rea-agents 6.2.0 → 6.3.0

package/dist/application/javascript/JavaScriptApplicationEvidenceGraph.js

@@ -1,8 +1,21 @@
 import { JAVASCRIPT_APPLICATION_PROVIDER, JAVASCRIPT_RUNTIME_RECONCILIATION_PROVIDER, MANAGED_WORKFLOW_PROVIDER, } from "../InvestigationProviders.js";
 import { isImmutableEvidence, parseEvidence, } from "../../domain/evidence.js";
+import { AnalysisInputError, } from "../../domain/analysisErrorCore.js";
+import { projectInputIssues } from "../../domain/inputIssueProjection.js";
+import { err, ok } from "../../domain/result.js";
+import { z } from "zod";
 import { analyzeJavaScriptApplicationInputSchema, javascriptApplicationAnalysisResultSchema, } from "../../domain/javascript/javascriptApplicationAnalysis.js";
 import { javascriptRuntimeReconciliationResultSchema } from "../../domain/javascript/javascriptRuntimeReconciliationSchemas.js";
 import { managedApplicationGraphResultSchema } from "../../domain/managed/managedApplicationGraph.js";
+/** Convert typed parser issues into this workflow's caller-facing input error. */
+export const applicationGraphEvidenceInputError = (operation, failure) => new AnalysisInputError(operation, undefined, failure.issues);
+class InvalidApplicationGraphEvidence extends Error {
+    issues;
+    constructor(issues) {
+        super("Application graph Evidence failed input validation");
+        this.issues = issues;
+    }
+}
 const ownedApplicationSources = new WeakMap();
 /** Retain the producer-validated meaning of its exact immutable result snapshot. */
 export const rememberOwnedApplicationGraphEvidence = (evidence, result) => {
@@ -11,44 +24,44 @@ export const rememberOwnedApplicationGraphEvidence = (evidence, result) => {
         evidence.operation !== "analyze_javascript_application" ||
         !providerMatches(evidence, JAVASCRIPT_APPLICATION_PROVIDER))
         throw new TypeError("Owned application Evidence must bind its exact validated immutable result");
-    ownedApplicationSources.set(evidence, Object.freeze(staticApplicationSourceForResult(evidence, result)));
+    ownedApplicationSources.set(evidence, Object.freeze(staticApplicationSourceForResult(evidence, result, [])));
     return evidence;
 };
 /** Parse and authenticate one REA-produced JavaScript Application Graph Evidence. */
-export const parseApplicationGraphEvidence = (input) => {
-    const evidence = parseEvidence(input);
+export const parseApplicationGraphEvidence = (input, path = []) => captureInputValidation(() => {
+    const evidence = parseEvidenceInput(input, path);
     const owned = ownedApplicationSources.get(evidence);
     if (owned !== undefined)
         return owned;
-    if (evidence.operation === "analyze_javascript_application" &&
-        evidence.predicate_type === "rea.javascript-application-analysis" &&
-        providerMatches(evidence, JAVASCRIPT_APPLICATION_PROVIDER))
-        return staticApplicationSource(evidence);
-    if (evidence.operation === "reconcile_javascript_runtime" &&
-        evidence.predicate_type === "rea.javascript-runtime-reconciliation" &&
-        providerMatches(evidence, JAVASCRIPT_RUNTIME_RECONCILIATION_PROVIDER))
-        return staticRuntimeSource(evidence);
-    if (evidence.operation === "project_managed_application_graph" &&
-        evidence.predicate_type === "rea.managed-application-graph" &&
-        providerMatches(evidence, MANAGED_WORKFLOW_PROVIDER))
-        return managedApplicationSource(evidence);
-    throw new TypeError("Application workflow requires authenticated analyze_javascript_application, reconcile_javascript_runtime, or project_managed_application_graph Evidence");
+    if (evidence.operation === "analyze_javascript_application") {
+        requirePredicate(evidence, "rea.javascript-application-analysis", path);
+        requireProvider(evidence, JAVASCRIPT_APPLICATION_PROVIDER, path);
+        return staticApplicationSource(evidence, path);
+    }
+    if (evidence.operation === "reconcile_javascript_runtime") {
+        requirePredicate(evidence, "rea.javascript-runtime-reconciliation", path);
+        requireProvider(evidence, JAVASCRIPT_RUNTIME_RECONCILIATION_PROVIDER, path);
+        return staticRuntimeSource(evidence, path);
+    }
+    if (evidence.operation === "project_managed_application_graph") {
+        requirePredicate(evidence, "rea.managed-application-graph", path);
+        requireProvider(evidence, MANAGED_WORKFLOW_PROVIDER, path);
+        return managedApplicationSource(evidence, path);
+    }
+    throw invalidEvidence(path, "operation", "Expected authenticated JavaScript analysis, runtime reconciliation, or managed application graph Evidence.");
+});
+const staticApplicationSource = (evidence, path) => {
+    const result = parseCallerValue((input) => javascriptApplicationAnalysisResultSchema.parse(input), evidence.normalized_result, [...path, "normalized_result"]);
+    return staticApplicationSourceForResult(evidence, result, path);
 };
-const staticApplicationSource = (evidence) => {
-    const result = javascriptApplicationAnalysisResultSchema.parse(evidence.normalized_result);
-    return staticApplicationSourceForResult(evidence, result);
-};
-const staticApplicationSourceForResult = (evidence, result) => {
+const staticApplicationSourceForResult = (evidence, result, path) => {
     if (evidence.authority !== "shipped-artifact" ||
         evidence.confidence !== "derived")
-        throw new TypeError("JavaScript application Evidence authority or confidence is invalid");
+        throw invalidEvidence(path, "authority", "JavaScript application Evidence must use shipped-artifact authority and derived confidence.");
     if (evidence.predicate_type !== "rea.javascript-application-analysis")
-        throw new TypeError("JavaScript application Evidence predicate does not match its result shape");
-    analyzeJavaScriptApplicationInputSchema.parse({
-        input_path: result.input_path,
-        ...evidence.parameters,
-    });
-    assertApplicationSubject(evidence, result);
+        throw invalidEvidence(path, "predicate_type", "JavaScript application Evidence predicate does not match its result shape.");
+    parseCallerValue((input) => analyzeJavaScriptApplicationInputSchema.parse(input), { input_path: result.input_path, ...evidence.parameters }, [...path, "parameters"]);
+    assertApplicationSubject(evidence, result, path);
     return {
         evidence,
         graph: result.graph,
@@ -57,16 +70,17 @@ const staticApplicationSourceForResult = (evidence, result) => {
         semanticGraph: result.semantic_graph,
     };
 };
-const staticRuntimeSource = (evidence) => {
+const staticRuntimeSource = (evidence, path) => {
     if (evidence.authority !== "analyst-inference" ||
         evidence.confidence !== "inferred")
-        throw new TypeError("JavaScript runtime reconciliation Evidence authority or confidence is invalid");
-    const result = javascriptRuntimeReconciliationResultSchema.parse(evidence.normalized_result);
-    if (result.evidence_links.some((evidenceId) => !evidence.evidence_links.includes(evidenceId)))
-        throw new TypeError("Runtime reconciliation result references Evidence outside its envelope");
+        throw invalidEvidence(path, "authority", "Runtime reconciliation Evidence must use analyst-inference authority and inferred confidence.");
+    const result = parseCallerValue((input) => javascriptRuntimeReconciliationResultSchema.parse(input), evidence.normalized_result, [...path, "normalized_result"]);
+    const unmatchedLink = result.evidence_links.find((evidenceId) => !evidence.evidence_links.includes(evidenceId));
+    if (unmatchedLink !== undefined)
+        throw invalidEvidence([...path, "normalized_result"], "evidence_links", `Runtime reconciliation result references Evidence ${unmatchedLink} outside its envelope.`);
     const applicationLayer = result.static_layers.find(({ role }) => role === "application");
     if (applicationLayer === undefined)
-        throw new TypeError("Runtime reconciliation application layer is missing");
+        throw invalidEvidence([...path, "normalized_result"], "static_layers", "Runtime reconciliation Evidence must include its application layer.");
     return {
         evidence,
         graph: result.graph,
@@ -75,13 +89,14 @@ const staticRuntimeSource = (evidence) => {
         semanticGraph: null,
     };
 };
-const managedApplicationSource = (evidence) => {
+const managedApplicationSource = (evidence, path) => {
     if (evidence.authority !== "analyst-inference" ||
         evidence.confidence !== "inferred")
-        throw new TypeError("Managed application graph Evidence authority or confidence is invalid");
-    const result = managedApplicationGraphResultSchema.parse(evidence.normalized_result);
-    if (result.evidence_links.some((evidenceId) => !evidence.evidence_links.includes(evidenceId)))
-        throw new TypeError("Managed application graph result references Evidence outside its envelope");
+        throw invalidEvidence(path, "authority", "Managed application graph Evidence must use analyst-inference authority and inferred confidence.");
+    const result = parseCallerValue((input) => managedApplicationGraphResultSchema.parse(input), evidence.normalized_result, [...path, "normalized_result"]);
+    const unmatchedLink = result.evidence_links.find((evidenceId) => !evidence.evidence_links.includes(evidenceId));
+    if (unmatchedLink !== undefined)
+        throw invalidEvidence([...path, "normalized_result"], "evidence_links", `Managed application graph result references Evidence ${unmatchedLink} outside its envelope.`);
     return {
         evidence,
         graph: result.graph,
@@ -90,23 +105,69 @@ const managedApplicationSource = (evidence) => {
         semanticGraph: null,
     };
 };
-const assertApplicationSubject = (evidence, result) => {
+const assertApplicationSubject = (evidence, result, path) => {
     if (evidence.subject === null ||
         evidence.subject.digest.sha256 !== result.root_artifact_sha256 ||
         evidence.subject.format !== result.format ||
         evidence.subject.local_path !== result.input_path)
-        throw new TypeError("JavaScript application Evidence subject does not match its result");
+        throw invalidEvidence(path, "subject", "JavaScript application Evidence subject must match the analyzed artifact identity and input path.");
 };
 const providerMatches = (evidence, provider) => evidence.provider.id === provider.id &&
     evidence.provider.name === provider.name &&
     evidence.provider.version === provider.version;
+const requirePredicate = (evidence, expected, path) => {
+    if (evidence.predicate_type !== expected)
+        throw invalidEvidence(path, "predicate_type", `Expected predicate ${expected} for operation ${evidence.operation}.`);
+};
+const requireProvider = (evidence, expected, path) => {
+    if (!providerMatches(evidence, expected))
+        throw invalidEvidence(path, "provider", `Expected provider ${expected.id} v${expected.version} for operation ${evidence.operation}.`);
+};
 /** Parse unique, artifact-bound Evidence that may extend a native handoff. */
-export const parseNativeApplicationEvidence = (inputs) => {
-    const parsed = inputs.map((input) => parseEvidence(input));
-    if (parsed.some(({ subject }) => subject === null))
-        throw new TypeError("Native handoff Evidence requires an artifact subject");
+export const parseNativeApplicationEvidence = (inputs, path = []) => captureInputValidation(() => {
+    const parsed = inputs.map((input, index) => parseEvidenceInput(input, [...path, index]));
+    const withoutSubject = parsed.findIndex(({ subject }) => subject === null);
+    if (withoutSubject !== -1)
+        throw invalidEvidence([...path, withoutSubject], "subject", "Native handoff Evidence requires an artifact subject.");
     const ids = parsed.map(({ evidence_id: id }) => id);
     if (new Set(ids).size !== ids.length)
-        throw new TypeError("Native handoff Evidence must be unique");
+        throw invalidEvidence(path, "evidence_id", "Native handoff Evidence must be unique.");
     return parsed;
+});
+const captureInputValidation = (operation) => {
+    try {
+        return ok(operation());
+    }
+    catch (cause) {
+        if (cause instanceof InvalidApplicationGraphEvidence)
+            return err({ issues: cause.issues });
+        throw cause;
+    }
+};
+const parseEvidenceInput = (input, path) => {
+    try {
+        return parseEvidence(input);
+    }
+    catch (cause) {
+        if (cause instanceof z.ZodError)
+            throw zodInputFailure(cause, input, path);
+        throw cause;
+    }
+};
+const parseCallerValue = (parse, input, path) => {
+    try {
+        return parse(input);
+    }
+    catch (cause) {
+        if (cause instanceof z.ZodError)
+            throw zodInputFailure(cause, input, path);
+        throw cause;
+    }
 };
+const zodInputFailure = (cause, input, path) => new InvalidApplicationGraphEvidence(projectInputIssues(cause.issues, input).map((issue) => ({
+    ...issue,
+    path: [...path, ...issue.path],
+})));
+const invalidEvidence = (path, field, message) => new InvalidApplicationGraphEvidence([
+    { path: [...path, field], reason: "invalid_value", message },
+]);

package/dist/application/javascript/JavaScriptApplicationService.js

@@ -33,6 +33,7 @@ export const analyzeJavaScriptApplicationValidated = async (input, options = {})
         const reconstructed = await reconstructJavaScriptArtifact({
             input_path: input.input_path,
             format: input.format,
+            integrity_policy: input.integrity_policy,
         }, options.signal, options.progress);
         const { electron_summary: summary, ...application } = reconstructed;
         await options.progress?.report({

package/dist/application/javascript/JavaScriptApplicationWorkflowService.js

@@ -1,17 +1,17 @@
 import { z } from "zod";
-import { AnalysisInputError, AnalysisProtocolError, } from "../../domain/analysisErrorCore.js";
+import { AnalysisProtocolError } from "../../domain/analysisErrorCore.js";
 import {} from "../../domain/analysisErrorBase.js";
 import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
 import { compareJavaScriptApplicationVersions } from "../../domain/javascript/javascriptApplicationVersionComparison.js";
-import { compareApplicationVersionsInputSchema } from "../../domain/javascript/javascriptApplicationVersionComparisonSchemas.js";
+import { compareApplicationVersionsInputSchema, applicationVersionIdentitiesSchema, } from "../../domain/javascript/javascriptApplicationVersionComparisonSchemas.js";
 import { compareJavaScriptExportShapes } from "../../domain/javascript/javascriptExportShapeComparison.js";
-import { compareJavaScriptExportShapesInputSchema } from "../../domain/javascript/javascriptExportShapeComparisonSchemas.js";
+import { compareJavaScriptExportShapesInputSchema, javaScriptExportShapeIdentitiesSchema, } from "../../domain/javascript/javascriptExportShapeComparisonSchemas.js";
 import { traceApplicationFeature } from "../../domain/javascript/javascriptFeatureTrace.js";
-import { traceApplicationFeatureInputSchema } from "../../domain/javascript/javascriptFeatureTraceSchemas.js";
+import { traceApplicationFeatureInputSchema, applicationTraceIdentitiesSchema, } from "../../domain/javascript/javascriptFeatureTraceSchemas.js";
 import { err, ok } from "../../domain/result.js";
 import { compareSourceToBundle } from "../../domain/javascript/sourceToBundleComparison.js";
 import { compareSourceToBundleInputSchema } from "../../domain/javascript/sourceToBundleComparisonSchemas.js";
-import { parseApplicationGraphEvidence, parseNativeApplicationEvidence, } from "./JavaScriptApplicationEvidenceGraph.js";
+import { applicationGraphEvidenceInputError, parseApplicationGraphEvidence, parseNativeApplicationEvidence, } from "./JavaScriptApplicationEvidenceGraph.js";
 import { createApplicationFeatureTraceEvidence, createApplicationVersionComparisonEvidence, createJavaScriptExportShapeComparisonEvidence, createSourceToBundleComparisonEvidence, } from "./JavaScriptApplicationWorkflowEvidence.js";
 /** Authenticate Evidence and derive one bounded cross-layer feature trace. */
 export const traceApplicationFeatureEvidence = (rawInput) => {
@@ -24,9 +24,20 @@ export const traceApplicationFeatureEvidence = (rawInput) => {
 /** Derive one feature trace from input parsed by a trusted adapter. */
 export const traceApplicationFeatureEvidenceValidated = (input) => {
     const operation = "trace_application_feature";
+    const identities = applicationTraceIdentitiesSchema.safeParse(input);
+    if (!identities.success)
+        return err(analysisInputErrorFromIssues(operation, identities.error.issues, input));
+    const sourceResult = parseApplicationGraphEvidence(input.application, [
+        "application",
+    ]);
+    if (!sourceResult.ok)
+        return err(applicationGraphEvidenceInputError(operation, sourceResult.error));
+    const nativeResult = parseNativeApplicationEvidence(input.native_observations, ["native_observations"]);
+    if (!nativeResult.ok)
+        return err(applicationGraphEvidenceInputError(operation, nativeResult.error));
     try {
-        const source = parseApplicationGraphEvidence(input.application);
-        const nativeEvidence = parseNativeApplicationEvidence(input.native_observations);
+        const source = sourceResult.value;
+        const nativeEvidence = nativeResult.value;
         const result = traceApplicationFeature({
             sourceEvidenceId: source.evidence.evidence_id,
             graph: source.graph,
@@ -42,7 +53,7 @@ export const traceApplicationFeatureEvidenceValidated = (input) => {
         }, result));
     }
     catch (cause) {
-        return workflowFailure(operation, cause, input);
+        return workflowFailure(operation, cause);
     }
 };
 /** Authenticate both graphs and derive a tiered cross-version change graph. */
@@ -56,11 +67,26 @@ export const compareApplicationVersionsEvidence = (rawInput) => {
 /** Compare versions from input parsed by a trusted adapter. */
 export const compareApplicationVersionsEvidenceValidated = (input) => {
     const operation = "compare_application_versions";
+    const identities = applicationVersionIdentitiesSchema.safeParse(input);
+    if (!identities.success)
+        return err(analysisInputErrorFromIssues(operation, identities.error.issues, input));
+    const leftResult = parseApplicationGraphEvidence(input.left, ["left"]);
+    if (!leftResult.ok)
+        return err(applicationGraphEvidenceInputError(operation, leftResult.error));
+    const rightResult = parseApplicationGraphEvidence(input.right, ["right"]);
+    if (!rightResult.ok)
+        return err(applicationGraphEvidenceInputError(operation, rightResult.error));
+    const leftNativeResult = parseNativeApplicationEvidence(input.left_native_observations, ["left_native_observations"]);
+    if (!leftNativeResult.ok)
+        return err(applicationGraphEvidenceInputError(operation, leftNativeResult.error));
+    const rightNativeResult = parseNativeApplicationEvidence(input.right_native_observations, ["right_native_observations"]);
+    if (!rightNativeResult.ok)
+        return err(applicationGraphEvidenceInputError(operation, rightNativeResult.error));
     try {
-        const left = parseApplicationGraphEvidence(input.left);
-        const right = parseApplicationGraphEvidence(input.right);
-        const leftNative = parseNativeApplicationEvidence(input.left_native_observations);
-        const rightNative = parseNativeApplicationEvidence(input.right_native_observations);
+        const left = leftResult.value;
+        const right = rightResult.value;
+        const leftNative = leftNativeResult.value;
+        const rightNative = rightNativeResult.value;
         const result = compareJavaScriptApplicationVersions({
             left: {
                 evidenceId: left.evidence.evidence_id,
@@ -83,14 +109,19 @@ export const compareApplicationVersionsEvidenceValidated = (input) => {
         }, result));
     }
     catch (cause) {
-        return workflowFailure(operation, cause, input);
+        return workflowFailure(operation, cause);
     }
 };
 /** Compare source and bundle inputs already parsed by a trusted adapter. */
 export const compareSourceToBundleEvidenceValidated = (input) => {
     const operation = "compare_source_to_bundle";
+    const applicationResult = parseApplicationGraphEvidence(input.application, [
+        "application",
+    ]);
+    if (!applicationResult.ok)
+        return err(applicationGraphEvidenceInputError(operation, applicationResult.error));
     try {
-        const application = parseApplicationGraphEvidence(input.application);
+        const application = applicationResult.value;
         const result = compareSourceToBundle({
             reference: input.reference,
             application: {
@@ -105,7 +136,7 @@ export const compareSourceToBundleEvidenceValidated = (input) => {
         }, result));
     }
     catch (cause) {
-        return workflowFailure(operation, cause, input);
+        return workflowFailure(operation, cause);
     }
 };
 /**
@@ -122,9 +153,18 @@ export const compareJavaScriptExportShapesEvidence = (rawInput) => {
 /** Compare exact export shapes from input parsed by a trusted adapter. */
 export const compareJavaScriptExportShapesEvidenceValidated = (input) => {
     const operation = "compare_javascript_export_shapes";
+    const identities = javaScriptExportShapeIdentitiesSchema.safeParse(input);
+    if (!identities.success)
+        return err(analysisInputErrorFromIssues(operation, identities.error.issues, input));
+    const leftResult = parseApplicationGraphEvidence(input.left, ["left"]);
+    if (!leftResult.ok)
+        return err(applicationGraphEvidenceInputError(operation, leftResult.error));
+    const rightResult = parseApplicationGraphEvidence(input.right, ["right"]);
+    if (!rightResult.ok)
+        return err(applicationGraphEvidenceInputError(operation, rightResult.error));
     try {
-        const left = parseApplicationGraphEvidence(input.left);
-        const right = parseApplicationGraphEvidence(input.right);
+        const left = leftResult.value;
+        const right = rightResult.value;
         const result = compareJavaScriptExportShapes({
             left: {
                 evidenceId: left.evidence.evidence_id,
@@ -149,33 +189,7 @@ export const compareJavaScriptExportShapesEvidenceValidated = (input) => {
         }, result));
     }
     catch (cause) {
-        return workflowFailure(operation, cause, input);
+        return workflowFailure(operation, cause);
     }
 };
-const workflowFailure = (operation, cause, input) => cause instanceof z.ZodError
-    ? err(analysisInputErrorFromIssues(operation, cause.issues, input))
-    : cause instanceof TypeError &&
-        SAFE_APPLICATION_INPUT_CONSTRAINTS.has(cause.message)
-        ? err(new AnalysisInputError(operation, undefined, [
-            { path: [], reason: "invalid_value", message: cause.message },
-        ]))
-        : err(new AnalysisProtocolError("JavaScript application workflow produced an invalid result", { cause }));
-const SAFE_APPLICATION_INPUT_CONSTRAINTS = new Set([
-    "Evidence semantic identifier does not match its record",
-    "Application workflow requires authenticated analyze_javascript_application, reconcile_javascript_runtime, or project_managed_application_graph Evidence",
-    "JavaScript application Evidence authority or confidence is invalid",
-    "JavaScript application Evidence predicate does not match its result shape",
-    "JavaScript application Evidence subject does not match its result",
-    "Runtime reconciliation Evidence authority or confidence is invalid",
-    "Runtime reconciliation result references Evidence outside its envelope",
-    "Runtime reconciliation application layer is missing",
-    "Managed application graph Evidence authority or confidence is invalid",
-    "Managed application graph result references Evidence outside its envelope",
-    "Native handoff Evidence requires an artifact subject",
-    "Native handoff Evidence must be unique",
-    ...[
-        "analyze_javascript_application",
-        "reconcile_javascript_runtime",
-        "project_managed_application_graph",
-    ].map((operation) => `Evidence does not match the supported ${operation} contract`),
-]);
+const workflowFailure = (operation, cause) => err(new AnalysisProtocolError(`JavaScript application workflow failed while producing ${operation}`, { cause }));

package/dist/application/javascript/JavaScriptArtifactAnalysis.js

@@ -46,7 +46,6 @@ const analyzeArtifactFiles = (fileSet, projectSemantics) => {
     return finalizeArtifactAnalysis(state);
 };
 const finalizeArtifactAnalysis = (state) => {
-    const truncatedScopes = state.truncatedScopes;
     return {
         files: state.files,
         packages: state.packages,
@@ -57,13 +56,9 @@ const finalizeArtifactAnalysis = (state) => {
         findings: state.findings + state.htmlScripts.length,
         modules: state.modules,
         parse_failures: state.parseFailures,
-        truncated_scopes: truncatedScopes,
         limitations: [
             "JavaScript and HTML were parsed as inert text; bundle bootstrap code was never executed.",
             "Static paths and relationships may remain unresolved when expressions are dynamic or obfuscated.",
-            ...(truncatedScopes === 0
-                ? []
-                : ["Some static-analysis scopes were truncated."]),
         ],
     };
 };
@@ -118,7 +113,6 @@ const emptyArtifactAnalysis = () => ({
     findings: 0,
     modules: 0,
     parseFailures: 0,
-    truncatedScopes: 0,
 });
 const addStructuredObservations = (file, state) => {
     if (file.kind === "package-json")

package/dist/application/javascript/JavaScriptArtifactGraphBuilder.js

@@ -5,8 +5,8 @@ import { addJavaScriptHtmlRoles, addJavaScriptSourceMapOriginals, } from "./Java
 import { addJavaScriptStaticFindings } from "./JavaScriptArtifactGraphFindings.js";
 import { addJavaScriptModuleRelationships, addJavaScriptSourceModules, } from "./JavaScriptModuleRelationships.js";
 import { completeApplicationCoverage, partialApplicationCoverage, } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
-import { semanticCoverageResourceLimits } from "../../domain/javascript/javascriptSemanticCoverage.js";
-import { SEMANTIC_EXPRESSION_DEPTH_LIMIT, SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT, SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT, semanticResourceLimitReason, } from "../../domain/javascript/javascriptSemanticResourceLimits.js";
+import { semanticCoverageResourceLimits, semanticResourceLimitCoverage, } from "../../domain/javascript/javascriptSemanticCoverage.js";
+import { semanticResourceLimitReason } from "../../domain/javascript/javascriptSemanticResourceLimits.js";
 import { addJavaScriptArtifactContainers, addJavaScriptArtifactFiles, addJavaScriptPackageNodes, createJavaScriptArtifactRootNode, } from "./JavaScriptArtifactGraphStructure.js";
 import { addJavaScriptBundlerNodes } from "./JavaScriptArtifactGraphBundlers.js";
 import { addElectronBoundaries } from "./ElectronBoundaryGraph.js";
@@ -70,12 +70,14 @@ const graphCoverage = (context) => {
         sourceMapPolicyGap ||
         malformedStructuredData ||
         partialJavaScript;
-    if (context.analysis.truncated_scopes > 0)
-        return partialApplicationCoverage([], null);
     if (resourceLimits.length > 0)
-        return partialApplicationCoverage(resourceLimits.map(applicationGraphResourceLimit), null);
+        return partialApplicationCoverage(semanticResourceLimitCoverage(resourceLimits), null);
     if (unknownGap)
         return partialApplicationCoverage([], null);
+    if (context.snapshot.integrity_contradictions.length > 0) {
+        const nestedArchiveWasOpaque = context.snapshot.integrity_contradictions.some(({ logical_path }) => logical_path.toLowerCase().endsWith(".asar"));
+        return partialApplicationCoverage([], nestedArchiveWasOpaque ? null : 0);
+    }
     return completeApplicationCoverage();
 };
 const semanticResourceLimits = (context) => [
@@ -83,19 +85,6 @@ const semanticResourceLimits = (context) => [
         ? []
         : semanticCoverageResourceLimits(semantic.ir.coverage))),
 ].sort();
-const applicationGraphResourceLimit = (resourceLimit) => ({
-    name: `javascript_semantic_${resourceLimit.replaceAll("-", "_")}`,
-    value: resourceLimit === "primitive-candidates"
-        ? SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT
-        : resourceLimit === "primitive-bytes"
-            ? SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT
-            : SEMANTIC_EXPRESSION_DEPTH_LIMIT,
-    unit: resourceLimit === "expression-depth"
-        ? "depth"
-        : resourceLimit === "primitive-bytes"
-            ? "bytes"
-            : "items",
-});
 const graphLimitations = (context, coverage, relationshipOmissions) => {
     const ipc = collectElectronIpcRecords(context.analysis);
     const pairings = classifyElectronIpcPairings(ipc);
@@ -110,6 +99,7 @@ const graphLimitations = (context, coverage, relationshipOmissions) => {
                 javascript.electron.native_addon_bindings.length), 0);
     return [
         ...context.analysis.limitations,
+        ...context.snapshot.integrity_contradictions.map(({ logical_path: path }) => `Artifact integrity metadata contradicts observed bytes at ${path}; the observed bytes are untrusted.`),
         ...selfReferenceOmissions(relationshipOmissions.selfImports, ["import specifier", "import specifiers"], "the importing module"),
         "CommonJS and ESM binding relationships were recovered from inert syntax and resolved only within the inventoried artifact container.",
         "Webpack/Rspack factories were recovered from AST literals; REA did not invoke push handlers or bundle bootstrap code.",

package/dist/application/javascript/JavaScriptArtifactGraphFindings.js

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { addStaticInferenceEdge, artifactLocalIdentity, chunkLookupKey, createElectronRoleNode, javascriptAnalysisCoverage, linkElectronRoleToAsset, moduleLookupKey, resolveArtifactPath, selfReferenceOmissions, sourceNodeFor, } from "./JavaScriptArtifactGraphContext.js";
 import { astObservationEvidence, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
 import { resolveArtifactPathByContext } from "./JavaScriptArtifactPathResolution.js";
@@ -199,6 +200,9 @@ const addDiscoveredRole = (context, input) => {
     });
 };
 const addSourceMapEdge = (context, input) => {
+    const declaredUrlSha256 = createHash("sha256")
+        .update(input.value.declared_url)
+        .digest("hex");
     const resolvedPath = resolveArtifactPathByContext({
         declaredPath: input.value.declared_url,
         sourcePath: input.file.path,
@@ -207,33 +211,37 @@ const addSourceMapEdge = (context, input) => {
     }).resolved_path;
     const resolvedFile = resolvedPath === null ? undefined : context.filesByPath.get(resolvedPath);
     const resolvedNode = resolvedPath === null ? undefined : context.fileNodes.get(resolvedPath);
-    const target = resolvedFile?.kind === "source-map" && resolvedNode !== undefined
-        ? resolvedNode
-        : context.accumulator.addNode({
-            kind: "source-map",
-            identity: artifactLocalIdentity(input.file.sha256, "unresolved-source-map", input.value.declared_url),
-            observations: [
-                {
-                    label: input.value.declared_url,
-                    properties: {
-                        declared_url: input.value.declared_url,
-                        resolved_path: resolvedPath,
-                        available: false,
-                    },
-                    evidence: staticInferenceEvidence({
-                        sha256: input.file.sha256,
-                        path: input.file.path,
-                        range: input.value.location,
-                        operation: "discover-source-map",
-                        coverage: input.coverage,
-                        confidence: "medium",
-                        limitations: [
+    const isAvailable = resolvedFile?.kind === "source-map" && resolvedNode !== undefined;
+    const target = context.accumulator.addNode({
+        kind: "source-map",
+        identity: isAvailable && resolvedNode !== undefined
+            ? resolvedNode.identity
+            : artifactLocalIdentity(input.file.sha256, "unresolved-source-map", declaredUrlSha256),
+        observations: [
+            {
+                label: "source map reference",
+                properties: {
+                    declared_url: input.value.declared_url,
+                    declared_url_sha256: declaredUrlSha256,
+                    resolved_path: resolvedPath,
+                    available: isAvailable,
+                },
+                evidence: staticInferenceEvidence({
+                    sha256: input.file.sha256,
+                    path: input.file.path,
+                    range: input.value.location,
+                    operation: "discover-source-map",
+                    coverage: input.coverage,
+                    confidence: "medium",
+                    limitations: isAvailable
+                        ? []
+                        : [
                             "The declared source map was not present in the inventoried artifact.",
                         ],
-                    }),
-                },
-            ],
-        });
+                }),
+            },
+        ],
+    });
     addStaticInferenceEdge(context, {
         source: input.asset,
         target,
@@ -242,7 +250,7 @@ const addSourceMapEdge = (context, input) => {
         coverage: input.coverage,
         relation: "maps_to",
         properties: {
-            declared_url: input.value.declared_url,
+            declared_url_sha256: declaredUrlSha256,
             resolved_path: resolvedPath,
         },
     });