rea-agents 6.2.0 → 6.4.0

package/dist/application/binary/BinarySession.js

@@ -13,7 +13,8 @@ import { BinarySessionRecords } from "./BinarySessionRecords.js";
 import { binarySessionStatus } from "./BinarySessionStatus.js";
 import { resolveSessionOpen, resolveSessionTarget, validateResolvedSessionTarget, } from "./BinarySessionOpen.js";
 import { bindExecutionTarget, commitExecutionProfile, prepareSessionExecution, } from "./BinarySessionExecution.js";
-import { analysisErrorWithCleanupFailure, closeAnalysisClient, } from "./AnalysisClientCleanup.js";
+import { closeAnalysisClient } from "./AnalysisClientCleanup.js";
+import { analysisErrorWithCleanupFailure } from "../../domain/analysisErrorCleanup.js";
 const OFFICIAL_OPERATIONS = new Set(OFFICIAL_TOOL_CONTRACTS.map(({ name }) => name));
 const ENHANCED_OPERATIONS = new Set(ENHANCED_TOOL_CONTRACTS.map(({ name }) => name));
 /**
@@ -314,6 +315,22 @@ export class BinarySession extends BinarySessionRecords {
         this.#calls.set(call, generation);
         return call.finally(() => this.#calls.delete(call));
     }
+    /** Admit one composed request until its result and session bookkeeping settle. */
+    withAdmittedAnalysis(operationName, signal, operation) {
+        const generation = this.#transitionGeneration;
+        const transition = this.#transition;
+        const call = (async () => {
+            const admission = await this.#waitForTransition(operationName, signal, transition);
+            if (!admission.ok)
+                return admission;
+            return ok(await operation({
+                execute: (name, arguments_, options) => this.#execute(name, arguments_, options, Promise.resolve()),
+            }));
+        })();
+        // Register synchronously before a lifecycle transition can snapshot calls.
+        this.#calls.set(call, generation);
+        return call.finally(() => this.#calls.delete(call));
+    }
     async #execute(name, arguments_, options, transition) {
         const transitioned = await this.#waitForTransition(name, options?.signal, transition);
         if (!transitioned.ok)

package/dist/application/binary/BinarySessionOpen.js

@@ -8,7 +8,15 @@ import { SessionProviderRouter } from "./SessionProviderRouter.js";
 /** Parse a target, resolve its provider route, and validate snapshot binding. */
 export const resolveSessionOpen = async (input) => {
     const { path, options } = input;
-    const parsed = await parseBinaryTarget(path, process.cwd(), process.arch, options.targetKind, options.formatHint);
+    const parsed = await parseBinaryTarget(path, {
+        ...(options.targetKind === undefined
+            ? {}
+            : { targetKind: options.targetKind }),
+        ...(options.formatHint === undefined
+            ? {}
+            : { formatHint: options.formatHint }),
+        ...(options.signal === undefined ? {} : { signal: options.signal }),
+    });
     if (!parsed.ok)
         return parsed;
     return resolveSessionTarget({ ...input, target: parsed.value });

package/dist/application/binaryDiagnostics/BinaryLayoutService.js

@@ -50,7 +50,8 @@ export class BinaryLayoutService {
             operation: OPERATION,
             parameters: input.data,
             result: value,
-            rawResult: value,
+            // The decoded report is the only representation; do not repeat it.
+            rawResult: null,
             confidence: "observed",
             limitations: value.limitations,
             locations: [{ kind: "artifact-path", path: value.artifact.path }],

package/dist/application/binaryDiagnostics/PeResourcesPort.js

@@ -0,0 +1 @@
+export {};

package/dist/application/binaryDiagnostics/PeResourcesService.js

@@ -0,0 +1,111 @@
+import { isAbsolute } from "node:path";
+import { AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, } from "../../domain/analysisErrorCore.js";
+import { createEvidence } from "../../domain/evidence.js";
+import { inspectPeResourcesInputSchema, peResourcesSchema, } from "../../domain/native/peResources.js";
+import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
+import { err, ok } from "../../domain/result.js";
+/** Shared caller validation, output parsing and Evidence provenance for CLI/MCP. */
+export class PeResourcesService {
+    provider;
+    constructor(provider) {
+        this.provider = provider;
+    }
+    async inspect(rawInput, options) {
+        const operation = "inspect_pe_resources";
+        if (options?.signal?.aborted)
+            return err(new AnalysisCancelledError(operation));
+        const input = inspectPeResourcesInputSchema.safeParse(rawInput);
+        if (!input.success)
+            return err(analysisInputErrorFromIssues(operation, input.error.issues, rawInput, {
+                cause: input.error,
+            }));
+        if (!isAbsolute(input.data.path))
+            return err(new AnalysisInputError(operation, undefined, [
+                {
+                    path: ["path"],
+                    reason: "invalid_format",
+                    message: "Expected an absolute filesystem path on this host.",
+                },
+            ]));
+        const result = await this.provider.inspect(input.data, options);
+        if (!result.ok)
+            return result;
+        if (options?.signal?.aborted)
+            return err(new AnalysisCancelledError(operation));
+        const report = peResourcesSchema.safeParse(result.value);
+        if (!report.success ||
+            report.data.artifact.path !== input.data.path ||
+            !validReport(report.data, input.data.max_entries, input.data.max_file_bytes))
+            return err(new AnalysisOutputError(operation, "PE resource provider returned malformed output or changed artifact identity."));
+        const value = report.data;
+        return ok(createEvidence({
+            path: value.artifact.path,
+            format: "pe",
+            sha256: value.artifact.sha256,
+        }, this.provider.identity, {
+            operation,
+            parameters: input.data,
+            result: value,
+            confidence: "observed",
+            limitations: value.limitations,
+            locations: [{ kind: "artifact-path", path: value.artifact.path }],
+        }));
+    }
+}
+/** Check cross-field invariants before provider output becomes public Evidence. */
+const validReport = (report, maxEntries, maxBytes) => {
+    const inside = ({ offset, bytes }) => offset <= report.artifact.bytes - bytes;
+    if (report.artifact.bytes > maxBytes ||
+        report.coverage.resources !== report.resources.length ||
+        report.coverage.examined_entries > maxEntries ||
+        report.coverage.examined_entries !==
+            report.directories.reduce((sum, item) => sum + item.named_entries + item.id_entries, 0))
+        return false;
+    if (report.directory === null &&
+        (report.directories.length > 0 || report.resources.length > 0))
+        return false;
+    if (report.directory !== null &&
+        (!inside(report.directory.location) ||
+            !inside(report.directory.data_directory_location)))
+        return false;
+    if (!report.directories.every((item) => inside(item.location)))
+        return false;
+    if (!report.resources.every((item, index) => item.index === index &&
+        inside(item.data_entry_location) &&
+        inside(item.payload.location) &&
+        item.entry_locations.every(inside) &&
+        [item.type, item.name, item.language].every((identity) => identity.kind === "id" || inside(identity.location))))
+        return false;
+    return report.icon_groups.every((group) => {
+        const resource = report.resources[group.resource_index];
+        if (resource === undefined ||
+            resource.type.kind !== "id" ||
+            resource.type.id !== 14)
+            return false;
+        return group.images.every((image) => inside(image.location) &&
+            image.location.offset >= resource.payload.location.offset &&
+            image.location.offset + image.location.bytes <=
+                resource.payload.location.offset + resource.payload.location.bytes &&
+            image.candidate_resource_indices.every((index) => {
+                const icon = report.resources[index];
+                return (icon !== undefined &&
+                    icon.type.kind === "id" &&
+                    icon.type.id === 3 &&
+                    icon.name.kind === "id" &&
+                    icon.name.id === image.resource_id);
+            }) &&
+            (image.same_language_resource_index === null
+                ? image.size_matches === null
+                : image.candidate_resource_indices.includes(image.same_language_resource_index) &&
+                    sameIdentity(report.resources[image.same_language_resource_index]?.language, resource.language) &&
+                    image.size_matches ===
+                        (report.resources[image.same_language_resource_index]?.payload
+                            .location.bytes ===
+                            image.declared_bytes)));
+    });
+};
+const sameIdentity = (left, right) => left?.kind === "id" && right.kind === "id"
+    ? left.id === right.id
+    : left?.kind === "name" &&
+        right.kind === "name" &&
+        left.utf16le_hex === right.utf16le_hex;

package/dist/application/binaryDiagnostics/RecordedCrashService.js

@@ -53,7 +53,8 @@ export class RecordedCrashService {
             operation: OPERATION,
             parameters: input.data,
             result: value,
-            rawResult: value,
+            // The decoded report is the only representation; do not repeat it.
+            rawResult: null,
             confidence: value.debugger.status === "available" ? "derived" : "observed",
             limitations: value.limitations,
             locations: [{ kind: "artifact-path", path: value.artifact.path }],

package/dist/application/evm/EvmInterfaceService.js

@@ -15,6 +15,9 @@ export class EvmInterfaceService {
     constructor(provider) {
         this.provider = provider;
     }
+    close() {
+        return this.provider.close?.() ?? Promise.resolve();
+    }
     /** Preserve selected byte identity while clearly labeling recovered ABI candidates as inferences. */
     async inspect(rawInput, options) {
         if (options?.signal?.aborted)

package/dist/application/firmware/FirmwareAnalysisService.js

@@ -9,6 +9,9 @@ export class FirmwareAnalysisService {
     constructor(provider) {
         this.provider = provider;
     }
+    close() {
+        return this.provider.close?.() ?? Promise.resolve();
+    }
     /** Execute an explicit inspection or extraction and preserve its producing identity. */
     async execute(operation, input, options) {
         if (options?.signal?.aborted === true)

package/dist/application/investigation/InspectEvidenceBundle.js

@@ -0,0 +1,18 @@
+import { AnalysisInputError } from "../../domain/analysisErrorCore.js";
+import { err, ok } from "../../domain/result.js";
+import { summarizeEvidenceBundle, } from "../../domain/evidenceRecordSummary.js";
+/** Select complete bundle delivery or discovery metadata without analysis payloads. */
+export const inspectEvidenceBundle = (bundle, options) => {
+    if (options.detail === "complete" && options.filters !== undefined)
+        return err(new AnalysisInputError("get_evidence_bundle", undefined, [
+            {
+                path: ["filters"],
+                reason: "invalid_value",
+                message: "Record filters require detail: summary; complete returns the canonical bundle.",
+                expected: "detail: summary",
+            },
+        ]));
+    return ok(options.detail === "summary"
+        ? summarizeEvidenceBundle(bundle, options.filters)
+        : bundle);
+};

package/dist/application/javascript/ElectronActiveEvidence.js

@@ -1,4 +1,4 @@
-import { canonicalDigest } from "../../domain/comparisonSemantics.js";
+import { digestCanonicalValue } from "../../domain/canonicalDigest.js";
 import { createEvidence } from "../../domain/evidence.js";
 import { jsonObjectSchema, jsonValueSchema } from "../../domain/jsonValue.js";
 /** Commit the selected Electron experiment and its observed result. */
@@ -24,6 +24,6 @@ const parameters = (input) => {
     const scenario = jsonObjectSchema.parse(input);
     return {
         ...scenario,
-        scenario_sha256: canonicalDigest(scenario, "Electron scenario"),
+        scenario_sha256: digestCanonicalValue(scenario, "Electron scenario"),
     };
 };

package/dist/application/javascript/ElectronBoundaryAnalysis.js

@@ -1,4 +1,4 @@
-import { compareCodePoints } from "../../domain/canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";
 import { resolveArtifactPathByContext } from "./JavaScriptArtifactPathResolution.js";
 /** Flatten all per-file IPC facts into deterministic application records. */
 export const collectElectronIpcRecords = (analysis) => analysis.files
@@ -7,7 +7,7 @@ export const collectElectronIpcRecords = (analysis) => analysis.files
     file,
     finding,
 })))
-    .sort((left, right) => compareCodePoints(left.key, right.key));
+    .sort((left, right) => compareUnicodeCodePoints(left.key, right.key));
 /** Match only exact literal channels and retain ambiguous matches separately. */
 export const classifyElectronIpcPairings = (records) => {
     const handlers = records.filter(isMainHandler);

package/dist/application/javascript/ElectronBoundaryGraphContext.js

@@ -1,9 +1,10 @@
 import { sha256Text } from "../../domain/javascript/javascriptStaticAnalysisHelpers.js";
+import { sourceNodeFor, } from "./JavaScriptArtifactGraphContext.js";
 import { astObservationEvidence, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
 /** Resolve the file or recovered bundle module that owns one finding. */
-export const electronFindingSourceNode = (context, file, moduleKey) => moduleKey === null
+export const electronFindingSourceNode = (context, file, moduleKey, runtime) => moduleKey === null
     ? (context.assetNodes.get(file.path) ?? context.fileNodes.get(file.path))
-    : context.moduleNodes.get(`${file.path}\0${moduleKey}`);
+    : sourceNodeFor(context, file.path, moduleKey, runtime);
 /** Observation-scoped identity shared safely across different artifact files. */
 export const electronObservationIdentity = (context, scope, key) => ({
     strategy: "observation-fingerprint",

package/dist/application/javascript/ElectronBoundaryGraphIpc.js

@@ -21,7 +21,7 @@ const addIpcRecord = (state, record) => {
     const coverage = coverageFor(context, record.file);
     if (coverage === undefined)
         return;
-    const source = electronFindingSourceNode(context, record.file, record.finding.module_key);
+    const source = electronFindingSourceNode(context, record.file, record.finding.module_key, record.finding.module_runtime);
     if (source === undefined)
         return;
     state.sources.set(record.key, source);
@@ -181,7 +181,7 @@ const addValidationObservations = (state) => {
         for (const validation of javascript.electron.sender_validations) {
             const handlerRecord = containingHandler(state.records, file, validation);
             const target = handlerRecord === undefined
-                ? electronFindingSourceNode(state.context, file, validation.module_key)
+                ? electronFindingSourceNode(state.context, file, validation.module_key, validation.module_runtime)
                 : state.handlers.get(handlerRecord.key);
             if (target !== undefined)
                 addValidationObservation({

package/dist/application/javascript/ElectronBoundaryGraphNative.js

@@ -1,5 +1,7 @@
 import { javascriptAnalysisCoverage, resolveArtifactPath, } from "./JavaScriptArtifactGraphContext.js";
 import { astObservationEvidence } from "./JavaScriptArtifactGraphEvidence.js";
+import { compositeKey } from "../../domain/unicodeCodePointOrder.js";
+import { javascriptDisplayText } from "../../domain/javascript/javascriptAstValues.js";
 import { addElectronInferenceEdge, electronFindingSourceNode, electronObservationIdentity, electronRangeKey, } from "./ElectronBoundaryGraphContext.js";
 /** Project JavaScript-requested native addon binding and re-export surfaces. */
 export const addElectronNativeBoundaries = (context) => {
@@ -14,21 +16,32 @@ export const addElectronNativeBoundaries = (context) => {
 };
 const addNativeBinding = (input) => {
     const { context, file, value, coverage } = input;
-    const source = electronFindingSourceNode(context, file, value.module_key);
+    const source = electronFindingSourceNode(context, file, value.module_key, value.module_runtime);
     if (source === undefined)
         return;
     const resolved = resolveArtifactPath(value.specifier, file.path, context.filesByPath, value.module_kind);
     const addon = resolved === null ? undefined : context.fileNodes.get(resolved);
     const binding = context.accumulator.addNode({
         kind: "native-export",
-        identity: electronObservationIdentity(context, "javascript-requested-native-export", `${file.path}:${value.specifier}:${value.binding_kind}:${value.members.join("\0")}:${electronRangeKey(value.location)}`),
+        identity: electronObservationIdentity(context, "javascript-requested-native-export", compositeKey([
+            file.path,
+            value.specifier,
+            value.binding_kind,
+            value.members,
+            value.namespace_access ?? null,
+            value.dynamic_member_access ?? null,
+            electronRangeKey(value.location),
+        ])),
         observations: [
             {
-                label: value.members.join(", "),
+                label: value.members.map(javascriptDisplayText).join(", ") ||
+                    value.specifier,
                 properties: {
                     specifier: value.specifier,
                     binding_kind: value.binding_kind,
                     requested_members: value.members,
+                    namespace_access: value.namespace_access ?? null,
+                    dynamic_member_access: value.dynamic_member_access ?? null,
                     resolved_path: resolved,
                     native_export_verification: "not-performed",
                 },
@@ -57,6 +70,8 @@ const addNativeBinding = (input) => {
             specifier: value.specifier,
             binding_kind: value.binding_kind,
             requested_members: value.members,
+            namespace_access: value.namespace_access ?? null,
+            dynamic_member_access: value.dynamic_member_access ?? null,
         },
         limitations: [
             "Requested JavaScript members are not verified native exports.",
@@ -75,6 +90,8 @@ const addNativeBinding = (input) => {
         properties: {
             resolved_path: resolved,
             requested_members: value.members,
+            namespace_access: value.namespace_access ?? null,
+            dynamic_member_access: value.dynamic_member_access ?? null,
             verified: false,
         },
         confidence: "medium",

package/dist/application/javascript/ElectronBoundaryGraphWindows.js

@@ -10,17 +10,17 @@ export const addElectronWindowBoundaries = (context) => {
             continue;
         const coverage = javascriptAnalysisCoverage(javascript);
         for (const value of javascript.electron.browser_windows) {
-            const source = electronFindingSourceNode(context, file, value.module_key);
+            const source = electronFindingSourceNode(context, file, value.module_key, value.module_runtime);
             if (source !== undefined)
                 addBrowserWindow({ context, file, source, value, coverage });
         }
         for (const value of javascript.electron.context_bridge_apis) {
-            const source = electronFindingSourceNode(context, file, value.module_key);
+            const source = electronFindingSourceNode(context, file, value.module_key, value.module_runtime);
             if (source !== undefined)
                 addContextBridge({ context, file, source, value, coverage });
         }
         for (const value of javascript.electron.utility_processes) {
-            const source = electronFindingSourceNode(context, file, value.module_key);
+            const source = electronFindingSourceNode(context, file, value.module_key, value.module_runtime);
             if (source !== undefined)
                 addUtilityProcess({ context, file, source, value, coverage });
         }

package/dist/application/javascript/JavaScriptApplicationEvidence.js

@@ -36,4 +36,5 @@ const applicationObservation = (input, result) => ({
 });
 const parameters = (input) => ({
     format: input.format,
+    integrity_policy: input.integrity_policy,
 });

package/dist/application/javascript/JavaScriptApplicationEvidenceGraph.js

@@ -1,8 +1,21 @@
 import { JAVASCRIPT_APPLICATION_PROVIDER, JAVASCRIPT_RUNTIME_RECONCILIATION_PROVIDER, MANAGED_WORKFLOW_PROVIDER, } from "../InvestigationProviders.js";
 import { isImmutableEvidence, parseEvidence, } from "../../domain/evidence.js";
+import { AnalysisInputError, } from "../../domain/analysisErrorCore.js";
+import { projectInputIssues } from "../../domain/inputIssueProjection.js";
+import { err, ok } from "../../domain/result.js";
+import { z } from "zod";
 import { analyzeJavaScriptApplicationInputSchema, javascriptApplicationAnalysisResultSchema, } from "../../domain/javascript/javascriptApplicationAnalysis.js";
 import { javascriptRuntimeReconciliationResultSchema } from "../../domain/javascript/javascriptRuntimeReconciliationSchemas.js";
 import { managedApplicationGraphResultSchema } from "../../domain/managed/managedApplicationGraph.js";
+/** Convert typed parser issues into this workflow's caller-facing input error. */
+export const applicationGraphEvidenceInputError = (operation, failure) => new AnalysisInputError(operation, undefined, failure.issues);
+class InvalidApplicationGraphEvidence extends Error {
+    issues;
+    constructor(issues) {
+        super("Application graph Evidence failed input validation");
+        this.issues = issues;
+    }
+}
 const ownedApplicationSources = new WeakMap();
 /** Retain the producer-validated meaning of its exact immutable result snapshot. */
 export const rememberOwnedApplicationGraphEvidence = (evidence, result) => {
@@ -11,44 +24,44 @@ export const rememberOwnedApplicationGraphEvidence = (evidence, result) => {
         evidence.operation !== "analyze_javascript_application" ||
         !providerMatches(evidence, JAVASCRIPT_APPLICATION_PROVIDER))
         throw new TypeError("Owned application Evidence must bind its exact validated immutable result");
-    ownedApplicationSources.set(evidence, Object.freeze(staticApplicationSourceForResult(evidence, result)));
+    ownedApplicationSources.set(evidence, Object.freeze(staticApplicationSourceForResult(evidence, result, [])));
     return evidence;
 };
 /** Parse and authenticate one REA-produced JavaScript Application Graph Evidence. */
-export const parseApplicationGraphEvidence = (input) => {
-    const evidence = parseEvidence(input);
+export const parseApplicationGraphEvidence = (input, path = []) => captureInputValidation(() => {
+    const evidence = parseEvidenceInput(input, path);
     const owned = ownedApplicationSources.get(evidence);
     if (owned !== undefined)
         return owned;
-    if (evidence.operation === "analyze_javascript_application" &&
-        evidence.predicate_type === "rea.javascript-application-analysis" &&
-        providerMatches(evidence, JAVASCRIPT_APPLICATION_PROVIDER))
-        return staticApplicationSource(evidence);
-    if (evidence.operation === "reconcile_javascript_runtime" &&
-        evidence.predicate_type === "rea.javascript-runtime-reconciliation" &&
-        providerMatches(evidence, JAVASCRIPT_RUNTIME_RECONCILIATION_PROVIDER))
-        return staticRuntimeSource(evidence);
-    if (evidence.operation === "project_managed_application_graph" &&
-        evidence.predicate_type === "rea.managed-application-graph" &&
-        providerMatches(evidence, MANAGED_WORKFLOW_PROVIDER))
-        return managedApplicationSource(evidence);
-    throw new TypeError("Application workflow requires authenticated analyze_javascript_application, reconcile_javascript_runtime, or project_managed_application_graph Evidence");
+    if (evidence.operation === "analyze_javascript_application") {
+        requirePredicate(evidence, "rea.javascript-application-analysis", path);
+        requireProvider(evidence, JAVASCRIPT_APPLICATION_PROVIDER, path);
+        return staticApplicationSource(evidence, path);
+    }
+    if (evidence.operation === "reconcile_javascript_runtime") {
+        requirePredicate(evidence, "rea.javascript-runtime-reconciliation", path);
+        requireProvider(evidence, JAVASCRIPT_RUNTIME_RECONCILIATION_PROVIDER, path);
+        return staticRuntimeSource(evidence, path);
+    }
+    if (evidence.operation === "project_managed_application_graph") {
+        requirePredicate(evidence, "rea.managed-application-graph", path);
+        requireProvider(evidence, MANAGED_WORKFLOW_PROVIDER, path);
+        return managedApplicationSource(evidence, path);
+    }
+    throw invalidEvidence(path, "operation", "Expected authenticated JavaScript analysis, runtime reconciliation, or managed application graph Evidence.");
+});
+const staticApplicationSource = (evidence, path) => {
+    const result = parseCallerValue((input) => javascriptApplicationAnalysisResultSchema.parse(input), evidence.normalized_result, [...path, "normalized_result"]);
+    return staticApplicationSourceForResult(evidence, result, path);
 };
-const staticApplicationSource = (evidence) => {
-    const result = javascriptApplicationAnalysisResultSchema.parse(evidence.normalized_result);
-    return staticApplicationSourceForResult(evidence, result);
-};
-const staticApplicationSourceForResult = (evidence, result) => {
+const staticApplicationSourceForResult = (evidence, result, path) => {
     if (evidence.authority !== "shipped-artifact" ||
         evidence.confidence !== "derived")
-        throw new TypeError("JavaScript application Evidence authority or confidence is invalid");
+        throw invalidEvidence(path, "authority", "JavaScript application Evidence must use shipped-artifact authority and derived confidence.");
     if (evidence.predicate_type !== "rea.javascript-application-analysis")
-        throw new TypeError("JavaScript application Evidence predicate does not match its result shape");
-    analyzeJavaScriptApplicationInputSchema.parse({
-        input_path: result.input_path,
-        ...evidence.parameters,
-    });
-    assertApplicationSubject(evidence, result);
+        throw invalidEvidence(path, "predicate_type", "JavaScript application Evidence predicate does not match its result shape.");
+    parseCallerValue((input) => analyzeJavaScriptApplicationInputSchema.parse(input), { input_path: result.input_path, ...evidence.parameters }, [...path, "parameters"]);
+    assertApplicationSubject(evidence, result, path);
     return {
         evidence,
         graph: result.graph,
@@ -57,16 +70,17 @@ const staticApplicationSourceForResult = (evidence, result) => {
         semanticGraph: result.semantic_graph,
     };
 };
-const staticRuntimeSource = (evidence) => {
+const staticRuntimeSource = (evidence, path) => {
     if (evidence.authority !== "analyst-inference" ||
         evidence.confidence !== "inferred")
-        throw new TypeError("JavaScript runtime reconciliation Evidence authority or confidence is invalid");
-    const result = javascriptRuntimeReconciliationResultSchema.parse(evidence.normalized_result);
-    if (result.evidence_links.some((evidenceId) => !evidence.evidence_links.includes(evidenceId)))
-        throw new TypeError("Runtime reconciliation result references Evidence outside its envelope");
+        throw invalidEvidence(path, "authority", "Runtime reconciliation Evidence must use analyst-inference authority and inferred confidence.");
+    const result = parseCallerValue((input) => javascriptRuntimeReconciliationResultSchema.parse(input), evidence.normalized_result, [...path, "normalized_result"]);
+    const unmatchedLink = result.evidence_links.find((evidenceId) => !evidence.evidence_links.includes(evidenceId));
+    if (unmatchedLink !== undefined)
+        throw invalidEvidence([...path, "normalized_result"], "evidence_links", `Runtime reconciliation result references Evidence ${unmatchedLink} outside its envelope.`);
     const applicationLayer = result.static_layers.find(({ role }) => role === "application");
     if (applicationLayer === undefined)
-        throw new TypeError("Runtime reconciliation application layer is missing");
+        throw invalidEvidence([...path, "normalized_result"], "static_layers", "Runtime reconciliation Evidence must include its application layer.");
     return {
         evidence,
         graph: result.graph,
@@ -75,13 +89,14 @@ const staticRuntimeSource = (evidence) => {
         semanticGraph: null,
     };
 };
-const managedApplicationSource = (evidence) => {
+const managedApplicationSource = (evidence, path) => {
     if (evidence.authority !== "analyst-inference" ||
         evidence.confidence !== "inferred")
-        throw new TypeError("Managed application graph Evidence authority or confidence is invalid");
-    const result = managedApplicationGraphResultSchema.parse(evidence.normalized_result);
-    if (result.evidence_links.some((evidenceId) => !evidence.evidence_links.includes(evidenceId)))
-        throw new TypeError("Managed application graph result references Evidence outside its envelope");
+        throw invalidEvidence(path, "authority", "Managed application graph Evidence must use analyst-inference authority and inferred confidence.");
+    const result = parseCallerValue((input) => managedApplicationGraphResultSchema.parse(input), evidence.normalized_result, [...path, "normalized_result"]);
+    const unmatchedLink = result.evidence_links.find((evidenceId) => !evidence.evidence_links.includes(evidenceId));
+    if (unmatchedLink !== undefined)
+        throw invalidEvidence([...path, "normalized_result"], "evidence_links", `Managed application graph result references Evidence ${unmatchedLink} outside its envelope.`);
     return {
         evidence,
         graph: result.graph,
@@ -90,23 +105,69 @@ const managedApplicationSource = (evidence) => {
         semanticGraph: null,
     };
 };
-const assertApplicationSubject = (evidence, result) => {
+const assertApplicationSubject = (evidence, result, path) => {
     if (evidence.subject === null ||
         evidence.subject.digest.sha256 !== result.root_artifact_sha256 ||
         evidence.subject.format !== result.format ||
         evidence.subject.local_path !== result.input_path)
-        throw new TypeError("JavaScript application Evidence subject does not match its result");
+        throw invalidEvidence(path, "subject", "JavaScript application Evidence subject must match the analyzed artifact identity and input path.");
 };
 const providerMatches = (evidence, provider) => evidence.provider.id === provider.id &&
     evidence.provider.name === provider.name &&
     evidence.provider.version === provider.version;
+const requirePredicate = (evidence, expected, path) => {
+    if (evidence.predicate_type !== expected)
+        throw invalidEvidence(path, "predicate_type", `Expected predicate ${expected} for operation ${evidence.operation}.`);
+};
+const requireProvider = (evidence, expected, path) => {
+    if (!providerMatches(evidence, expected))
+        throw invalidEvidence(path, "provider", `Expected provider ${expected.id} v${expected.version} for operation ${evidence.operation}.`);
+};
 /** Parse unique, artifact-bound Evidence that may extend a native handoff. */
-export const parseNativeApplicationEvidence = (inputs) => {
-    const parsed = inputs.map((input) => parseEvidence(input));
-    if (parsed.some(({ subject }) => subject === null))
-        throw new TypeError("Native handoff Evidence requires an artifact subject");
+export const parseNativeApplicationEvidence = (inputs, path = []) => captureInputValidation(() => {
+    const parsed = inputs.map((input, index) => parseEvidenceInput(input, [...path, index]));
+    const withoutSubject = parsed.findIndex(({ subject }) => subject === null);
+    if (withoutSubject !== -1)
+        throw invalidEvidence([...path, withoutSubject], "subject", "Native handoff Evidence requires an artifact subject.");
     const ids = parsed.map(({ evidence_id: id }) => id);
     if (new Set(ids).size !== ids.length)
-        throw new TypeError("Native handoff Evidence must be unique");
+        throw invalidEvidence(path, "evidence_id", "Native handoff Evidence must be unique.");
     return parsed;
+});
+const captureInputValidation = (operation) => {
+    try {
+        return ok(operation());
+    }
+    catch (cause) {
+        if (cause instanceof InvalidApplicationGraphEvidence)
+            return err({ issues: cause.issues });
+        throw cause;
+    }
+};
+const parseEvidenceInput = (input, path) => {
+    try {
+        return parseEvidence(input);
+    }
+    catch (cause) {
+        if (cause instanceof z.ZodError)
+            throw zodInputFailure(cause, input, path);
+        throw cause;
+    }
+};
+const parseCallerValue = (parse, input, path) => {
+    try {
+        return parse(input);
+    }
+    catch (cause) {
+        if (cause instanceof z.ZodError)
+            throw zodInputFailure(cause, input, path);
+        throw cause;
+    }
 };
+const zodInputFailure = (cause, input, path) => new InvalidApplicationGraphEvidence(projectInputIssues(cause.issues, input).map((issue) => ({
+    ...issue,
+    path: [...path, ...issue.path],
+})));
+const invalidEvidence = (path, field, message) => new InvalidApplicationGraphEvidence([
+    { path: [...path, field], reason: "invalid_value", message },
+]);