, electronRangeKey, } from "./ElectronBoundaryGraphContext.js";
+import { resolveArtifactPathByContext } from "./JavaScriptArtifactPathResolution.js";
+/** Project BrowserWindow, contextBridge, preload, and utility-process facts. */
+export const addElectronWindowBoundaries = (context) => {
+    for (const analyzed of context.analysis.files) {
+        const { file, javascript } = analyzed;
+        if (javascript === null)
+            continue;
+        const coverage = javascriptAnalysisCoverage(javascript, context.input);
+        for (const value of javascript.electron.browser_windows) {
+            const source = electronFindingSourceNode(context, file, value.module_key);
+            if (source !== undefined)
+                addBrowserWindow({ context, file, source, value, coverage });
+        }
+        for (const value of javascript.electron.context_bridge_apis) {
+            const source = electronFindingSourceNode(context, file, value.module_key);
+            if (source !== undefined)
+                addContextBridge({ context, file, source, value, coverage });
+        }
+        for (const value of javascript.electron.utility_processes) {
+            const source = electronFindingSourceNode(context, file, value.module_key);
+            if (source !== undefined)
+                addUtilityProcess({ context, file, source, value, coverage });
+        }
+    }
+};
+const addBrowserWindow = (input) => {
+    const { context, file, value, coverage } = input;
+    const window = context.accumulator.addNode({
+        kind: "browser-window",
+        identity: artifactLocalIdentity(file.sha256, "electron-browser-window", electronRangeKey(value.location)),
+        observations: [
+            {
+                label: `BrowserWindow@${electronRangeKey(value.location)}`,
+                properties: {
+                    source_path: file.path,
+                    options_status: value.options_status,
+                    web_preferences_status: value.web_preferences_status,
+                    web_preferences: value.web_preferences,
+                    omitted_web_preferences: value.omitted_web_preferences,
+                    preload_path: value.preload_path,
+                    preload_resolution_context: value.preload_resolution_context,
+                    absence_means_default: false,
+                },
+                evidence: astObservationEvidence({
+                    sha256: file.sha256,
+                    path: file.path,
+                    range: value.location,
+                    operation: "observe-browser-window-construction",
+                    coverage,
+                    limitations: [
+                        "Only explicitly present webPreferences are reported; omitted properties are not interpreted as Electron defaults.",
+                    ],
+                }),
+            },
+        ],
+    });
+    addElectronAstEdge(context, {
+        source: input.source,
+        target: window,
+        file,
+        range: value.location,
+        coverage,
+        relation: "contains",
+        operation: "locate-browser-window-construction",
+        properties: { source_path: file.path },
+    });
+    addWindowPreload(input, window);
+};
+const addWindowPreload = (input, window) => {
+    const declared = input.value.preload_path;
+    if (declared === null)
+        return;
+    const resolution = resolveArtifactPathByContext({
+        declaredPath: declared,
+        sourcePath: input.file.path,
+        context: input.value.preload_resolution_context ?? "module-specifier",
+        files: input.context.filesByPath,
+    });
+    const role = createElectronRoleNode(input.context, {
+        kind: "electron-preload",
+        anchor: input.file,
+        resolution,
+        mechanism: "BrowserWindow:webPreferences.preload",
+        range: input.value.location,
+        coverage: input.coverage,
+    });
+    addElectronInferenceEdge(input.context, {
+        source: window,
+        target: role,
+        file: input.file,
+        range: input.value.location,
+        coverage: input.coverage,
+        relation: "loads",
+        operation: "associate-browser-window-preload",
+        properties: {
+            declared_path: declared,
+            resolution_context: resolution.resolution_context,
+            resolved_path: resolution.resolved_path,
+            resolution_status: resolution.resolution_status,
+            limitations: resolution.limitations,
+        },
+    });
+    linkElectronRoleToAsset(input.context, {
+        role,
+        anchor: input.file,
+        resolution,
+        range: input.value.location,
+        coverage: input.coverage,
+    });
+};
+const addContextBridge = (input) => {
+    const { context, file, value, coverage } = input;
+    const bridge = context.accumulator.addNode({
+        kind: "context-bridge-api",
+        identity: artifactLocalIdentity(file.sha256, "electron-context-bridge", `${value.world}:${value.api_key ?? value.api_key_expression ?? "[missing]"}:${electronRangeKey(value.location)}`),
+        observations: [
+            {
+                label: value.api_key,
+                properties: {
+                    world: value.world,
+                    world_id: value.world_id,
+                    api_key: value.api_key,
+                    api_key_expression: value.api_key_expression,
+                    api_status: value.api_status,
+                    members: value.members,
+                    unknown_members: value.unknown_members,
+                    omitted_members: value.omitted_members,
+                },
+                evidence: astObservationEvidence({
+                    sha256: file.sha256,
+                    path: file.path,
+                    range: value.location,
+                    operation: "observe-context-bridge-api",
+                    coverage,
+                }),
+            },
+        ],
+    });
+    addElectronInferenceEdge(context, {
+        source: input.source,
+        target: bridge,
+        file,
+        range: value.location,
+        coverage,
+        relation: "exposes",
+        operation: "map-context-bridge-exposure",
+        properties: {
+            world: value.world,
+            api_key: value.api_key,
+            resolution: value.api_key === null ? "dynamic" : "literal",
+        },
+    });
+};
+const addUtilityProcess = (input) => {
+    const { context, file, value, coverage } = input;
+    const utility = context.accumulator.addNode({
+        kind: "electron-utility",
+        identity: artifactLocalIdentity(file.sha256, "electron-utility-process", `${value.module_path ?? value.module_expression ?? "[missing]"}:${electronRangeKey(value.location)}`),
+        observations: [
+            {
+                label: value.service_name ?? value.module_path,
+                properties: {
+                    module_path: value.module_path,
+                    module_resolution_context: value.module_resolution_context,
+                    module_expression: value.module_expression,
+                    service_name: value.service_name,
+                },
+                evidence: astObservationEvidence({
+                    sha256: file.sha256,
+                    path: file.path,
+                    range: value.location,
+                    operation: "observe-utility-process-fork",
+                    coverage,
+                }),
+            },
+        ],
+    });
+    addElectronInferenceEdge(context, {
+        source: input.source,
+        target: utility,
+        file,
+        range: value.location,
+        coverage,
+        relation: "loads",
+        operation: "map-utility-process-launch",
+        properties: {
+            declared_path: value.module_path,
+            expression: value.module_expression,
+        },
+    });
+    if (value.module_path === null)
+        return;
+    const resolution = resolveArtifactPathByContext({
+        declaredPath: value.module_path,
+        sourcePath: file.path,
+        context: value.module_resolution_context ?? "module-specifier",
+        files: context.filesByPath,
+    });
+    const resolved = resolution.resolved_path;
+    const target = resolved === null
+        ? undefined
+        : (context.assetNodes.get(resolved) ?? context.fileNodes.get(resolved));
+    if (target === undefined)
+        return;
+    addElectronInferenceEdge(context, {
+        source: utility,
+        target,
+        file,
+        range: value.location,
+        coverage,
+        relation: "maps_to",
+        operation: "resolve-utility-process-entrypoint",
+        properties: {
+            declared_path: value.module_path,
+            resolution_context: resolution.resolution_context,
+            resolved_path: resolved,
+            resolution_status: resolution.resolution_status,
+        },
+    });
+};

package/dist/application/EnhancedToolPagination.js

@@ -0,0 +1,22 @@
+import { AnalysisOutputError } from "../domain/errors.js";
+import { parseAddressedPage } from "../domain/hopperValues.js";
+import { err, ok } from "../domain/result.js";
+/** Read all addressed entries while enforcing advancing provider pagination. */
+export const readAllAddressed = async (input) => {
+    const entries = [];
+    let offset = 0;
+    while (true) {
+        const result = await input.call(input.tool, { offset, limit: 500 }, input.signal);
+        if (!result.ok)
+            return result;
+        const page = parseAddressedPage(result.value);
+        if (!page.ok)
+            return page;
+        entries.push(...page.value.items);
+        if (!page.value.hasMore || page.value.nextOffset === null)
+            return ok(entries);
+        if (page.value.nextOffset <= offset)
+            return err(new AnalysisOutputError(input.tool, "provider returned a non-advancing pagination offset"));
+        offset = page.value.nextOffset;
+    }
+};

package/dist/application/EnhancedToolTypes.js

@@ -0,0 +1,4 @@
+import { AnalysisInputError } from "../domain/errors.js";
+import { err } from "../domain/result.js";
+import { enhancedInputSchemas, } from "../contracts/enhancedInputs.js";
+export const invalidEnhancedInput = (name, cause) => Promise.resolve(err(new AnalysisInputError(name, { cause })));

package/dist/application/EnhancedTools.js

@@ -1,81 +1,108 @@
 import { enhancedInputSchemas } from "../contracts/enhancedInputs.js";
-import { AnalysisInputError, AnalysisCancelledError, AnalysisOutputError, projectAnalysisError, } from "../domain/errors.js";
-import { addressDistance, parseDocuments, parseFunctionDossier, parseAddressedPage, parseListCount, parseRelatedAddresses, parseSegments, } from "../domain/hopperValues.js";
+import { AnalysisCancelledError, AnalysisOutputError, projectAnalysisError, } from "../domain/errors.js";
+import { addressDistance, parseAddressedPage, parseDocuments, parseFunctionDossier, parseListCount, parseRelatedAddresses, parseSegments, } from "../domain/hopperValues.js";
 import { err, ok } from "../domain/result.js";
 import { categorizeSwiftTypes, discoverObjcClasses, discoverObjcProtocols, discoverSwiftClasses, } from "../domain/symbolAnalysis.js";
+import { invalidEnhancedInput, } from "./EnhancedToolTypes.js";
+import { readAllAddressed } from "./EnhancedToolPagination.js";
 /**
  * Composes direct provider operations into bounded reverse-engineering tools.
- * Inputs are parsed again at this application boundary even though MCP normally
- * validates them, allowing direct callers to use the same service safely.
+ * Direct callers use `execute`; adapters that own validation use
+ * `executeValidated` so an MCP input is parsed exactly once.
  */
 export class EnhancedTools {
     analysis;
     constructor(analysis) {
         this.analysis = analysis;
     }
-    /** Parse inputs again at the direct-call boundary, then dispatch exhaustively. */
+    /** Parse an untrusted direct-call input once, then dispatch exhaustively. */
     execute(name, input, signal) {
         switch (name) {
             case "swift_classes": {
                 const parsed = enhancedInputSchemas.swift_classes.safeParse(input);
                 return parsed.success
-                    ? this.#swiftClasses(parsed.data.pattern, signal)
-                    : invalidInput(name, parsed.error);
+                    ? this.executeValidated({ name, input: parsed.data }, signal)
+                    : invalidEnhancedInput(name, parsed.error);
             }
             case "get_objc_classes": {
                 const parsed = enhancedInputSchemas.get_objc_classes.safeParse(input);
                 return parsed.success
-                    ? this.#objcClasses(parsed.data.pattern, signal)
-                    : invalidInput(name, parsed.error);
+                    ? this.executeValidated({ name, input: parsed.data }, signal)
+                    : invalidEnhancedInput(name, parsed.error);
             }
             case "get_objc_protocols":
-                return this.#objcProtocols(signal);
+                return this.executeValidated({ name, input: {} }, signal);
             case "batch_decompile": {
                 const parsed = enhancedInputSchemas.batch_decompile.safeParse(input);
                 return parsed.success
-                    ? this.#batchDecompile(parsed.data.addresses, signal)
-                    : invalidInput(name, parsed.error);
+                    ? this.executeValidated({ name, input: parsed.data }, signal)
+                    : invalidEnhancedInput(name, parsed.error);
             }
             case "get_call_graph": {
                 const parsed = enhancedInputSchemas.get_call_graph.safeParse(input);
                 return parsed.success
-                    ? this.#callGraph(parsed.data, signal)
-                    : invalidInput(name, parsed.error);
+                    ? this.executeValidated({ name, input: parsed.data }, signal)
+                    : invalidEnhancedInput(name, parsed.error);
             }
             case "analyze_swift_types":
-                return this.#analyzeSwiftTypes(signal);
+                return this.executeValidated({ name, input: {} }, signal);
             case "find_xrefs_to_name": {
                 const parsed = enhancedInputSchemas.find_xrefs_to_name.safeParse(input);
                 return parsed.success
-                    ? this.#findXrefs(parsed.data.name, signal)
-                    : invalidInput(name, parsed.error);
+                    ? this.executeValidated({ name, input: parsed.data }, signal)
+                    : invalidEnhancedInput(name, parsed.error);
             }
             case "binary_overview": {
                 const parsed = enhancedInputSchemas.binary_overview.safeParse(input);
                 return parsed.success
-                    ? this.#binaryOverview(parsed.data, signal)
-                    : invalidInput(name, parsed.error);
+                    ? this.executeValidated({ name, input: parsed.data }, signal)
+                    : invalidEnhancedInput(name, parsed.error);
             }
             case "analyze_function": {
                 const parsed = enhancedInputSchemas.analyze_function.safeParse(input);
                 return parsed.success
-                    ? this.#analyzeFunction(parsed.data, signal)
-                    : invalidInput(name, parsed.error);
+                    ? this.executeValidated({ name, input: parsed.data }, signal)
+                    : invalidEnhancedInput(name, parsed.error);
             }
             case "trace_feature": {
                 const parsed = enhancedInputSchemas.trace_feature.safeParse(input);
                 return parsed.success
-                    ? this.#traceFeature(parsed.data, signal)
-                    : invalidInput(name, parsed.error);
+                    ? this.executeValidated({ name, input: parsed.data }, signal)
+                    : invalidEnhancedInput(name, parsed.error);
             }
         }
     }
+    /** Dispatch input already parsed by a trusted adapter boundary. */
+    executeValidated(call, signal) {
+        switch (call.name) {
+            case "swift_classes":
+                return this.#swiftClasses(call.input.pattern, signal);
+            case "get_objc_classes":
+                return this.#objcClasses(call.input.pattern, signal);
+            case "get_objc_protocols":
+                return this.#objcProtocols(signal);
+            case "batch_decompile":
+                return this.#batchDecompile(call.input.addresses, signal);
+            case "get_call_graph":
+                return this.#callGraph(call.input, signal);
+            case "analyze_swift_types":
+                return this.#analyzeSwiftTypes(signal);
+            case "find_xrefs_to_name":
+                return this.#findXrefs(call.input.name, signal);
+            case "binary_overview":
+                return this.#binaryOverview(call.input, signal);
+            case "analyze_function":
+                return this.#analyzeFunction(call.input, signal);
+            case "trace_feature":
+                return this.#traceFeature(call.input, signal);
+        }
+    }
     async #analyzeFunction(input, signal) {
         const result = await this.#call("analyze_function", input, signal);
         return result.ok ? parseFunctionDossier(result.value) : result;
     }
     async #swiftClasses(pattern, signal) {
-        const procedures = await this.#allProcedures(signal);
+        const procedures = await this.#allAddressed("list_procedures", signal);
         return procedures.ok
             ? ok(discoverSwiftClasses(procedures.value, pattern))
             : procedures;
@@ -164,7 +191,7 @@ export class EnhancedTools {
         return ok(graph);
     }
     async #analyzeSwiftTypes(signal) {
-        const procedures = await this.#allProcedures(signal);
+        const procedures = await this.#allAddressed("list_procedures", signal);
         return procedures.ok
             ? ok(categorizeSwiftTypes(procedures.value))
             : procedures;
@@ -193,7 +220,7 @@ export class EnhancedTools {
         const [segmentsResult, documentsResult, procedures, stringsResult] = await Promise.all([
             this.#call("list_segments", {}, signal),
             this.#call("list_documents", {}, signal),
-            this.#allProcedures(signal),
+            this.#allAddressed("list_procedures", signal),
             this.#call("list_strings", {}, signal),
         ]);
         if (!segmentsResult.ok)
@@ -333,28 +360,12 @@ export class EnhancedTools {
             residual: [...residual],
         });
     }
-    async #allProcedures(signal) {
-        return this.#allAddressed("list_procedures", signal);
-    }
     async #allAddressed(tool, signal) {
-        const entries = [];
-        let offset = 0;
-        while (true) {
-            const result = await this.#call(tool, { offset, limit: 500 }, signal);
-            if (!result.ok)
-                return result;
-            const page = parseAddressedPage(result.value);
-            if (!page.ok)
-                return page;
-            entries.push(...page.value.items);
-            if (!page.value.hasMore || page.value.nextOffset === null) {
-                return ok(entries);
-            }
-            if (page.value.nextOffset <= offset) {
-                return err(new AnalysisOutputError(tool, "provider returned a non-advancing pagination offset"));
-            }
-            offset = page.value.nextOffset;
-        }
+        return readAllAddressed({
+            call: (name, arguments_, operationSignal) => this.#call(name, arguments_, operationSignal),
+            tool,
+            ...(signal === undefined ? {} : { signal }),
+        });
     }
     async #call(name, arguments_, signal) {
         if (signal?.aborted === true)
@@ -363,6 +374,3 @@ export class EnhancedTools {
         return execution.ok ? ok(execution.value.result) : execution;
     }
 }
-const invalidInput = (name, cause) => Promise.resolve(err(new AnalysisInputError(name, {
-    cause,
-})));

package/dist/application/InstrumentedJavaScriptReplayHost.js

@@ -0,0 +1,36 @@
+import { instrumentJavaScriptExport, } from "../domain/javascriptExportInstrumentation.js";
+/** Decorate one exact replay source with deterministic in-memory instrumentation. */
+export class InstrumentedJavaScriptReplayHost {
+    delegate;
+    input;
+    instrumentation = null;
+    constructor(delegate, input) {
+        this.delegate = delegate;
+        this.input = input;
+    }
+    async readSource(path, maximumBytes) {
+        const source = await this.delegate.readSource(path, maximumBytes);
+        if (path !== this.input.artifact_path)
+            return source;
+        const instrumented = instrumentJavaScriptExport(source.bytes, this.input);
+        if (instrumented.bytes.byteLength > maximumBytes)
+            throw new RangeError("Instrumented JavaScript exceeds the replay module byte limit");
+        this.instrumentation = instrumented;
+        return { canonicalPath: source.canonicalPath, bytes: instrumented.bytes };
+    }
+    identifyExecutable(path, versionArguments) {
+        return this.delegate.identifyExecutable(path, versionArguments);
+    }
+    identifyWorker() {
+        return this.delegate.identifyWorker();
+    }
+    identifyRuntimeClosure(nodePath) {
+        return this.delegate.identifyRuntimeClosure(nodePath);
+    }
+    seccompDigest() {
+        return this.delegate.seccompDigest();
+    }
+    probe(policy) {
+        return this.delegate.probe(policy);
+    }
+}

package/dist/application/InvestigationProviders.js

@@ -15,6 +15,36 @@ export const ARTIFACT_GRAPH_PROVIDER = {
     name: "REA safe artifact graph provider",
     version: "1",
 };
+/** Provider identity for execution-free managed PE/CLI analysis. */
+export const MANAGED_STATIC_PROVIDER = {
+    id: "rea-dotnet-static",
+    name: "REA managed static analysis provider",
+    version: "1",
+};
+/** Provider identity for deterministic managed-code comparison workflows. */
+export const MANAGED_WORKFLOW_PROVIDER = {
+    id: "rea-dotnet-workflows",
+    name: "REA managed-code workflows",
+    version: "1",
+};
+/** Provider identity for deterministic static JavaScript application analysis. */
+export const JAVASCRIPT_APPLICATION_PROVIDER = {
+    id: "rea-javascript-application",
+    name: "REA JavaScript application analyzer",
+    version: "1",
+};
+/** Provider identity for static/passive-runtime JavaScript reconciliation. */
+export const JAVASCRIPT_RUNTIME_RECONCILIATION_PROVIDER = {
+    id: "rea-javascript-runtime-reconciliation",
+    name: "REA JavaScript runtime reconciliation",
+    version: "1",
+};
+/** Provider identity for graph-native feature tracing and version comparison. */
+export const JAVASCRIPT_APPLICATION_WORKFLOW_PROVIDER = {
+    id: "rea-javascript-application-workflows",
+    name: "REA JavaScript application workflows",
+    version: "1",
+};
 /** Provider identity for deterministic cross-artifact comparisons. */
 export const ARTIFACT_COMPARISON_PROVIDER = {
     id: "rea-artifact-comparison",

package/dist/application/InvestigationWorkspaceStore.js

@@ -5,27 +5,41 @@ import { isJsonWithinLimits } from "../domain/jsonLimits.js";
 import { InvestigationWorkspaceError } from "../domain/errors.js";
 import { parseInvestigationWorkspace, serializeInvestigationWorkspace, } from "../domain/investigationWorkspace.js";
 import { err, ok } from "../domain/result.js";
+const investigationWorkspaceCodec = {
+    parse: parseInvestigationWorkspace,
+    serialize: serializeInvestigationWorkspace,
+    validateNext: validateNextRevision,
+};
 /** Read a validated workspace, returning null only when it does not exist. */
-export const readInvestigationWorkspace = async (path, policy) => {
+export const readInvestigationWorkspace = async (path, policy) => readRevisionedWorkspace(path, policy, investigationWorkspaceCodec);
+/** Read one root-confined, owner-only revisioned workspace document. */
+export const readRevisionedWorkspace = async (path, policy, codec) => {
     if (policy.roots.length === 0)
         return err(new InvestigationWorkspaceError("read", "disabled"));
     try {
         const destination = await resolveDestination(path, policy.roots);
         if (destination === null)
             return err(new InvestigationWorkspaceError("read", "outside-root"));
-        return await readWorkspaceFile(destination, policy);
+        return await readWorkspaceFile(destination, policy, codec);
     }
     catch (cause) {
         return err(new InvestigationWorkspaceError("read", "io", { cause }));
     }
 };
 /** Atomically append one CAS-linked workspace revision under an exclusive lock. */
-export const writeInvestigationWorkspace = async (workspace, path, expectedRevision, policy) => {
+export const writeInvestigationWorkspace = async (workspace, path, expectedRevision, policy) => writeRevisionedWorkspace(path, policy, {
+    document: workspace,
+    expectedRevision,
+    codec: investigationWorkspaceCodec,
+});
+/** Atomically append one validated CAS-linked revision under an exclusive lock. */
+export const writeRevisionedWorkspace = async (path, policy, input) => {
+    const { document, expectedRevision, codec } = input;
     if (policy.roots.length === 0)
         return err(new InvestigationWorkspaceError("update", "disabled"));
     let encoded;
     try {
-        encoded = serializeInvestigationWorkspace(workspace);
+        encoded = codec.serialize(document);
     }
     catch (cause) {
         return err(new InvestigationWorkspaceError("update", "integrity", { cause }));
@@ -42,10 +56,10 @@ export const writeInvestigationWorkspace = async (workspace, path, expectedRevis
         if (!acquired.ok)
             return acquired;
         lock = acquired.value;
-        const current = await readWorkspaceFile(destination, policy);
+        const current = await readWorkspaceFile(destination, policy, codec);
         if (!current.ok)
             return current;
-        const checked = validateNextRevision(current.value, workspace, expectedRevision);
+        const checked = codec.validateNext(current.value, document, expectedRevision);
         if (!checked.ok)
             return checked;
         await writeFileAtomic(destination, encoded, {
@@ -76,7 +90,7 @@ const resolveDestination = async (path, roots) => {
     }
     return null;
 };
-const readWorkspaceFile = async (destination, policy) => {
+const readWorkspaceFile = async (destination, policy, codec) => {
     const stats = await lstat(destination).catch((cause) => {
         if (isFileNotFound(cause))
             return undefined;
@@ -101,7 +115,7 @@ const readWorkspaceFile = async (destination, policy) => {
     if (!isJsonWithinLimits(decoded, policy))
         return err(new InvestigationWorkspaceError("read", "too-large"));
     try {
-        return ok(parseInvestigationWorkspace(decoded));
+        return ok(codec.parse(decoded));
     }
     catch (cause) {
         return err(new InvestigationWorkspaceError("read", "integrity", { cause }));
@@ -168,7 +182,7 @@ const releaseLock = async (lock) => {
     await lock.handle.close().catch(() => undefined);
     await unlink(lock.path).catch(() => undefined);
 };
-const validateNextRevision = (current, next, expectedRevision) => {
+function validateNextRevision(current, next, expectedRevision) {
     if ((current?.revision ?? null) !== expectedRevision)
         return err(new InvestigationWorkspaceError("update", "revision-conflict"));
     if (current === null) {
@@ -182,7 +196,7 @@ const validateNextRevision = (current, next, expectedRevision) => {
         next.previous_revision_digest === current.revision_digest
         ? ok(null)
         : err(new InvestigationWorkspaceError("update", "revision-conflict"));
-};
+}
 const isFileNotFound = (cause) => errorCode(cause) === "ENOENT";
 const isAlreadyExists = (cause) => errorCode(cause) === "EEXIST";
 const errorCode = (cause) => typeof cause === "object" && cause !== null && "code" in cause

package/dist/application/JavaScriptApplicationEvidence.js

@@ -0,0 +1,26 @@
+import { createEvidence, } from "../domain/evidence.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { JAVASCRIPT_APPLICATION_PROVIDER } from "./InvestigationProviders.js";
+/** Create Evidence v2 for one deterministic local JavaScript application graph. */
+export const createJavaScriptApplicationEvidence = (input, result) => createEvidence({
+    path: result.input_path,
+    sha256: result.root_artifact_sha256,
+    format: result.format,
+}, JAVASCRIPT_APPLICATION_PROVIDER, {
+    predicateType: "rea.javascript-application-analysis/v1",
+    operation: "analyze_javascript_application",
+    parameters: parameters(input),
+    result: jsonValueSchema.parse(result),
+    rawResult: null,
+    confidence: "derived",
+    authority: "shipped-artifact",
+    environment: null,
+    limitations: result.limitations,
+    locations: [{ kind: "artifact-path", path: "artifact-root" }],
+});
+const parameters = (input) => ({
+    format: input.format,
+    approved: input.approved,
+    source_map_read_approved: input.source_map_read_approved,
+    limits: input.limits,
+});