rea-agents 6.1.0 → 6.3.0

package/dist/domain/javascript/electronActiveObservation.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
-import { isAbsoluteLocalPath, localPathStringSchema } from "../localPath.js";
-const pathInputSchema = localPathStringSchema.refine(isAbsoluteLocalPath, {
+import { isAbsolute } from "node:path";
+import { localPathStringSchema } from "../localPath.js";
+const pathInputSchema = localPathStringSchema.refine(isAbsolute, {
     message: "Electron executable, application, and root paths must be absolute local filesystem paths (for example /Applications/Electron.app/Contents/MacOS/Electron)",
 });
 const absolutePathSchema = z
@@ -61,61 +62,16 @@ export const electronActiveObservationInputSchema = z.strictObject({
         .optional()
         .describe("Absolute local filesystem root for application-relative paths; omit to derive it from the application path. Relative paths are rejected."),
     args: z
-        .array(z.string().regex(/^[^\0]*$/u, "Electron arguments must not contain NUL"))
+        .array(z
+        .string()
+        .regex(/^[^\x00]*$/u, "Electron arguments must not contain NUL"))
         .default([]),
     actions: z.array(actionSchema).default([]),
 });
-const ipcEventSchema = z.strictObject({
-    sequence: z.number().int().min(1),
-    correlation_id: z.string().nullable().default(null),
-    kind: z.enum([
-        "main-handler-invocation",
-        "main-event-invocation",
-        "utility-process-fork",
-        "utility-process-message",
-        "ipc-main-to-renderer",
-        "ipc-utility-to-main",
-        "ipc-renderer-send",
-        "ipc-renderer-invoke",
-        "ipc-renderer-post-message",
-    ]),
-    event: z.string().nullable().optional(),
-    phase: z
-        .enum(["attempted", "completed", "blocked", "failed", "observed"])
-        .nullable()
-        .optional(),
-    channel: z.string().nullable(),
-    direction: z
-        .enum([
-        "renderer-to-main",
-        "main-to-renderer",
-        "main-to-utility",
-        "utility-to-main",
-    ])
-        .nullable()
-        .optional(),
-    sender: z.string().nullable().optional(),
-    receiver: z.string().nullable().optional(),
-    frame: z.string().nullable().default(null),
-    target: z.string().nullable().optional(),
-    argument_shapes: z.array(z.string()),
-    result_shape: z.string().nullable(),
-    process_type: z.string().nullable(),
-    source: z.string().default("electron-active-hook"),
-    capture_method: z
-        .enum(["api-wrapper", "event-emitter", "process-hook"])
-        .default("api-wrapper"),
-    artifact_path: z.string().nullable().default(null),
-    artifact_sha256: z
-        .string()
-        .regex(/^[a-f0-9]{64}$/u)
-        .nullable()
-        .default(null),
-    error: z.boolean(),
-});
-const timelineEventSchema = z.strictObject({
+/** Canonical active Electron event shared by the hook boundary and public timeline. */
+export const electronActiveTimelineEventSchema = z.strictObject({
     sequence: z.number().int().min(1),
-    correlation_id: z.string().nullable().default(null),
+    correlation_id: z.string().nullable(),
     kind: z.enum([
         "main-handler-invocation",
         "main-event-invocation",
@@ -168,6 +124,19 @@ const timelineEventSchema = z.strictObject({
         .nullable(),
     error: z.boolean(),
 });
+const ipcEventSchema = electronActiveTimelineEventSchema.extend({
+    kind: z.enum([
+        "main-handler-invocation",
+        "main-event-invocation",
+        "utility-process-fork",
+        "utility-process-message",
+        "ipc-main-to-renderer",
+        "ipc-utility-to-main",
+        "ipc-renderer-send",
+        "ipc-renderer-invoke",
+        "ipc-renderer-post-message",
+    ]),
+});
 const processMetricSchema = z.strictObject({
     pid: z.number().int().min(1),
     type: z.string().min(1),
@@ -237,17 +206,14 @@ export const electronActiveObservationResultSchema = z.strictObject({
     ipc: z.strictObject({
         events: z.array(ipcEventSchema),
         observed: z.number().int().min(0),
-        dropped: z.number().int().min(0).nullable().default(null),
+        dropped: z.number().int().min(0),
     }),
-    timeline: z
-        .strictObject({
-        events: z.array(timelineEventSchema),
+    timeline: z.strictObject({
+        events: z.array(electronActiveTimelineEventSchema),
         observed: z.number().int().min(0),
-        dropped: z.number().int().min(0).nullable().default(null),
-    })
-        .default({ events: [], observed: 0, dropped: null }),
-    retention: z
-        .strictObject({
+        dropped: z.number().int().min(0),
+    }),
+    retention: z.strictObject({
         budget_bytes: z.number().int().min(0),
         estimated_retained_bytes: z.number().int().min(0),
         event_serialized_byte_upper_bound: z.number().int().min(0),
@@ -265,15 +231,7 @@ export const electronActiveObservationResultSchema = z.strictObject({
         dropped_ipc: z.number().int().min(0),
         observed_runtime: z.number().int().min(0),
         dropped_runtime: z.number().int().min(0),
-    })
-        .nullable()
-        .default(null),
-    coverage: coverageSchema.default({
-        status: "partial_attach",
-        observed_event_families: [],
-        unavailable_event_families: [],
-        observed_roles: [],
-        pre_capture_activity: "unavailable",
     }),
+    coverage: coverageSchema,
     limitations: z.array(z.string()),
 });

package/dist/domain/javascript/electronObservation.js

@@ -80,9 +80,20 @@ export const electronPageInspectionSchema = z.object({
             script_key: prefixedDigestSchema("electron_script"),
             frame_id: z.string().nullable().default(null),
             file_path: z.string(),
-            cdp_hash: z.string(),
-            length: z.number().int().min(0),
-            is_module: z.boolean(),
+            cdp_hash: z
+                .string()
+                .nullable()
+                .describe("Producer-reported script hash; null when unavailable."),
+            length: z
+                .number()
+                .int()
+                .min(0)
+                .nullable()
+                .describe("Producer-reported script length; null when unavailable."),
+            is_module: z
+                .boolean()
+                .nullable()
+                .describe("Producer-reported module classification; null when unavailable."),
             language: z.string().nullable(),
             source: electronSourceSchema,
         })),

package/dist/domain/javascript/electronStaticAnalysisBrowser.js

@@ -1,6 +1,6 @@
 import * as t from "@babel/types";
 import { boundedExpression, collectContextBridgeMembers, electronStaticValue, objectProperty, } from "./electronStaticAnalysisValues.js";
-import { compareCodePoints } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
 import { argumentNode, calleeName, range, staticPath, staticPathResolutionContext, } from "./javascriptStaticAnalysisHelpers.js";
 import { semanticStaticPropertyName } from "./javascriptAstValues.js";
@@ -54,10 +54,16 @@ const collectWindowOptions = (source, options) => {
 const collectWebPreferences = (source, object) => {
     const preferences = [];
     let unknown = 0;
-    let preload = {
-        preload_path: null,
-        preload_resolution_context: null,
-    };
+    const effectivePreload = objectProperty(object, "preload");
+    const preloadPath = effectivePreload.status === "explicit"
+        ? staticPath(effectivePreload.property.value)
+        : undefined;
+    const preload = effectivePreload.status === "explicit" && preloadPath !== undefined
+        ? {
+            preload_path: preloadPath,
+            preload_resolution_context: staticPathResolutionContext(effectivePreload.property.value),
+        }
+        : { preload_path: null, preload_resolution_context: null };
     for (const property of object.properties) {
         if (t.isSpreadElement(property)) {
             unknown += 1;
@@ -85,11 +91,6 @@ const collectWebPreferences = (source, object) => {
             continue;
         }
         const path = name === "preload" ? staticPath(property.value) : undefined;
-        if (path !== undefined)
-            preload = {
-                preload_path: path,
-                preload_resolution_context: staticPathResolutionContext(property.value),
-            };
         const value = path === undefined
             ? electronStaticValue(source, property.value)
             : { status: "literal", value: path, expression: null };
@@ -97,7 +98,7 @@ const collectWebPreferences = (source, object) => {
             unknown += 1;
         preferences.push({ name, value });
     }
-    preferences.sort((left, right) => compareCodePoints(left.name, right.name));
+    preferences.sort((left, right) => compareUnicodeCodePoints(left.name, right.name));
     return {
         status: "object-literal",
         preferences,

package/dist/domain/javascript/electronStaticAnalysisIpc.js

@@ -1,7 +1,9 @@
 import * as t from "@babel/types";
 import { boundedExpression, electronStaticValue, handlerKind, } from "./electronStaticAnalysisValues.js";
 import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
-import { argumentNode, calleeName, range, semanticStaticPropertyName, } from "./javascriptStaticAnalysisHelpers.js";
+import { argumentNode, calleeName, range, } from "./javascriptStaticAnalysisHelpers.js";
+import { semanticStaticPropertyName } from "./javascriptAstValues.js";
+import { compositeKey } from "../unicodeCodePointOrder.js";
 /** Inspect Electron IPC operations and validation candidates. */
 export const inspectElectronIpcNode = (node, context) => {
     if (t.isCallExpression(node)) {
@@ -115,7 +117,14 @@ const addValidation = (context, node, input) => {
     };
     addLocatedFinding(context, {
         collection: context.accumulator.senderValidations,
-        key: `electron-validation\0${input.subject}\0${input.mechanism}\0${input.expected.status === "literal" ? String(input.expected.value) : input.expected.expression}`,
+        key: compositeKey([
+            "electron-validation",
+            input.subject,
+            input.mechanism,
+            input.expected.status === "literal"
+                ? String(input.expected.value)
+                : input.expected.expression,
+        ]),
         node,
         value: finding,
     });

package/dist/domain/javascript/electronStaticAnalysisNative.js

@@ -1,8 +1,9 @@
 import * as t from "@babel/types";
-import { compareCodePoints } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints, compositeKey, } from "../unicodeCodePointOrder.js";
 import { stripQueryAndFragment } from "../artifactPathSyntax.js";
 import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
-import { argumentNode, calleeName, propertyName, range, semanticStaticPropertyName, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
+import { argumentNode, calleeName, range, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
+import { propertyName, semanticStaticPropertyName, } from "./javascriptAstValues.js";
 /** Inspect JavaScript-side imports and re-exports of native .node addons. */
 export const inspectElectronNativeNode = (node, context) => {
     if (t.isImportDeclaration(node))
@@ -97,11 +98,13 @@ const addBinding = (input) => {
     const { context, node, specifier, kind } = input;
     const unique = [
         ...new Set(input.members.filter((member) => member !== "")),
-    ].sort(compareCodePoints);
+    ].sort(compareUnicodeCodePoints);
     const members = unique.length === 0 ? ["*"] : unique;
     addLocatedFinding(context, {
         collection: context.accumulator.nativeAddonBindings,
-        key: `native-addon-binding\0${kind}\0${specifier}\0${members.join("\0")}`,
+        // Members are a variable-length source-derived list: compositeKey keeps
+        // ["a\0b"] distinct from ["a", "b"] instead of collapsing one binding.
+        key: compositeKey(["native-addon-binding", kind, specifier, members]),
         node,
         value: {
             specifier,

package/dist/domain/javascript/electronStaticAnalysisValues.js

@@ -1,5 +1,5 @@
 import * as t from "@babel/types";
-import { compareCodePoints } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 import { readExactJavaScriptLiteral, semanticStaticPropertyName, } from "./javascriptAstValues.js";
 import { sourceSlice } from "./javascriptStaticAnalysisHelpers.js";
 /** Preserve one literal value or the exact inert expression. */
@@ -72,7 +72,7 @@ export const collectContextBridgeMembers = (node) => {
         unknown: 0,
     };
     collectMembersAt(node, "", 0, state);
-    const members = [...new Set(state.members)].sort(compareCodePoints);
+    const members = [...new Set(state.members)].sort(compareUnicodeCodePoints);
     return {
         status: "object-literal",
         members,
@@ -107,7 +107,11 @@ const literalValue = (node) => {
     if (literal.found)
         return literal;
     if (t.isUnaryExpression(node, { operator: "-" }) &&
-        t.isNumericLiteral(node.argument))
-        return { found: true, value: -node.argument.value };
+        t.isNumericLiteral(node.argument)) {
+        const value = -node.argument.value;
+        return Number.isFinite(value) && !Object.is(value, -0)
+            ? { found: true, value }
+            : { found: false };
+    }
     return { found: false };
 };

package/dist/domain/javascript/javascriptApplicationAnalysis.js

@@ -3,12 +3,14 @@ import { javascriptApplicationGraphSchema, isValidatedImmutableJavaScriptApplica
 import { javaScriptSemanticGraphSchema, isValidatedImmutableJavaScriptSemanticGraph, } from "./javascriptSemanticGraph.js";
 import { digestSchema } from "../digests.js";
 import { prefixedDigestSchema } from "../digests.js";
+import { integrityContradictionSchema } from "../artifactGraph.js";
 import { localPathStringSchema } from "../localPath.js";
 const countSchema = z.number().int().min(0);
 /** Public target-free request for static JavaScript application analysis. */
 export const analyzeJavaScriptApplicationInputSchema = z.strictObject({
     input_path: localPathStringSchema,
     format: z.enum(["auto", "asar", "directory"]).default("auto"),
+    integrity_policy: z.enum(["fail", "record-and-continue"]).default("fail"),
 });
 /** Compact counts for the high-level Electron architecture/security surface. */
 const electronBoundarySummarySchema = z.strictObject({
@@ -44,7 +46,6 @@ const reconstructionStatisticsSchema = z.strictObject({
     findings: countSchema,
     modules: countSchema,
     parse_failures: countSchema,
-    truncated_scopes: countSchema,
 });
 const applicationAnalysisResultShape = z.strictObject({
     input_path: z.string().min(1),
@@ -52,6 +53,7 @@ const applicationAnalysisResultShape = z.strictObject({
     root_artifact_sha256: digestSchema,
     inventory_manifest_id: prefixedDigestSchema("agm"),
     inventory_graph_sha256: digestSchema,
+    integrity_contradictions: z.array(integrityContradictionSchema),
     graph: javascriptApplicationGraphSchema,
     summary: electronBoundarySummarySchema,
     statistics: reconstructionStatisticsSchema,

package/dist/domain/javascript/javascriptApplicationChangeGraph.js

@@ -1,5 +1,6 @@
-import { createJavaScriptApplicationEdge, createJavaScriptApplicationGraph, createJavaScriptApplicationNode, } from "./javascriptApplicationGraph.js";
-import { compareCodePoints, uniqueSorted } from "../canonicalOrdering.js";
+import { createJavaScriptApplicationEdge, createImmutableJavaScriptApplicationGraphSteps, createJavaScriptApplicationNode, } from "./javascriptApplicationGraph.js";
+import { uniqueSorted } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 /** Merge compared nodes and add inferred right-to-left changed_from edges. */
 export const buildJavaScriptApplicationChangeGraph = (input) => {
     const allNodes = nodeCandidates(input);
@@ -24,7 +25,7 @@ export const buildJavaScriptApplicationChangeGraph = (input) => {
     const candidateEdges = uniqueEdges([...sourceEdges, ...comparisonEdges]);
     const rootNodeIds = preferredRoots.filter((nodeId) => retained.has(nodeId));
     const fallbackRoot = mergedNodes[0]?.node_id;
-    const graph = createJavaScriptApplicationGraph({
+    const steps = createImmutableJavaScriptApplicationGraphSteps({
         schema: "JavaScriptApplicationGraph",
         root_node_ids: rootNodeIds.length > 0
             ? rootNodeIds
@@ -41,7 +42,10 @@ export const buildJavaScriptApplicationChangeGraph = (input) => {
             "The change graph contains compared entities and their retained relationships; it is not an executable application.",
         ]),
     });
-    return { graph };
+    let next = steps.next();
+    while (!next.done)
+        next = steps.next();
+    return { graph: next.value };
 };
 const nodeCandidates = (input) => {
     const required = new Set([
@@ -145,7 +149,7 @@ const changeGraphCoverage = (input) => {
 };
 const sourceCoverageLimits = (input) => [
     ...new Map([...input.left.coverage.limits, ...input.right.coverage.limits].map((limit) => [`${limit.name}\0${limit.value}\0${limit.unit}`, limit])).values(),
-].sort((left, right) => compareCodePoints(left.name, right.name));
+].sort((left, right) => compareUnicodeCodePoints(left.name, right.name));
 const combineOmittedCounts = (left, right) => left === null || right === null ? null : left + right;
 const mergeNodes = (nodes) => {
     const groups = new Map();
@@ -159,13 +163,13 @@ const mergeNodes = (nodes) => {
             ...new Map(group
                 .flatMap(({ observations: values }) => values)
                 .map((observation) => [observation.observation_id, observation])).values(),
-        ].sort((left, right) => compareCodePoints(left.observation_id, right.observation_id));
+        ].sort((left, right) => compareUnicodeCodePoints(left.observation_id, right.observation_id));
         return createJavaScriptApplicationNode({
             kind: first.kind,
             identity: first.identity,
             observations: observations.map(({ observation_id: _id, identifier_strategy: _strategy, ...value }) => value),
         });
     });
-    return merged.sort((left, right) => compareCodePoints(left.node_id, right.node_id));
+    return merged.sort((left, right) => compareUnicodeCodePoints(left.node_id, right.node_id));
 };
-const uniqueEdges = (edges) => [...new Map(edges.map((edge) => [edge.edge_id, edge])).values()].sort((left, right) => compareCodePoints(left.edge_id, right.edge_id));
+const uniqueEdges = (edges) => [...new Map(edges.map((edge) => [edge.edge_id, edge])).values()].sort((left, right) => compareUnicodeCodePoints(left.edge_id, right.edge_id));

package/dist/domain/javascript/javascriptApplicationEvidenceSchemas.js

@@ -232,6 +232,10 @@ const applicationGraphEvidenceBaseSchema = z.strictObject({
     limitations: z.array(boundedTextSchema),
     evidence_ids: z.array(prefixedDigestSchema("ev")),
 });
+/** Shared provenance fields apart from the fact-specific evidence location. */
+export const applicationGraphEvidenceContextSchema = applicationGraphEvidenceBaseSchema.omit({ location: true });
+/** Exact coordinates retained on each graph fact. */
+export const applicationGraphEvidenceLocationSchema = applicationLocationReferenceSchema;
 const checkAuthorityState = (evidence, context) => {
     if (evidence.authority === "static-relationship-inference" &&
         evidence.state !== "inferred")
@@ -347,6 +351,8 @@ export const applicationNodeIdentitySchema = z.discriminatedUnion("strategy", [
         source_map_sha256: digestSchema,
         // The exact `sources` entry; `""` is a legal relative reference.
         original_source: z.string(),
+        // Exact leaf-local root; null means omitted or explicitly null.
+        source_root: z.string().nullable(),
         source_sha256: digestSchema.nullable(),
     }),
     z.strictObject({

package/dist/domain/javascript/javascriptApplicationGraph.js

@@ -1,6 +1,8 @@
 import { z } from "zod";
-import { canonicalDigest, canonicalJson } from "../comparisonSemantics.js";
-import { compareCodePoints, uniqueSorted } from "../canonicalOrdering.js";
+import { canonicalJson } from "../comparisonSemantics.js";
+import { digestCanonicalValue } from "../canonicalDigest.js";
+import { uniqueSorted } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 import { freezeOwnedJsonSnapshotSteps } from "../immutableJson.js";
 import { applicationEdgeInputSchema, applicationEdgeSchema, applicationNodeInputSchema, applicationNodeObservationSchema, applicationNodeSchema, javascriptApplicationGraphInputSchema, javascriptApplicationGraphRecordSchema, } from "./javascriptApplicationGraphSchemas.js";
 const OBSERVATION_IDENTIFIER_STRATEGY = {
@@ -12,7 +14,7 @@ const EDGE_IDENTIFIER_STRATEGY = {
     stability: "relationship-exact",
 };
 const limitKey = (limit) => canonicalJson(limit, "JavaScript Application Graph");
-const normalizeLimits = (limits) => [...new Map(limits.map((limit) => [limitKey(limit), limit])).values()].sort((left, right) => compareCodePoints(limitKey(left), limitKey(right)));
+const normalizeLimits = (limits) => [...new Map(limits.map((limit) => [limitKey(limit), limit])).values()].sort((left, right) => compareUnicodeCodePoints(limitKey(left), limitKey(right)));
 const normalizeEvidence = (evidence) => ({
     ...evidence,
     coverage: {
@@ -29,13 +31,13 @@ const nodeSemantic = (node) => ({
     kind: node.kind,
     identity: node.identity,
 });
-const nodeId = (node) => `jag_node_${canonicalDigest(nodeSemantic(node), "JavaScript Application Graph")}`;
+const nodeId = (node) => `jag_node_${digestCanonicalValue(nodeSemantic(node), "JavaScript Application Graph")}`;
 const observationSemantic = (nodeIdentifier, observation) => ({ node_id: nodeIdentifier, ...observation });
-const observationId = (nodeIdentifier, observation) => `jag_observation_${canonicalDigest(observationSemantic(nodeIdentifier, observation))}`;
-const edgeId = (edge) => `jag_edge_${canonicalDigest(edge, "JavaScript Application Graph")}`;
+const observationId = (nodeIdentifier, observation) => `jag_observation_${digestCanonicalValue(observationSemantic(nodeIdentifier, observation))}`;
+const edgeId = (edge) => `jag_edge_${digestCanonicalValue(edge, "JavaScript Application Graph")}`;
 const sortedUniqueIssue = (values, path, label, context) => {
     for (let index = 1; index < values.length; index += 1) {
-        if (compareCodePoints(values[index - 1] ?? "", values[index] ?? "") < 0)
+        if (compareUnicodeCodePoints(values[index - 1] ?? "", values[index] ?? "") < 0)
             continue;
         context.addIssue({
             code: "custom",
@@ -63,6 +65,18 @@ const checkEvidenceNormalization = (evidence, path, context) => {
             path: [...path, "location"],
         });
 };
+const sourceMapObservationMatchesIdentity = (identity, observation) => {
+    const { evidence, source_map_reference: reference } = observation;
+    return (reference !== null &&
+        evidence.state === "observed" &&
+        evidence.artifact.available &&
+        evidence.artifact.sha256 === identity.source_map_sha256 &&
+        reference.source_name === identity.original_source &&
+        reference.source_root === identity.source_root &&
+        evidence.location.available &&
+        evidence.location.value.kind === "artifact-path" &&
+        reference.map_path === evidence.location.value.path);
+};
 const observationMatchesIdentity = (node, observation) => {
     const { identity } = node;
     const { evidence } = observation;
@@ -71,9 +85,7 @@ const observationMatchesIdentity = (node, observation) => {
             evidence.artifact.available &&
             evidence.artifact.sha256 === identity.sha256);
     if (identity.strategy === "source-map-original")
-        return (evidence.state === "observed" &&
-            evidence.artifact.available &&
-            evidence.artifact.sha256 === identity.source_map_sha256);
+        return sourceMapObservationMatchesIdentity(identity, observation);
     if (identity.strategy === "canonical-path")
         return (evidence.artifact.available &&
             evidence.artifact.sha256 === identity.artifact_sha256 &&
@@ -126,6 +138,19 @@ const checkNode = (node, index, context) => {
                     "observation_id",
                 ],
             });
+        if (node.identity.strategy === "source-map-original" &&
+            !observationMatchesIdentity(node, observation))
+            context.addIssue({
+                code: "custom",
+                message: "Source-map observation must retain its exact declaration and map location",
+                path: [
+                    "nodes",
+                    index,
+                    "observations",
+                    observationIndex,
+                    "source_map_reference",
+                ],
+            });
         checkEvidenceNormalization(observation.evidence, ["nodes", index, "observations", observationIndex, "evidence"], context);
     }
     if (!node.observations.some((observation) => observationMatchesIdentity(node, observation)))
@@ -190,7 +215,7 @@ const checkGraphInvariants = (graph, context) => {
     }
     const { graph_id: identifier, ...semantic } = graph;
     if (identifier !==
-        `jag_${canonicalDigest(semantic, "JavaScript Application Graph")}`)
+        `jag_${digestCanonicalValue(semantic, "JavaScript Application Graph")}`)
         context.addIssue({
             code: "custom",
             message: "Graph identifier does not match its semantic content",
@@ -216,7 +241,7 @@ export const createJavaScriptApplicationNode = (input) => {
             observation_id: observationId(identifier, semantic),
         });
     })
-        .sort((left, right) => compareCodePoints(left.observation_id, right.observation_id));
+        .sort((left, right) => compareUnicodeCodePoints(left.observation_id, right.observation_id));
     return applicationNodeSchema.parse({
         node_id: identifier,
         kind: parsed.kind,
@@ -243,8 +268,8 @@ export const createJavaScriptApplicationGraph = (input) => {
     const semantic = {
         ...parsed,
         root_node_ids: uniqueSorted(parsed.root_node_ids),
-        nodes: [...parsed.nodes].sort((left, right) => compareCodePoints(left.node_id, right.node_id)),
-        edges: [...parsed.edges].sort((left, right) => compareCodePoints(left.edge_id, right.edge_id)),
+        nodes: [...parsed.nodes].sort((left, right) => compareUnicodeCodePoints(left.node_id, right.node_id)),
+        edges: [...parsed.edges].sort((left, right) => compareUnicodeCodePoints(left.edge_id, right.edge_id)),
         coverage: {
             ...parsed.coverage,
             limits: normalizeLimits(parsed.coverage.limits),
@@ -253,7 +278,7 @@ export const createJavaScriptApplicationGraph = (input) => {
     };
     return javascriptApplicationGraphSchema.parse({
         ...semantic,
-        graph_id: `jag_${canonicalDigest(semantic, "JavaScript Application Graph")}`,
+        graph_id: `jag_${digestCanonicalValue(semantic, "JavaScript Application Graph")}`,
     });
 };
 const validatedImmutableApplicationGraphs = new WeakSet();
@@ -271,6 +296,6 @@ export const isValidatedImmutableJavaScriptApplicationGraph = (value) => typeof
 /** Parse a stored graph and reject stale IDs. */
 export const parseJavaScriptApplicationGraph = (input) => javascriptApplicationGraphSchema.parse(input);
 /** Compute the byte-stable SHA-256 commitment of a verified graph. */
-export const computeJavaScriptApplicationGraphSha256 = (input) => canonicalDigest(parseJavaScriptApplicationGraph(input), "JavaScript Application Graph");
+export const computeJavaScriptApplicationGraphSha256 = (input) => digestCanonicalValue(parseJavaScriptApplicationGraph(input), "JavaScript Application Graph");
 /** Serialize a verified graph as RFC 8785 canonical JSON. */
 export const serializeJavaScriptApplicationGraph = (input) => canonicalJson(parseJavaScriptApplicationGraph(input), "JavaScript Application Graph");

package/dist/domain/javascript/javascriptApplicationGraphSchemas.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { javascriptSourceMapReferenceSchema } from "./javascriptSourceMapPaths.js";
 import { applicationCoverageSchema, applicationGraphEvidenceSchema, applicationNodeIdentitySchema, } from "./javascriptApplicationEvidenceSchemas.js";
 import { jsonValueSchema } from "../jsonValue.js";
 import { prefixedDigestSchema } from "../digests.js";
@@ -61,13 +62,19 @@ export const JAVASCRIPT_APPLICATION_RELATIONS = [
 const applicationRelationSchema = z.enum(JAVASCRIPT_APPLICATION_RELATIONS);
 const applicationPropertiesSchema = z.record(z.string().min(1), jsonValueSchema);
 /** One node observation before its semantic identifier is derived. */
-const applicationNodeObservationInputSchema = z.strictObject({
+const applicationNodeObservationBaseSchema = z.strictObject({
     label: z.string().min(1).nullable(),
+    source_map_reference: javascriptSourceMapReferenceSchema.nullable(),
     properties: applicationPropertiesSchema,
     evidence: applicationGraphEvidenceSchema,
 });
+const applicationNodeObservationInputSchema = applicationNodeObservationBaseSchema.extend({
+    source_map_reference: javascriptSourceMapReferenceSchema
+        .nullable()
+        .default(null),
+});
 /** One immutable, evidence-bearing observation attached to an entity. */
-export const applicationNodeObservationSchema = applicationNodeObservationInputSchema.extend({
+export const applicationNodeObservationSchema = applicationNodeObservationBaseSchema.extend({
     observation_id: prefixedDigestSchema("jag_observation"),
     identifier_strategy: z.strictObject({
         strategy: z.literal("semantic-content-sha256"),

package/dist/domain/javascript/javascriptApplicationVersionComparison.js

@@ -1,7 +1,7 @@
-import { canonicalDigest } from "../comparisonSemantics.js";
+import { digestCanonicalValue } from "../canonicalDigest.js";
 import { uniqueSorted } from "../canonicalOrdering.js";
 import { buildJavaScriptApplicationChangeGraph } from "./javascriptApplicationChangeGraph.js";
-import { applicationVersionComparisonResultSchema, } from "./javascriptApplicationVersionComparisonSchemas.js";
+import { ownedApplicationVersionComparisonResultSchema, } from "./javascriptApplicationVersionComparisonSchemas.js";
 import { classifyJavaScriptApplicationVersions } from "./javascriptApplicationVersionItems.js";
 import { matchJavaScriptApplicationVersions } from "./javascriptApplicationVersionKeys.js";
 /** Compare application entities with ordered unique-only identity tiers. */
@@ -47,9 +47,9 @@ export const compareJavaScriptApplicationVersions = (input) => {
         evidence_links: evidenceLinks,
         limitations: comparisonLimitations(input),
     };
-    return applicationVersionComparisonResultSchema.parse({
+    return ownedApplicationVersionComparisonResultSchema.parse({
         ...semantic,
-        comparison_id: `javc_${canonicalDigest(semantic, "Application version comparison")}`,
+        comparison_id: `javc_${digestCanonicalValue(semantic, "Application version comparison")}`,
     });
 };
 const summary = (items) => ({