rea-agents 6.1.0 → 6.3.0

package/dist/application/javascript/JavaScriptApplicationEvidenceGraph.js

@@ -1,8 +1,21 @@
 import { JAVASCRIPT_APPLICATION_PROVIDER, JAVASCRIPT_RUNTIME_RECONCILIATION_PROVIDER, MANAGED_WORKFLOW_PROVIDER, } from "../InvestigationProviders.js";
 import { isImmutableEvidence, parseEvidence, } from "../../domain/evidence.js";
+import { AnalysisInputError, } from "../../domain/analysisErrorCore.js";
+import { projectInputIssues } from "../../domain/inputIssueProjection.js";
+import { err, ok } from "../../domain/result.js";
+import { z } from "zod";
 import { analyzeJavaScriptApplicationInputSchema, javascriptApplicationAnalysisResultSchema, } from "../../domain/javascript/javascriptApplicationAnalysis.js";
 import { javascriptRuntimeReconciliationResultSchema } from "../../domain/javascript/javascriptRuntimeReconciliationSchemas.js";
 import { managedApplicationGraphResultSchema } from "../../domain/managed/managedApplicationGraph.js";
+/** Convert typed parser issues into this workflow's caller-facing input error. */
+export const applicationGraphEvidenceInputError = (operation, failure) => new AnalysisInputError(operation, undefined, failure.issues);
+class InvalidApplicationGraphEvidence extends Error {
+    issues;
+    constructor(issues) {
+        super("Application graph Evidence failed input validation");
+        this.issues = issues;
+    }
+}
 const ownedApplicationSources = new WeakMap();
 /** Retain the producer-validated meaning of its exact immutable result snapshot. */
 export const rememberOwnedApplicationGraphEvidence = (evidence, result) => {
@@ -11,44 +24,44 @@ export const rememberOwnedApplicationGraphEvidence = (evidence, result) => {
         evidence.operation !== "analyze_javascript_application" ||
         !providerMatches(evidence, JAVASCRIPT_APPLICATION_PROVIDER))
         throw new TypeError("Owned application Evidence must bind its exact validated immutable result");
-    ownedApplicationSources.set(evidence, Object.freeze(staticApplicationSourceForResult(evidence, result)));
+    ownedApplicationSources.set(evidence, Object.freeze(staticApplicationSourceForResult(evidence, result, [])));
     return evidence;
 };
 /** Parse and authenticate one REA-produced JavaScript Application Graph Evidence. */
-export const parseApplicationGraphEvidence = (input) => {
-    const evidence = parseEvidence(input);
+export const parseApplicationGraphEvidence = (input, path = []) => captureInputValidation(() => {
+    const evidence = parseEvidenceInput(input, path);
     const owned = ownedApplicationSources.get(evidence);
     if (owned !== undefined)
         return owned;
-    if (evidence.operation === "analyze_javascript_application" &&
-        evidence.predicate_type === "rea.javascript-application-analysis" &&
-        providerMatches(evidence, JAVASCRIPT_APPLICATION_PROVIDER))
-        return staticApplicationSource(evidence);
-    if (evidence.operation === "reconcile_javascript_runtime" &&
-        evidence.predicate_type === "rea.javascript-runtime-reconciliation" &&
-        providerMatches(evidence, JAVASCRIPT_RUNTIME_RECONCILIATION_PROVIDER))
-        return staticRuntimeSource(evidence);
-    if (evidence.operation === "project_managed_application_graph" &&
-        evidence.predicate_type === "rea.managed-application-graph" &&
-        providerMatches(evidence, MANAGED_WORKFLOW_PROVIDER))
-        return managedApplicationSource(evidence);
-    throw new TypeError("Application workflow requires authenticated analyze_javascript_application, reconcile_javascript_runtime, or project_managed_application_graph Evidence");
+    if (evidence.operation === "analyze_javascript_application") {
+        requirePredicate(evidence, "rea.javascript-application-analysis", path);
+        requireProvider(evidence, JAVASCRIPT_APPLICATION_PROVIDER, path);
+        return staticApplicationSource(evidence, path);
+    }
+    if (evidence.operation === "reconcile_javascript_runtime") {
+        requirePredicate(evidence, "rea.javascript-runtime-reconciliation", path);
+        requireProvider(evidence, JAVASCRIPT_RUNTIME_RECONCILIATION_PROVIDER, path);
+        return staticRuntimeSource(evidence, path);
+    }
+    if (evidence.operation === "project_managed_application_graph") {
+        requirePredicate(evidence, "rea.managed-application-graph", path);
+        requireProvider(evidence, MANAGED_WORKFLOW_PROVIDER, path);
+        return managedApplicationSource(evidence, path);
+    }
+    throw invalidEvidence(path, "operation", "Expected authenticated JavaScript analysis, runtime reconciliation, or managed application graph Evidence.");
+});
+const staticApplicationSource = (evidence, path) => {
+    const result = parseCallerValue((input) => javascriptApplicationAnalysisResultSchema.parse(input), evidence.normalized_result, [...path, "normalized_result"]);
+    return staticApplicationSourceForResult(evidence, result, path);
 };
-const staticApplicationSource = (evidence) => {
-    const result = javascriptApplicationAnalysisResultSchema.parse(evidence.normalized_result);
-    return staticApplicationSourceForResult(evidence, result);
-};
-const staticApplicationSourceForResult = (evidence, result) => {
+const staticApplicationSourceForResult = (evidence, result, path) => {
     if (evidence.authority !== "shipped-artifact" ||
         evidence.confidence !== "derived")
-        throw new TypeError("JavaScript application Evidence authority or confidence is invalid");
+        throw invalidEvidence(path, "authority", "JavaScript application Evidence must use shipped-artifact authority and derived confidence.");
     if (evidence.predicate_type !== "rea.javascript-application-analysis")
-        throw new TypeError("JavaScript application Evidence predicate does not match its result shape");
-    analyzeJavaScriptApplicationInputSchema.parse({
-        input_path: result.input_path,
-        ...evidence.parameters,
-    });
-    assertApplicationSubject(evidence, result);
+        throw invalidEvidence(path, "predicate_type", "JavaScript application Evidence predicate does not match its result shape.");
+    parseCallerValue((input) => analyzeJavaScriptApplicationInputSchema.parse(input), { input_path: result.input_path, ...evidence.parameters }, [...path, "parameters"]);
+    assertApplicationSubject(evidence, result, path);
     return {
         evidence,
         graph: result.graph,
@@ -57,16 +70,17 @@ const staticApplicationSourceForResult = (evidence, result) => {
         semanticGraph: result.semantic_graph,
     };
 };
-const staticRuntimeSource = (evidence) => {
+const staticRuntimeSource = (evidence, path) => {
     if (evidence.authority !== "analyst-inference" ||
         evidence.confidence !== "inferred")
-        throw new TypeError("JavaScript runtime reconciliation Evidence authority or confidence is invalid");
-    const result = javascriptRuntimeReconciliationResultSchema.parse(evidence.normalized_result);
-    if (result.evidence_links.some((evidenceId) => !evidence.evidence_links.includes(evidenceId)))
-        throw new TypeError("Runtime reconciliation result references Evidence outside its envelope");
+        throw invalidEvidence(path, "authority", "Runtime reconciliation Evidence must use analyst-inference authority and inferred confidence.");
+    const result = parseCallerValue((input) => javascriptRuntimeReconciliationResultSchema.parse(input), evidence.normalized_result, [...path, "normalized_result"]);
+    const unmatchedLink = result.evidence_links.find((evidenceId) => !evidence.evidence_links.includes(evidenceId));
+    if (unmatchedLink !== undefined)
+        throw invalidEvidence([...path, "normalized_result"], "evidence_links", `Runtime reconciliation result references Evidence ${unmatchedLink} outside its envelope.`);
     const applicationLayer = result.static_layers.find(({ role }) => role === "application");
     if (applicationLayer === undefined)
-        throw new TypeError("Runtime reconciliation application layer is missing");
+        throw invalidEvidence([...path, "normalized_result"], "static_layers", "Runtime reconciliation Evidence must include its application layer.");
     return {
         evidence,
         graph: result.graph,
@@ -75,13 +89,14 @@ const staticRuntimeSource = (evidence) => {
         semanticGraph: null,
     };
 };
-const managedApplicationSource = (evidence) => {
+const managedApplicationSource = (evidence, path) => {
     if (evidence.authority !== "analyst-inference" ||
         evidence.confidence !== "inferred")
-        throw new TypeError("Managed application graph Evidence authority or confidence is invalid");
-    const result = managedApplicationGraphResultSchema.parse(evidence.normalized_result);
-    if (result.evidence_links.some((evidenceId) => !evidence.evidence_links.includes(evidenceId)))
-        throw new TypeError("Managed application graph result references Evidence outside its envelope");
+        throw invalidEvidence(path, "authority", "Managed application graph Evidence must use analyst-inference authority and inferred confidence.");
+    const result = parseCallerValue((input) => managedApplicationGraphResultSchema.parse(input), evidence.normalized_result, [...path, "normalized_result"]);
+    const unmatchedLink = result.evidence_links.find((evidenceId) => !evidence.evidence_links.includes(evidenceId));
+    if (unmatchedLink !== undefined)
+        throw invalidEvidence([...path, "normalized_result"], "evidence_links", `Managed application graph result references Evidence ${unmatchedLink} outside its envelope.`);
     return {
         evidence,
         graph: result.graph,
@@ -90,23 +105,69 @@ const managedApplicationSource = (evidence) => {
         semanticGraph: null,
     };
 };
-const assertApplicationSubject = (evidence, result) => {
+const assertApplicationSubject = (evidence, result, path) => {
     if (evidence.subject === null ||
         evidence.subject.digest.sha256 !== result.root_artifact_sha256 ||
         evidence.subject.format !== result.format ||
         evidence.subject.local_path !== result.input_path)
-        throw new TypeError("JavaScript application Evidence subject does not match its result");
+        throw invalidEvidence(path, "subject", "JavaScript application Evidence subject must match the analyzed artifact identity and input path.");
 };
 const providerMatches = (evidence, provider) => evidence.provider.id === provider.id &&
     evidence.provider.name === provider.name &&
     evidence.provider.version === provider.version;
+const requirePredicate = (evidence, expected, path) => {
+    if (evidence.predicate_type !== expected)
+        throw invalidEvidence(path, "predicate_type", `Expected predicate ${expected} for operation ${evidence.operation}.`);
+};
+const requireProvider = (evidence, expected, path) => {
+    if (!providerMatches(evidence, expected))
+        throw invalidEvidence(path, "provider", `Expected provider ${expected.id} v${expected.version} for operation ${evidence.operation}.`);
+};
 /** Parse unique, artifact-bound Evidence that may extend a native handoff. */
-export const parseNativeApplicationEvidence = (inputs) => {
-    const parsed = inputs.map((input) => parseEvidence(input));
-    if (parsed.some(({ subject }) => subject === null))
-        throw new TypeError("Native handoff Evidence requires an artifact subject");
+export const parseNativeApplicationEvidence = (inputs, path = []) => captureInputValidation(() => {
+    const parsed = inputs.map((input, index) => parseEvidenceInput(input, [...path, index]));
+    const withoutSubject = parsed.findIndex(({ subject }) => subject === null);
+    if (withoutSubject !== -1)
+        throw invalidEvidence([...path, withoutSubject], "subject", "Native handoff Evidence requires an artifact subject.");
     const ids = parsed.map(({ evidence_id: id }) => id);
     if (new Set(ids).size !== ids.length)
-        throw new TypeError("Native handoff Evidence must be unique");
+        throw invalidEvidence(path, "evidence_id", "Native handoff Evidence must be unique.");
     return parsed;
+});
+const captureInputValidation = (operation) => {
+    try {
+        return ok(operation());
+    }
+    catch (cause) {
+        if (cause instanceof InvalidApplicationGraphEvidence)
+            return err({ issues: cause.issues });
+        throw cause;
+    }
+};
+const parseEvidenceInput = (input, path) => {
+    try {
+        return parseEvidence(input);
+    }
+    catch (cause) {
+        if (cause instanceof z.ZodError)
+            throw zodInputFailure(cause, input, path);
+        throw cause;
+    }
+};
+const parseCallerValue = (parse, input, path) => {
+    try {
+        return parse(input);
+    }
+    catch (cause) {
+        if (cause instanceof z.ZodError)
+            throw zodInputFailure(cause, input, path);
+        throw cause;
+    }
 };
+const zodInputFailure = (cause, input, path) => new InvalidApplicationGraphEvidence(projectInputIssues(cause.issues, input).map((issue) => ({
+    ...issue,
+    path: [...path, ...issue.path],
+})));
+const invalidEvidence = (path, field, message) => new InvalidApplicationGraphEvidence([
+    { path: [...path, field], reason: "invalid_value", message },
+]);

package/dist/application/javascript/JavaScriptApplicationService.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { ArtifactReaderFailure } from "../../artifacts/ArtifactReader.js";
 import { analyzeJavaScriptApplicationInputSchema, parseOwnedJavaScriptApplicationAnalysisSteps, } from "../../domain/javascript/javascriptApplicationAnalysis.js";
-import { AnalysisOutputError } from "../../domain/analysisErrorCore.js";
+import { AnalysisAccessDeniedError, AnalysisInputError, AnalysisOutputError, AnalysisUnsupportedTargetError, } from "../../domain/analysisErrorCore.js";
 import { ArtifactOperationError } from "../../domain/artifactOperationError.js";
 import {} from "../../domain/analysisErrorBase.js";
 import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
@@ -33,6 +33,7 @@ export const analyzeJavaScriptApplicationValidated = async (input, options = {})
         const reconstructed = await reconstructJavaScriptArtifact({
             input_path: input.input_path,
             format: input.format,
+            integrity_policy: input.integrity_policy,
         }, options.signal, options.progress);
         const { electron_summary: summary, ...application } = reconstructed;
         await options.progress?.report({
@@ -67,6 +68,11 @@ export const analyzeJavaScriptApplicationValidated = async (input, options = {})
         return ok(evidence);
     }
     catch (cause) {
+        // Input selection failures are already typed by their cause.
+        if (cause instanceof AnalysisInputError ||
+            cause instanceof AnalysisUnsupportedTargetError ||
+            cause instanceof AnalysisAccessDeniedError)
+            return err(cause);
         if (cause instanceof ArtifactReaderFailure)
             return err(new ArtifactOperationError(OPERATION, cause.reason, cause.details, cause.message));
         if (cause instanceof z.ZodError)

package/dist/application/javascript/JavaScriptApplicationWorkflowService.js

@@ -1,17 +1,17 @@
 import { z } from "zod";
-import { AnalysisInputError, AnalysisProtocolError, } from "../../domain/analysisErrorCore.js";
+import { AnalysisProtocolError } from "../../domain/analysisErrorCore.js";
 import {} from "../../domain/analysisErrorBase.js";
 import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
 import { compareJavaScriptApplicationVersions } from "../../domain/javascript/javascriptApplicationVersionComparison.js";
-import { compareApplicationVersionsInputSchema } from "../../domain/javascript/javascriptApplicationVersionComparisonSchemas.js";
+import { compareApplicationVersionsInputSchema, applicationVersionIdentitiesSchema, } from "../../domain/javascript/javascriptApplicationVersionComparisonSchemas.js";
 import { compareJavaScriptExportShapes } from "../../domain/javascript/javascriptExportShapeComparison.js";
-import { compareJavaScriptExportShapesInputSchema } from "../../domain/javascript/javascriptExportShapeComparisonSchemas.js";
+import { compareJavaScriptExportShapesInputSchema, javaScriptExportShapeIdentitiesSchema, } from "../../domain/javascript/javascriptExportShapeComparisonSchemas.js";
 import { traceApplicationFeature } from "../../domain/javascript/javascriptFeatureTrace.js";
-import { traceApplicationFeatureInputSchema } from "../../domain/javascript/javascriptFeatureTraceSchemas.js";
+import { traceApplicationFeatureInputSchema, applicationTraceIdentitiesSchema, } from "../../domain/javascript/javascriptFeatureTraceSchemas.js";
 import { err, ok } from "../../domain/result.js";
 import { compareSourceToBundle } from "../../domain/javascript/sourceToBundleComparison.js";
 import { compareSourceToBundleInputSchema } from "../../domain/javascript/sourceToBundleComparisonSchemas.js";
-import { parseApplicationGraphEvidence, parseNativeApplicationEvidence, } from "./JavaScriptApplicationEvidenceGraph.js";
+import { applicationGraphEvidenceInputError, parseApplicationGraphEvidence, parseNativeApplicationEvidence, } from "./JavaScriptApplicationEvidenceGraph.js";
 import { createApplicationFeatureTraceEvidence, createApplicationVersionComparisonEvidence, createJavaScriptExportShapeComparisonEvidence, createSourceToBundleComparisonEvidence, } from "./JavaScriptApplicationWorkflowEvidence.js";
 /** Authenticate Evidence and derive one bounded cross-layer feature trace. */
 export const traceApplicationFeatureEvidence = (rawInput) => {
@@ -24,9 +24,20 @@ export const traceApplicationFeatureEvidence = (rawInput) => {
 /** Derive one feature trace from input parsed by a trusted adapter. */
 export const traceApplicationFeatureEvidenceValidated = (input) => {
     const operation = "trace_application_feature";
+    const identities = applicationTraceIdentitiesSchema.safeParse(input);
+    if (!identities.success)
+        return err(analysisInputErrorFromIssues(operation, identities.error.issues, input));
+    const sourceResult = parseApplicationGraphEvidence(input.application, [
+        "application",
+    ]);
+    if (!sourceResult.ok)
+        return err(applicationGraphEvidenceInputError(operation, sourceResult.error));
+    const nativeResult = parseNativeApplicationEvidence(input.native_observations, ["native_observations"]);
+    if (!nativeResult.ok)
+        return err(applicationGraphEvidenceInputError(operation, nativeResult.error));
     try {
-        const source = parseApplicationGraphEvidence(input.application);
-        const nativeEvidence = parseNativeApplicationEvidence(input.native_observations);
+        const source = sourceResult.value;
+        const nativeEvidence = nativeResult.value;
         const result = traceApplicationFeature({
             sourceEvidenceId: source.evidence.evidence_id,
             graph: source.graph,
@@ -42,7 +53,7 @@ export const traceApplicationFeatureEvidenceValidated = (input) => {
         }, result));
     }
     catch (cause) {
-        return workflowFailure(operation, cause, input);
+        return workflowFailure(operation, cause);
     }
 };
 /** Authenticate both graphs and derive a tiered cross-version change graph. */
@@ -56,11 +67,26 @@ export const compareApplicationVersionsEvidence = (rawInput) => {
 /** Compare versions from input parsed by a trusted adapter. */
 export const compareApplicationVersionsEvidenceValidated = (input) => {
     const operation = "compare_application_versions";
+    const identities = applicationVersionIdentitiesSchema.safeParse(input);
+    if (!identities.success)
+        return err(analysisInputErrorFromIssues(operation, identities.error.issues, input));
+    const leftResult = parseApplicationGraphEvidence(input.left, ["left"]);
+    if (!leftResult.ok)
+        return err(applicationGraphEvidenceInputError(operation, leftResult.error));
+    const rightResult = parseApplicationGraphEvidence(input.right, ["right"]);
+    if (!rightResult.ok)
+        return err(applicationGraphEvidenceInputError(operation, rightResult.error));
+    const leftNativeResult = parseNativeApplicationEvidence(input.left_native_observations, ["left_native_observations"]);
+    if (!leftNativeResult.ok)
+        return err(applicationGraphEvidenceInputError(operation, leftNativeResult.error));
+    const rightNativeResult = parseNativeApplicationEvidence(input.right_native_observations, ["right_native_observations"]);
+    if (!rightNativeResult.ok)
+        return err(applicationGraphEvidenceInputError(operation, rightNativeResult.error));
     try {
-        const left = parseApplicationGraphEvidence(input.left);
-        const right = parseApplicationGraphEvidence(input.right);
-        const leftNative = parseNativeApplicationEvidence(input.left_native_observations);
-        const rightNative = parseNativeApplicationEvidence(input.right_native_observations);
+        const left = leftResult.value;
+        const right = rightResult.value;
+        const leftNative = leftNativeResult.value;
+        const rightNative = rightNativeResult.value;
         const result = compareJavaScriptApplicationVersions({
             left: {
                 evidenceId: left.evidence.evidence_id,
@@ -83,14 +109,19 @@ export const compareApplicationVersionsEvidenceValidated = (input) => {
         }, result));
     }
     catch (cause) {
-        return workflowFailure(operation, cause, input);
+        return workflowFailure(operation, cause);
     }
 };
 /** Compare source and bundle inputs already parsed by a trusted adapter. */
 export const compareSourceToBundleEvidenceValidated = (input) => {
     const operation = "compare_source_to_bundle";
+    const applicationResult = parseApplicationGraphEvidence(input.application, [
+        "application",
+    ]);
+    if (!applicationResult.ok)
+        return err(applicationGraphEvidenceInputError(operation, applicationResult.error));
     try {
-        const application = parseApplicationGraphEvidence(input.application);
+        const application = applicationResult.value;
         const result = compareSourceToBundle({
             reference: input.reference,
             application: {
@@ -105,7 +136,7 @@ export const compareSourceToBundleEvidenceValidated = (input) => {
         }, result));
     }
     catch (cause) {
-        return workflowFailure(operation, cause, input);
+        return workflowFailure(operation, cause);
     }
 };
 /**
@@ -122,9 +153,18 @@ export const compareJavaScriptExportShapesEvidence = (rawInput) => {
 /** Compare exact export shapes from input parsed by a trusted adapter. */
 export const compareJavaScriptExportShapesEvidenceValidated = (input) => {
     const operation = "compare_javascript_export_shapes";
+    const identities = javaScriptExportShapeIdentitiesSchema.safeParse(input);
+    if (!identities.success)
+        return err(analysisInputErrorFromIssues(operation, identities.error.issues, input));
+    const leftResult = parseApplicationGraphEvidence(input.left, ["left"]);
+    if (!leftResult.ok)
+        return err(applicationGraphEvidenceInputError(operation, leftResult.error));
+    const rightResult = parseApplicationGraphEvidence(input.right, ["right"]);
+    if (!rightResult.ok)
+        return err(applicationGraphEvidenceInputError(operation, rightResult.error));
     try {
-        const left = parseApplicationGraphEvidence(input.left);
-        const right = parseApplicationGraphEvidence(input.right);
+        const left = leftResult.value;
+        const right = rightResult.value;
         const result = compareJavaScriptExportShapes({
             left: {
                 evidenceId: left.evidence.evidence_id,
@@ -149,33 +189,7 @@ export const compareJavaScriptExportShapesEvidenceValidated = (input) => {
         }, result));
     }
     catch (cause) {
-        return workflowFailure(operation, cause, input);
+        return workflowFailure(operation, cause);
     }
 };
-const workflowFailure = (operation, cause, input) => cause instanceof z.ZodError
-    ? err(analysisInputErrorFromIssues(operation, cause.issues, input))
-    : cause instanceof TypeError &&
-        SAFE_APPLICATION_INPUT_CONSTRAINTS.has(cause.message)
-        ? err(new AnalysisInputError(operation, undefined, [
-            { path: [], reason: "invalid_value", message: cause.message },
-        ]))
-        : err(new AnalysisProtocolError("JavaScript application workflow produced an invalid result", { cause }));
-const SAFE_APPLICATION_INPUT_CONSTRAINTS = new Set([
-    "Evidence semantic identifier does not match its record",
-    "Application workflow requires authenticated analyze_javascript_application, reconcile_javascript_runtime, or project_managed_application_graph Evidence",
-    "JavaScript application Evidence authority or confidence is invalid",
-    "JavaScript application Evidence predicate does not match its result shape",
-    "JavaScript application Evidence subject does not match its result",
-    "Runtime reconciliation Evidence authority or confidence is invalid",
-    "Runtime reconciliation result references Evidence outside its envelope",
-    "Runtime reconciliation application layer is missing",
-    "Managed application graph Evidence authority or confidence is invalid",
-    "Managed application graph result references Evidence outside its envelope",
-    "Native handoff Evidence requires an artifact subject",
-    "Native handoff Evidence must be unique",
-    ...[
-        "analyze_javascript_application",
-        "reconcile_javascript_runtime",
-        "project_managed_application_graph",
-    ].map((operation) => `Evidence does not match the supported ${operation} contract`),
-]);
+const workflowFailure = (operation, cause) => err(new AnalysisProtocolError(`JavaScript application workflow failed while producing ${operation}`, { cause }));

package/dist/application/javascript/JavaScriptArtifactAnalysis.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { setImmediate } from "node:timers/promises";
+import { resolveJavaScriptSourceMapReference } from "../../domain/javascript/javascriptSourceMapPaths.js";
 import { analyzeParsedJavaScriptStaticSource } from "../../domain/javascript/javascriptStaticAnalysis.js";
 import { analyzeParsedJavaScriptSemantics, classifyParsedJavaScriptOpenReceivers, } from "../../domain/javascript/javascriptSemanticAnalysis.js";
 import { parseJavaScriptSource } from "../../domain/javascript/javascriptSourceParser.js";
@@ -45,7 +46,6 @@ const analyzeArtifactFiles = (fileSet, projectSemantics) => {
     return finalizeArtifactAnalysis(state);
 };
 const finalizeArtifactAnalysis = (state) => {
-    const truncatedScopes = state.truncatedScopes;
     return {
         files: state.files,
         packages: state.packages,
@@ -56,13 +56,9 @@ const finalizeArtifactAnalysis = (state) => {
         findings: state.findings + state.htmlScripts.length,
         modules: state.modules,
         parse_failures: state.parseFailures,
-        truncated_scopes: truncatedScopes,
         limitations: [
             "JavaScript and HTML were parsed as inert text; bundle bootstrap code was never executed.",
             "Static paths and relationships may remain unresolved when expressions are dynamic or obfuscated.",
-            ...(truncatedScopes === 0
-                ? []
-                : ["Some static-analysis scopes were truncated."]),
         ],
     };
 };
@@ -117,7 +113,6 @@ const emptyArtifactAnalysis = () => ({
     findings: 0,
     modules: 0,
     parseFailures: 0,
-    truncatedScopes: 0,
 });
 const addStructuredObservations = (file, state) => {
     if (file.kind === "package-json")
@@ -203,14 +198,16 @@ const collectSourceMapOriginals = (file, maps) => {
         const contents = map.sourcesContent;
         if (!hasValidSourceMapContents(names.length, contents))
             return invalidSourceMap(file, "Source map sourcesContent must contain one string or null entry per source.");
-        const root = typeof map.sourceRoot === "string" ? map.sourceRoot : "";
+        if (map.sourceRoot != null && typeof map.sourceRoot !== "string")
+            return invalidSourceMap(file, "Source map sourceRoot must be a string or null.");
+        const root = typeof map.sourceRoot === "string" ? map.sourceRoot : null;
         for (const [index, raw] of names.entries()) {
             if (typeof raw !== "string")
                 return invalidSourceMap(file, "Source map contains a non-string source name.");
             const rawContent = Array.isArray(contents) ? contents[index] : undefined;
             const content = typeof rawContent === "string" ? rawContent : null;
             sources.push({
-                source: resolveSourceName(root, raw),
+                reference: resolveJavaScriptSourceMapReference(raw, root, file.path),
                 content,
                 content_sha256: content === null ? null : sha256(content),
             });
@@ -266,7 +263,6 @@ const pointForOffset = (text, offset) => {
     const lines = text.slice(0, offset).split(/\r\n|\r|\n/u);
     return { line: lines.length, column: lines.at(-1)?.length ?? 0 };
 };
-const resolveSourceName = (root, source) => `${root}${root !== "" && !root.endsWith("/") ? "/" : ""}${source}`;
 const optionalString = (value) => typeof value === "string" && value.length > 0 ? value : null;
 const sha256 = (value) => createHash("sha256").update(value).digest("hex");
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);

package/dist/application/javascript/JavaScriptArtifactGraphBuilder.js

@@ -1,12 +1,14 @@
 import { createJavaScriptApplicationGraph, createImmutableJavaScriptApplicationGraphSteps, } from "../../domain/javascript/javascriptApplicationGraph.js";
 import { JavaScriptArtifactGraphAccumulator } from "./JavaScriptArtifactGraphAccumulator.js";
+import { selfReferenceOmissions, } from "./JavaScriptArtifactGraphContext.js";
 import { addJavaScriptHtmlRoles, addJavaScriptSourceMapOriginals, } from "./JavaScriptArtifactGraphDocuments.js";
 import { addJavaScriptStaticFindings } from "./JavaScriptArtifactGraphFindings.js";
 import { addJavaScriptModuleRelationships, addJavaScriptSourceModules, } from "./JavaScriptModuleRelationships.js";
 import { completeApplicationCoverage, partialApplicationCoverage, } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
-import { semanticCoverageResourceLimits } from "../../domain/javascript/javascriptSemanticCoverage.js";
-import { SEMANTIC_EXPRESSION_DEPTH_LIMIT, SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT, SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT, semanticResourceLimitReason, } from "../../domain/javascript/javascriptSemanticResourceLimits.js";
-import { addJavaScriptArtifactContainers, addJavaScriptArtifactFiles, addJavaScriptBundlerNodes, addJavaScriptPackageNodes, createJavaScriptArtifactRootNode, } from "./JavaScriptArtifactGraphStructure.js";
+import { semanticCoverageResourceLimits, semanticResourceLimitCoverage, } from "../../domain/javascript/javascriptSemanticCoverage.js";
+import { semanticResourceLimitReason } from "../../domain/javascript/javascriptSemanticResourceLimits.js";
+import { addJavaScriptArtifactContainers, addJavaScriptArtifactFiles, addJavaScriptPackageNodes, createJavaScriptArtifactRootNode, } from "./JavaScriptArtifactGraphStructure.js";
+import { addJavaScriptBundlerNodes } from "./JavaScriptArtifactGraphBundlers.js";
 import { addElectronBoundaries } from "./ElectronBoundaryGraph.js";
 import { classifyElectronIpcPairings, collectElectronIpcRecords, } from "./ElectronBoundaryAnalysis.js";
 /** Project artifact and AST facts into JavaScript Application Graph. */
@@ -34,9 +36,9 @@ const buildJavaScriptArtifactGraphInput = (snapshot, fileSet, analysis) => {
     addJavaScriptArtifactFiles(context);
     const packageRoots = addJavaScriptPackageNodes(context);
     addJavaScriptSourceModules(context);
-    addJavaScriptBundlerNodes(context);
+    const bundlerLimitations = addJavaScriptBundlerNodes(context);
     const relationshipOmissions = addJavaScriptModuleRelationships(context);
-    addJavaScriptStaticFindings(context);
+    const findingLimitations = addJavaScriptStaticFindings(context);
     addElectronBoundaries(context);
     addJavaScriptHtmlRoles(context);
     addJavaScriptSourceMapOriginals(context);
@@ -49,7 +51,11 @@ const buildJavaScriptArtifactGraphInput = (snapshot, fileSet, analysis) => {
         nodes: accumulator.nodes(),
         edges: accumulator.edges(),
         coverage,
-        limitations: graphLimitations(context, coverage.status, relationshipOmissions),
+        limitations: [
+            ...bundlerLimitations,
+            ...findingLimitations,
+            ...graphLimitations(context, coverage.status, relationshipOmissions),
+        ],
     };
 };
 const graphCoverage = (context) => {
@@ -64,12 +70,14 @@ const graphCoverage = (context) => {
         sourceMapPolicyGap ||
         malformedStructuredData ||
         partialJavaScript;
-    if (context.analysis.truncated_scopes > 0)
-        return partialApplicationCoverage([], null);
     if (resourceLimits.length > 0)
-        return partialApplicationCoverage(resourceLimits.map(applicationGraphResourceLimit), null);
+        return partialApplicationCoverage(semanticResourceLimitCoverage(resourceLimits), null);
     if (unknownGap)
         return partialApplicationCoverage([], null);
+    if (context.snapshot.integrity_contradictions.length > 0) {
+        const nestedArchiveWasOpaque = context.snapshot.integrity_contradictions.some(({ logical_path }) => logical_path.toLowerCase().endsWith(".asar"));
+        return partialApplicationCoverage([], nestedArchiveWasOpaque ? null : 0);
+    }
     return completeApplicationCoverage();
 };
 const semanticResourceLimits = (context) => [
@@ -77,19 +85,6 @@ const semanticResourceLimits = (context) => [
         ? []
         : semanticCoverageResourceLimits(semantic.ir.coverage))),
 ].sort();
-const applicationGraphResourceLimit = (resourceLimit) => ({
-    name: `javascript_semantic_${resourceLimit.replaceAll("-", "_")}`,
-    value: resourceLimit === "primitive-candidates"
-        ? SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT
-        : resourceLimit === "primitive-bytes"
-            ? SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT
-            : SEMANTIC_EXPRESSION_DEPTH_LIMIT,
-    unit: resourceLimit === "expression-depth"
-        ? "depth"
-        : resourceLimit === "primitive-bytes"
-            ? "bytes"
-            : "items",
-});
 const graphLimitations = (context, coverage, relationshipOmissions) => {
     const ipc = collectElectronIpcRecords(context.analysis);
     const pairings = classifyElectronIpcPairings(ipc);
@@ -104,11 +99,8 @@ const graphLimitations = (context, coverage, relationshipOmissions) => {
                 javascript.electron.native_addon_bindings.length), 0);
     return [
         ...context.analysis.limitations,
-        ...(relationshipOmissions.selfImports > 0
-            ? [
-                `${String(relationshipOmissions.selfImports)} import ${relationshipOmissions.selfImports === 1 ? "specifier" : "specifiers"} resolved back to the importing module itself and ${relationshipOmissions.selfImports === 1 ? "was" : "were"} omitted; application graph edges cannot be self-referential.`,
-            ]
-            : []),
+        ...context.snapshot.integrity_contradictions.map(({ logical_path: path }) => `Artifact integrity metadata contradicts observed bytes at ${path}; the observed bytes are untrusted.`),
+        ...selfReferenceOmissions(relationshipOmissions.selfImports, ["import specifier", "import specifiers"], "the importing module"),
         "CommonJS and ESM binding relationships were recovered from inert syntax and resolved only within the inventoried artifact container.",
         "Webpack/Rspack factories were recovered from AST literals; REA did not invoke push handlers or bundle bootstrap code.",
         "Static imports, entrypoints, workers, endpoints, and storage relationships do not prove runtime execution.",

package/dist/application/javascript/JavaScriptArtifactGraphBundlers.js

@@ -1,7 +1,8 @@
-import { addAstContainsEdge, artifactLocalIdentity, chunkLookupKey, javascriptAnalysisCoverage, moduleLookupKey, } from "./JavaScriptArtifactGraphContext.js";
+import { addAstContainsEdge, artifactLocalIdentity, chunkLookupKey, javascriptAnalysisCoverage, moduleLookupKey, selfReferenceOmissions, } from "./JavaScriptArtifactGraphContext.js";
 import { astObservationEvidence, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
-/** Project Webpack/Rspack chunk and factory literals recovered from AST. */
+/** Project Webpack/Rspack AST literals and disclose unrepresentable relationships. */
 export const addJavaScriptBundlerNodes = (context) => {
+    let selfAsyncChunks = 0;
     for (const analyzed of context.analysis.files) {
         const { file, javascript } = analyzed;
         const asset = context.assetNodes.get(file.path);
@@ -31,8 +32,9 @@ export const addJavaScriptBundlerNodes = (context) => {
             addBundlerModuleNodes(context, { ...input, chunk });
         }
         for (const record of records)
-            addBundlerRuntimeEdges(context, record);
+            selfAsyncChunks += addBundlerRuntimeEdges(context, record);
     }
+    return selfReferenceOmissions(selfAsyncChunks, ["bundler async-chunk reference", "bundler async-chunk references"], "the requesting chunk");
 };
 const createBundlerChunkNode = (context, input) => {
     const { file, registration, coverage, limitations } = input;
@@ -119,6 +121,7 @@ const addBundlerModuleNodes = (context, input) => {
     }
 };
 const addBundlerRuntimeEdges = (context, record) => {
+    let selfAsyncChunks = 0;
     const { file, registration, chunk, coverage } = record;
     for (const moduleKey of registration.entry_module_keys) {
         const resolved = context.moduleNodes.get(moduleLookupKey(file.path, moduleKey));
@@ -147,6 +150,10 @@ const addBundlerRuntimeEdges = (context, record) => {
     for (const chunkKey of registration.async_chunk_keys) {
         const lookup = chunkLookupKey(file.path, registration.runtime, chunkKey);
         const resolved = context.chunkNodes.get(lookup);
+        if (resolved?.node_id === chunk.node_id) {
+            selfAsyncChunks++;
+            continue;
+        }
         const target = resolved ?? unresolvedBundlerChunkNode(context, record, chunkKey);
         context.accumulator.addEdge({
             source_node_id: chunk.node_id,
@@ -169,6 +176,7 @@ const addBundlerRuntimeEdges = (context, record) => {
             }),
         });
     }
+    return selfAsyncChunks;
 };
 const unresolvedBundlerModuleNode = (context, record, moduleKey) => context.accumulator.addNode({
     kind: "javascript-module",