rea-agents 2.4.0 → 2.5.0

package/dist/application/EnhancedTools.js

@@ -1,10 +1,12 @@
 import { enhancedInputSchemas } from "../contracts/enhancedInputs.js";
 import { AnalysisCancelledError, AnalysisOutputError, projectAnalysisError, } from "../domain/errors.js";
-import { addressDistance, parseAddressedPage, parseDocuments, parseFunctionDossier, parseListCount, parseRelatedAddresses, parseSegments, } from "../domain/hopperValues.js";
+import { addressDistance, parseDocuments, parseFunctionDossier, parseListCount, parseRelatedAddresses, parseSegments, } from "../domain/hopperValues.js";
 import { err, ok } from "../domain/result.js";
 import { categorizeSwiftTypes, discoverObjcClasses, discoverObjcProtocols, discoverSwiftClasses, } from "../domain/symbolAnalysis.js";
 import { invalidEnhancedInput, } from "./EnhancedToolTypes.js";
 import { readAllAddressed } from "./EnhancedToolPagination.js";
+import { traceCallPath } from "./CallPathTracing.js";
+import { traceLiteralFeature } from "./EnhancedLiteralTracing.js";
 /**
  * Composes direct provider operations into bounded reverse-engineering tools.
  * Direct callers use `execute`; adapters that own validation use
@@ -17,6 +19,10 @@ export class EnhancedTools {
     }
     /** Parse an untrusted direct-call input once, then dispatch exhaustively. */
     execute(name, input, signal) {
+        if (name === "trace_feature" ||
+            name === "find_code_for_string" ||
+            name === "trace_call_path")
+            return this.#executeTracing(name, input, signal);
         switch (name) {
             case "swift_classes": {
                 const parsed = enhancedInputSchemas.swift_classes.safeParse(input);
@@ -64,12 +70,6 @@ export class EnhancedTools {
                     ? this.executeValidated({ name, input: parsed.data }, signal)
                     : invalidEnhancedInput(name, parsed.error);
             }
-            case "trace_feature": {
-                const parsed = enhancedInputSchemas.trace_feature.safeParse(input);
-                return parsed.success
-                    ? this.executeValidated({ name, input: parsed.data }, signal)
-                    : invalidEnhancedInput(name, parsed.error);
-            }
         }
     }
     /** Dispatch input already parsed by a trusted adapter boundary. */
@@ -94,9 +94,27 @@ export class EnhancedTools {
             case "analyze_function":
                 return this.#analyzeFunction(call.input, signal);
             case "trace_feature":
-                return this.#traceFeature(call.input, signal);
+                return traceLiteralFeature((name, arguments_, operationSignal) => this.#call(name, arguments_, operationSignal), call.input, "feature", signal);
+            case "find_code_for_string":
+                return traceLiteralFeature((name, arguments_, operationSignal) => this.#call(name, arguments_, operationSignal), call.input, "string", signal);
+            case "trace_call_path":
+                return traceCallPath((name, arguments_, operationSignal) => this.#call(name, arguments_, operationSignal), call.input, signal);
         }
     }
+    #executeTracing(name, input, signal) {
+        const parsed = enhancedInputSchemas[name].safeParse(input);
+        if (!parsed.success)
+            return invalidEnhancedInput(name, parsed.error);
+        if (name === "trace_call_path")
+            return this.executeValidated({
+                name,
+                input: enhancedInputSchemas.trace_call_path.parse(parsed.data),
+            }, signal);
+        return this.executeValidated({
+            name,
+            input: enhancedInputSchemas[name].parse(parsed.data),
+        }, signal);
+    }
     async #analyzeFunction(input, signal) {
         const result = await this.#call("analyze_function", input, signal);
         return result.ok ? parseFunctionDossier(result.value) : result;
@@ -217,18 +235,18 @@ export class EnhancedTools {
         });
     }
     async #binaryOverview(input, signal) {
-        const [segmentsResult, documentsResult, procedures, stringsResult] = await Promise.all([
+        const [segmentsResult, documentsResult, proceduresResult, stringsResult] = await Promise.all([
             this.#call("list_segments", {}, signal),
             this.#call("list_documents", {}, signal),
-            this.#allAddressed("list_procedures", signal),
-            this.#call("list_strings", {}, signal),
+            this.#call("list_procedures", { offset: 0, limit: 1 }, signal),
+            this.#call("list_strings", { offset: 0, limit: 1 }, signal),
         ]);
         if (!segmentsResult.ok)
             return segmentsResult;
         if (!documentsResult.ok)
             return documentsResult;
-        if (!procedures.ok)
-            return procedures;
+        if (!proceduresResult.ok)
+            return proceduresResult;
         if (!stringsResult.ok)
             return stringsResult;
         const segments = parseSegments(segmentsResult.value);
@@ -237,6 +255,9 @@ export class EnhancedTools {
         const documents = parseDocuments(documentsResult.value);
         if (!documents.ok)
             return documents;
+        const procedureCount = parseListCount(proceduresResult.value, "procedures");
+        if (!procedureCount.ok)
+            return procedureCount;
         const stringCount = parseListCount(stringsResult.value, "strings");
         if (!stringCount.ok)
             return stringCount;
@@ -249,117 +270,10 @@ export class EnhancedTools {
                 ? { name, start, end, length: addressDistance(start, end) }
                 : { name, start, end }),
             segment_count: segments.value.length,
-            procedure_count: procedures.value.length,
+            procedure_count: procedureCount.value,
             string_count: stringCount.value,
         });
     }
-    async #traceFeature(input, signal) {
-        const searched = await this.#literalMatches(input, signal);
-        if (!searched.ok)
-            return searched;
-        const residual = new Set();
-        const traced = await this.#traceReferences(searched.value.matches, input.limit, input.max_operations - searched.value.operations, signal);
-        if (!traced.ok)
-            return traced;
-        for (const reason of traced.value.residual)
-            residual.add(reason);
-        const operations = searched.value.operations + traced.value.operations;
-        if (operations >= input.max_operations)
-            residual.add("Investigation reached the operation budget.");
-        if (searched.value.matches.length >= input.limit)
-            residual.add("Literal matches reached the configured limit.");
-        return ok({
-            query: input.query,
-            search_mode: "literal",
-            operations_used: operations,
-            operation_budget: input.max_operations,
-            matches: searched.value.matches,
-            references: traced.value.references,
-            truncated: residual.size > 0,
-            residual_unknowns: [...residual],
-        });
-    }
-    async #literalMatches(input, signal) {
-        let operations = 0;
-        const matches = [];
-        const needle = input.case_sensitive
-            ? input.query
-            : input.query.toLowerCase();
-        for (const [tool, type] of [
-            ["list_strings", "string"],
-            ["list_procedures", "procedure"],
-        ]) {
-            let offset = 0;
-            while (operations < input.max_operations &&
-                matches.length < input.limit) {
-                operations += 1;
-                const result = await this.#call(tool, { offset, limit: 500 }, signal);
-                if (!result.ok)
-                    return result;
-                const page = parseAddressedPage(result.value);
-                if (!page.ok)
-                    return page;
-                for (const item of page.value.items) {
-                    const haystack = input.case_sensitive
-                        ? item.name
-                        : item.name.toLowerCase();
-                    if (haystack.includes(needle))
-                        matches.push({ type, address: item.address, value: item.name });
-                    if (matches.length >= input.limit)
-                        break;
-                }
-                if (!page.value.hasMore || page.value.nextOffset === null)
-                    break;
-                offset = page.value.nextOffset;
-            }
-        }
-        return ok({ matches, operations });
-    }
-    async #traceReferences(matches, limit, operationBudget, signal) {
-        let operations = 0;
-        const references = [];
-        const residual = new Set();
-        for (const match of matches) {
-            if (operations >= operationBudget) {
-                residual.add("Reference traversal stopped at the operation budget.");
-                break;
-            }
-            operations += 1;
-            const xrefs = await this.#call("xrefs", { address: match.address }, signal);
-            if (!xrefs.ok)
-                return xrefs;
-            if (!Array.isArray(xrefs.value))
-                return err(new AnalysisOutputError("xrefs", "provider returned a non-array result"));
-            for (const source of xrefs.value) {
-                if (typeof source !== "string")
-                    return err(new AnalysisOutputError("xrefs", "provider returned a non-address value"));
-                if (operations >= operationBudget) {
-                    residual.add("Containing-procedure resolution stopped at the operation budget.");
-                    break;
-                }
-                operations += 1;
-                const resolved = await this.#call("resolve_containing_procedure", { address: source }, signal);
-                if (!resolved.ok)
-                    return resolved;
-                references.push({
-                    target_address: match.address,
-                    source_address: source,
-                    containing_procedure: resolved.value,
-                });
-                if (references.length >= limit) {
-                    residual.add("Reference results reached the configured limit.");
-                    break;
-                }
-            }
-            if (references.length >= limit)
-                break;
-        }
-        return ok({
-            references,
-            operations,
-            residual: [...residual],
-        });
-    }
     async #allAddressed(tool, signal) {
         return readAllAddressed({
             call: (name, arguments_, operationSignal) => this.#call(name, arguments_, operationSignal),

package/dist/application/JavaScriptApplicationWorkflowEvidence.js

@@ -40,6 +40,19 @@ export const createApplicationVersionComparisonEvidence = (parameters, result) =
     limitations: result.limitations,
     evidenceLinks: result.evidence_links,
 });
+/** Create derived Evidence for one historical-source to bundle comparison. */
+export const createSourceToBundleComparisonEvidence = (parameters, result) => createEvidence(undefined, JAVASCRIPT_APPLICATION_WORKFLOW_PROVIDER, {
+    predicateType: "rea.source-to-bundle-comparison/v1",
+    operation: "compare_source_to_bundle",
+    parameters,
+    result: jsonValueSchema.parse(result),
+    rawResult: null,
+    confidence: "inferred",
+    authority: "analyst-inference",
+    environment: null,
+    limitations: result.limitations,
+    evidenceLinks: result.evidence_links,
+});
 /** Create derived Evidence for one bounded static export-shape comparison. */
 export const createJavaScriptExportShapeComparisonEvidence = (parameters, result) => createEvidence(undefined, JAVASCRIPT_APPLICATION_WORKFLOW_PROVIDER, {
     predicateType: "rea.javascript-export-shape-comparison/v1",

package/dist/application/JavaScriptApplicationWorkflowService.js

@@ -8,8 +8,10 @@ import { compareJavaScriptExportShapesInputSchema } from "../domain/javascriptEx
 import { traceApplicationFeature } from "../domain/javascriptFeatureTrace.js";
 import { traceApplicationFeatureInputSchema } from "../domain/javascriptFeatureTraceSchemas.js";
 import { err, ok } from "../domain/result.js";
+import { compareSourceToBundle } from "../domain/sourceToBundleComparison.js";
+import { compareSourceToBundleInputSchema } from "../domain/sourceToBundleComparisonSchemas.js";
 import { parseApplicationGraphEvidence, parseNativeApplicationEvidence, } from "./JavaScriptApplicationEvidenceGraph.js";
-import { createApplicationFeatureTraceEvidence, createApplicationVersionComparisonEvidence, createJavaScriptExportShapeComparisonEvidence, } from "./JavaScriptApplicationWorkflowEvidence.js";
+import { createApplicationFeatureTraceEvidence, createApplicationVersionComparisonEvidence, createJavaScriptExportShapeComparisonEvidence, createSourceToBundleComparisonEvidence, } from "./JavaScriptApplicationWorkflowEvidence.js";
 /** Authenticate Evidence and derive one bounded cross-layer feature trace. */
 export const traceApplicationFeatureEvidence = (rawInput) => {
     const operation = "trace_application_feature";
@@ -87,6 +89,30 @@ export const compareApplicationVersionsEvidenceValidated = (input) => {
         return workflowFailure(operation, cause);
     }
 };
+/** Compare source and bundle inputs already parsed by a trusted adapter. */
+export const compareSourceToBundleEvidenceValidated = (input) => {
+    const operation = "compare_source_to_bundle";
+    try {
+        const application = parseApplicationGraphEvidence(input.application);
+        const result = compareSourceToBundle({
+            reference: input.reference,
+            application: {
+                evidenceId: application.evidence.evidence_id,
+                rootArtifactSha256: application.rootArtifactSha256,
+                graph: application.graph,
+            },
+            limits: input.limits,
+        });
+        return ok(createSourceToBundleComparisonEvidence({
+            reference_root_sha256: input.reference.root_sha256,
+            application_evidence_id: application.evidence.evidence_id,
+            limits: input.limits,
+        }, result));
+    }
+    catch (cause) {
+        return workflowFailure(operation, cause);
+    }
+};
 /**
  * Authenticate both graphs and compare one exact export return shape.
  * @public

package/dist/application/JavaScriptRuntimeObservationEvidence.js

@@ -0,0 +1,34 @@
+import { createEvidence, } from "../domain/evidence.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+/** Create deterministic Evidence v2 for one passive Inspector operation. */
+export const createJavaScriptRuntimeObservationEvidence = (operation, input, result, provider) => createEvidence(undefined, provider, {
+    predicateType: operation === "list_javascript_runtime_targets"
+        ? "rea.javascript-runtime-target-list/v1"
+        : "rea.javascript-runtime-observation/v1",
+    operation,
+    parameters: parameters(input),
+    result: jsonValueSchema.parse(result),
+    rawResult: null,
+    confidence: "observed",
+    authority: "external-service",
+    environment: {
+        id: `${result.runtime.product}@${result.runtime.protocol_version}`,
+        platform: process.platform,
+        architecture: process.arch,
+        isolation: "none",
+    },
+    limitations: result.limitations,
+});
+const parameters = (input) => ({
+    inspector_endpoint: input.inspector_endpoint,
+    allowed_file_roots: input.allowed_file_roots,
+    allowed_origins: input.allowed_origins,
+    ...("target_id" in input
+        ? {
+            target_id: input.target_id,
+            runtime_kind: input.runtime_kind,
+            observation_ms: input.observation_ms,
+            limits: input.limits,
+        }
+        : { offset: input.offset, limit: input.limit }),
+});

package/dist/application/JavaScriptRuntimeObservationPort.js

@@ -0,0 +1 @@
+export {};

package/dist/application/JavaScriptRuntimeObservationService.js

@@ -0,0 +1,46 @@
+import { createJavaScriptRuntimeObservationEvidence } from "./JavaScriptRuntimeObservationEvidence.js";
+import { AnalysisCapabilityUnavailableError, AnalysisProtocolError, PermissionRequiredError, } from "../domain/errors.js";
+import { err, ok } from "../domain/result.js";
+/** Authorize and list attachable Node/Electron Inspector targets. */
+export const listJavaScriptRuntimeTargets = async (provider, authority, input, options = {}) => {
+    const ready = await prepare(provider, authority, input, "list_javascript_runtime_targets");
+    if (!ready.ok)
+        return ready;
+    const result = await ready.value.listTargets(input, options);
+    return result.ok
+        ? ok(createJavaScriptRuntimeObservationEvidence("list_javascript_runtime_targets", input, result.value, ready.value.identity()))
+        : result;
+};
+/** Authorize one bounded attach-only Inspector observation. */
+export const observeJavaScriptRuntime = async (provider, authority, input, options = {}) => {
+    const ready = await prepare(provider, authority, input, "observe_javascript_runtime");
+    if (!ready.ok)
+        return ready;
+    const result = await ready.value.observe(input, options);
+    return result.ok
+        ? ok(createJavaScriptRuntimeObservationEvidence("observe_javascript_runtime", input, result.value, ready.value.identity()))
+        : result;
+};
+const prepare = async (provider, authority, input, operation) => {
+    if (authority === undefined)
+        return err(new AnalysisCapabilityUnavailableError("rea-v8-inspector", operation, "V8 Inspector observation permission policy is not configured"));
+    const authorized = await authority.authorize({
+        capability: "v8_inspector_observe",
+        roots: input.allowed_file_roots,
+        executables: [],
+        environment_names: [],
+        origins: [input.inspector_endpoint, ...input.allowed_origins],
+        network: "loopback",
+        mount: false,
+        operation_identity: `${operation}:${"target_id" in input ? input.target_id : input.inspector_endpoint}`,
+    }, "read");
+    if (!authorized.ok)
+        return err(authorized.error instanceof PermissionRequiredError
+            ? authorized.error
+            : new AnalysisProtocolError(authorized.error.message, {
+                cause: authorized.error,
+            }));
+    return provider === undefined
+        ? err(new AnalysisCapabilityUnavailableError("rea-v8-inspector", operation, "V8 Inspector observation provider is not configured"))
+        : ok(provider);
+};

package/dist/application/JavaScriptSemanticGraphAsyncProjection.js

@@ -0,0 +1,147 @@
+import { createJavaScriptSemanticGraphUnknown } from "../domain/javascriptSemanticGraph.js";
+import { addSemanticGraphNode, addSemanticGraphRelation, addSemanticGraphUnknown, constructSemanticGraphNode, } from "./JavaScriptSemanticGraphConstruction.js";
+import { unknownSemanticEvidence } from "./JavaScriptSemanticGraphEvidence.js";
+import { semanticCallSiteAt, } from "./JavaScriptSemanticGraphFlowProjection.js";
+/** Project literal EventEmitter registrations, removals, and dispatches. */
+export const projectSemanticEvents = (context) => {
+    const eventNodes = new Map();
+    for (const operation of context.ir.eventOperations) {
+        const eventKey = operation.eventName === null
+            ? operation.eventId
+            : `${operation.emitterKey}\u0000${operation.eventName}`;
+        const event = eventNodes.get(eventKey) ?? addEventNode(context, operation, eventKey);
+        if (event === null)
+            continue;
+        eventNodes.set(eventKey, event);
+        const relation = eventRelation(operation);
+        if (operation.kind === "dispatch")
+            addSemanticGraphRelation(context.state, {
+                source: eventEmitterNode(context, operation),
+                target: event,
+                relation,
+                resolution: operation.resolution === "complete" ? "resolved" : "candidate",
+            });
+        else {
+            const listener = addListenerNode(context, operation);
+            addSemanticGraphRelation(context.state, {
+                source: event,
+                target: listener,
+                relation,
+                resolution: operation.resolution === "complete" ? "resolved" : "candidate",
+            });
+        }
+        if (operation.resolution !== "complete")
+            addEventUnknown(context, operation, event, relation);
+    }
+};
+const addEventNode = (context, operation, eventKey) => addSemanticGraphNode(context.state, constructSemanticGraphNode(context.file, {
+    kind: "event",
+    roleKey: `event:${eventKey}`,
+    location: operation.eventName === null ? operation.location : null,
+    label: operation.eventName,
+    functionNodeId: null,
+    properties: {
+        emitter_key: operation.emitterKey,
+        event_name: operation.eventName,
+    },
+}, context.state));
+const addListenerNode = (context, operation) => addSemanticGraphNode(context.state, constructSemanticGraphNode(context.file, {
+    kind: "listener",
+    roleKey: `listener:${operation.eventId}`,
+    location: operation.listenerLocation ?? operation.location,
+    label: operation.eventName === null
+        ? operation.method
+        : `${operation.method}:${operation.eventName}`,
+    functionNodeId: operation.ownerCallableId === null
+        ? null
+        : (context.callableNodes.get(operation.ownerCallableId)?.node_id ??
+            null),
+    properties: {
+        emitter_key: operation.emitterKey,
+        event_name: operation.eventName,
+        method: operation.method,
+    },
+}, context.state));
+const eventEmitterNode = (context, operation) => (operation.emitterBindingId === null
+    ? undefined
+    : context.bindingNodes.get(operation.emitterBindingId)) ??
+    (operation.ownerCallableId === null
+        ? context.moduleNode
+        : (context.callableNodes.get(operation.ownerCallableId) ??
+            context.moduleNode));
+const eventRelation = (operation) => operation.kind === "register"
+    ? "registers-listener"
+    : operation.kind === "remove"
+        ? "removes-listener"
+        : "dispatches-candidate";
+const addEventUnknown = (context, operation, event, relation) => {
+    addSemanticGraphUnknown(context.state, createJavaScriptSemanticGraphUnknown({
+        node_id: event.node_id,
+        family: "event",
+        relation_kinds: [relation],
+        reason: "ambiguous-target",
+        detail: operation.eventName === null
+            ? `Dynamic ${operation.method} event name remains unresolved.`
+            : `Static ${operation.method} emitter identity is partial.`,
+        candidate_node_ids: [],
+        evidence: unknownSemanticEvidence(context.file, operation.location),
+    }));
+};
+/** Project Node timer scheduling and exact local handle cancellation. */
+export const projectSemanticTimers = (context) => {
+    const timerNodes = new Map(context.ir.timerOperations.flatMap((operation) => {
+        if (operation.kind !== "schedule")
+            return [];
+        const owner = operation.ownerCallableId === null
+            ? undefined
+            : context.callableNodes.get(operation.ownerCallableId);
+        const timer = addSemanticGraphNode(context.state, constructSemanticGraphNode(context.file, {
+            kind: "timer",
+            roleKey: operation.timerId,
+            location: operation.location,
+            label: operation.method,
+            functionNodeId: owner?.node_id ?? null,
+            properties: {
+                delay_milliseconds: operation.delayMilliseconds,
+                method: operation.method,
+            },
+        }, context.state));
+        return timer === null ? [] : [[operation.timerId, timer]];
+    }));
+    for (const operation of context.ir.timerOperations)
+        if (operation.kind === "schedule")
+            projectTimerSchedule(context, operation, timerNodes);
+        else
+            projectTimerCancellation(context, operation, timerNodes);
+};
+const projectTimerSchedule = (context, operation, timerNodes) => {
+    addSemanticGraphRelation(context.state, {
+        source: semanticCallSiteAt(context, operation.location),
+        target: timerNodes.get(operation.timerId),
+        relation: "schedules-timer",
+        resolution: "resolved",
+    });
+};
+const projectTimerCancellation = (context, operation, timerNodes) => {
+    const callSite = semanticCallSiteAt(context, operation.location);
+    const target = operation.linkedTimerId === null
+        ? undefined
+        : timerNodes.get(operation.linkedTimerId);
+    addSemanticGraphRelation(context.state, {
+        source: callSite,
+        target,
+        relation: "cancels-timer",
+        resolution: operation.resolution === "complete" ? "resolved" : "candidate",
+    });
+    if (operation.resolution === "complete")
+        return;
+    addSemanticGraphUnknown(context.state, createJavaScriptSemanticGraphUnknown({
+        node_id: callSite?.node_id ?? null,
+        family: "timer",
+        relation_kinds: ["cancels-timer"],
+        reason: "ambiguous-target",
+        detail: `Static ${operation.method} handle resolution was ${operation.resolution}.`,
+        candidate_node_ids: [],
+        evidence: unknownSemanticEvidence(context.file, operation.location),
+    }));
+};

package/dist/application/JavaScriptSemanticGraphBuilder.js

@@ -1,16 +1,25 @@
 import { createJavaScriptSemanticGraph, } from "../domain/javascriptSemanticGraph.js";
 import { JAVASCRIPT_SEMANTIC_RELATION_FAMILIES, JAVASCRIPT_SEMANTIC_RELATION_FAMILY, } from "../domain/javascriptSemanticGraphSchemas.js";
+import { sourceRangesEqual as rangesEqual } from "../domain/javascriptStaticAnalysisHelpers.js";
+import { projectSemanticEvents, projectSemanticTimers, } from "./JavaScriptSemanticGraphAsyncProjection.js";
+import { projectSemanticChildProcesses } from "./JavaScriptSemanticGraphChildProcessProjection.js";
+import { projectSemanticBoundaries, projectSemanticConfiguration, projectSemanticRequests, } from "./JavaScriptSemanticGraphDataProjection.js";
+import { projectSemanticResources } from "./JavaScriptSemanticGraphResourceProjection.js";
+import { projectSemanticObjects } from "./JavaScriptSemanticGraphObjectProjection.js";
+import { projectSemanticValues } from "./JavaScriptSemanticGraphValueProjection.js";
 import { inferredSemanticEvidenceAt } from "./JavaScriptSemanticGraphEvidence.js";
-import { projectSemanticClosureCaptures, projectSemanticFrontiers, projectSemanticReturnValues, semanticRecoveryLimits, } from "./JavaScriptSemanticGraphFlowProjection.js";
-import { owningSemanticCallableNode, semanticFamilyStatus, semanticNodesWithinRange, semanticRangesEqual as rangesEqual, } from "./JavaScriptSemanticGraphProjection.js";
+import { projectSemanticFunctionFingerprints } from "./JavaScriptSemanticGraphFingerprintProjection.js";
+import { projectSemanticClosureCaptures, projectSemanticFrontiers, projectSemanticPromises, projectSemanticReturnValues, semanticRecoveryLimits, } from "./JavaScriptSemanticGraphFlowProjection.js";
+import { owningSemanticCallableNode, semanticFamilyStatus, semanticNodesWithinRange, } from "./JavaScriptSemanticGraphProjection.js";
 import { addSemanticFallbackRoot as addFallbackRoot, addSemanticGraphNode as addNode, addSemanticGraphRelation as addRelation, constructSemanticGraphNode as semanticNode, createSemanticGraphProjectionState as emptyState, MAX_APPLICATION_NODE_IDS_PER_SEMANTIC_NODE, MAX_SEMANTIC_GRAPH_NODES, MAX_SEMANTIC_GRAPH_RELATIONS, MAX_SEMANTIC_GRAPH_UNKNOWNS, } from "./JavaScriptSemanticGraphConstruction.js";
 /** Project bounded per-file semantic IR into an artifact-bound companion graph. */
 export const buildJavaScriptSemanticGraph = ({ rootArtifactSha256, applicationGraph, analysis, }) => {
     const state = emptyState(applicationGraph);
+    const fingerprints = [];
     for (const analyzed of analysis.files) {
         if (analyzed.semantic === null)
             continue;
-        projectFile(analyzed.file, analyzed.semantic.ir, state);
+        fingerprints.push(...projectFile(analyzed.file, analyzed.semantic.ir, state));
     }
     if (state.roots.size === 0)
         addFallbackRoot(rootArtifactSha256, state);
@@ -25,7 +34,7 @@ export const buildJavaScriptSemanticGraph = ({ rootArtifactSha256, applicationGr
         root_node_ids: [...state.roots],
         nodes: [...state.nodes.values()],
         relations: [...state.relations.values()],
-        fingerprints: [],
+        fingerprints,
         unknowns,
         coverage: {
             status: truncated ? "partial" : "unknown",
@@ -68,7 +77,15 @@ export const buildJavaScriptSemanticGraph = ({ rootArtifactSha256, applicationGr
         limitations: [
             "The semantic graph contains static syntax observations and conservative relationship candidates; it does not claim runtime execution.",
             "Local data flow does not claim control-flow-sensitive reaching definitions or arbitrary dynamic property resolution.",
-            "Function fingerprints and promise, event, process, request, boundary, timer, configuration, and resource extraction are not available in this graph version's current extractor coverage.",
+            "Promise ownership covers explicit unshadowed Promise construction, static factories, aggregation, chaining, and await syntax only.",
+            "Function fingerprints are bounded static candidates; equal digests can remain ambiguous and do not prove behavioral equivalence.",
+            "Event extraction covers EventEmitter-style literal registrations, removals, and dispatch candidates; dynamic names remain unknown.",
+            "Timer extraction covers global or node:timers scheduling and exact local-handle cancellation.",
+            "Child-process extraction covers asynchronous node:child_process creation, literal argv/env/stdio options, exit/error listeners, and kill signals.",
+            "Configuration extraction covers process.env, process.argv, node:fs reads, and direct logical defaults.",
+            "Request extraction covers fetch, WebSocket, node:http/node:https construction, direct option fields, and exact local response consumers.",
+            "Boundary extraction covers unshadowed JSON/global coercions plus parse and validation method candidates.",
+            "Resource extraction covers built-in filesystem/network acquisition and exact local close/destroy/end handles.",
             ...(truncated
                 ? [
                     "Semantic graph projection reached one or more explicit hard limits.",
@@ -86,7 +103,7 @@ const projectFile = (file, ir, state) => {
         functionNodeId: null,
     }, state));
     if (moduleNode === null)
-        return;
+        return [];
     state.roots.add(moduleNode.node_id);
     const callableNodes = new Map(ir.callables.flatMap((callable) => {
         const node = addNode(state, semanticNode(file, {
@@ -130,9 +147,20 @@ const projectFile = (file, ir, state) => {
         ])),
     };
     projectDefinitionsAndReferences(context);
+    projectSemanticValues(context);
+    projectSemanticObjects(context);
     projectCalls(context);
+    projectSemanticPromises(context);
+    projectSemanticEvents(context);
+    projectSemanticTimers(context);
+    projectSemanticChildProcesses(context);
+    projectSemanticConfiguration(context);
+    projectSemanticRequests(context);
+    projectSemanticBoundaries(context);
+    projectSemanticResources(context);
     projectSemanticClosureCaptures(context);
     projectSemanticFrontiers(context);
+    return projectSemanticFunctionFingerprints(file, ir, callableNodes);
 };
 const createReturnSiteNodes = (file, ir, callables, state) => {
     const result = new Map();