rea-agents 6.2.0 → 6.4.0

package/dist/domain/javascript/electronStaticAnalysisBrowser.js

@@ -1,21 +1,21 @@
 import * as t from "@babel/types";
-import { boundedExpression, collectContextBridgeMembers, electronStaticValue, objectProperty, } from "./electronStaticAnalysisValues.js";
-import { compareCodePoints } from "../canonicalOrdering.js";
+import { boundedExpression, collectContextBridgeMembers, electronCalleePath, electronStaticValue, objectProperty, } from "./electronStaticAnalysisValues.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
-import { argumentNode, calleeName, range, staticPath, staticPathResolutionContext, } from "./javascriptStaticAnalysisHelpers.js";
+import { argumentNode, range, staticPath, staticPathResolutionContext, } from "./javascriptStaticAnalysisHelpers.js";
 import { semanticStaticPropertyName } from "./javascriptAstValues.js";
 /** Inspect BrowserWindow, contextBridge, and utility-process syntax. */
 export const inspectElectronBrowserNode = (node, context) => {
     if (t.isNewExpression(node))
         inspectBrowserWindow(node, context);
-    if (!t.isCallExpression(node))
+    if (!t.isCallExpression(node) && !t.isOptionalCallExpression(node))
         return;
     inspectContextBridge(node, context);
     inspectUtilityProcess(node, context);
 };
 const inspectBrowserWindow = (node, context) => {
-    const name = calleeName(node.callee);
-    if (name !== "BrowserWindow" && !name.endsWith(".BrowserWindow"))
+    const path = electronCalleePath(node.callee, context);
+    if (path?.length !== 1 || path[0] !== "BrowserWindow")
         return;
     const options = argumentNode(node.arguments[0]);
     const collected = collectWindowOptions(context.source, options);
@@ -34,7 +34,7 @@ const inspectBrowserWindow = (node, context) => {
     };
     addLocatedFinding(context, {
         collection: context.accumulator.browserWindows,
-        key: `electron-window\0${name}`,
+        key: "electron-window\0BrowserWindow",
         node,
         value: finding,
     });
@@ -98,7 +98,7 @@ const collectWebPreferences = (source, object) => {
             unknown += 1;
         preferences.push({ name, value });
     }
-    preferences.sort((left, right) => compareCodePoints(left.name, right.name));
+    preferences.sort((left, right) => compareUnicodeCodePoints(left.name, right.name));
     return {
         status: "object-literal",
         preferences,
@@ -107,11 +107,10 @@ const collectWebPreferences = (source, object) => {
     };
 };
 const inspectContextBridge = (node, context) => {
-    const name = calleeName(node.callee);
-    const main = name === "contextBridge.exposeInMainWorld" ||
-        name.endsWith(".contextBridge.exposeInMainWorld");
-    const isolated = name === "contextBridge.exposeInIsolatedWorld" ||
-        name.endsWith(".contextBridge.exposeInIsolatedWorld");
+    const path = electronCalleePath(node.callee, context);
+    const exposureMethod = path?.length === 2 && path[0] === "contextBridge" ? path[1] : undefined;
+    const main = exposureMethod === "exposeInMainWorld";
+    const isolated = exposureMethod === "exposeInIsolatedWorld";
     if (!main && !isolated)
         return;
     const keyNode = argumentNode(node.arguments[isolated ? 1 : 0]);
@@ -148,8 +147,8 @@ const inspectContextBridge = (node, context) => {
     });
 };
 const inspectUtilityProcess = (node, context) => {
-    const name = calleeName(node.callee);
-    if (name !== "utilityProcess.fork" && !name.endsWith(".utilityProcess.fork"))
+    const path = electronCalleePath(node.callee, context);
+    if (path?.length !== 2 || path[0] !== "utilityProcess" || path[1] !== "fork")
         return;
     const moduleNode = argumentNode(node.arguments[0]);
     const modulePath = moduleNode === undefined ? undefined : staticPath(moduleNode);

package/dist/domain/javascript/electronStaticAnalysisIpc.js

@@ -1,11 +1,12 @@
 import * as t from "@babel/types";
-import { boundedExpression, electronStaticValue, handlerKind, } from "./electronStaticAnalysisValues.js";
+import { boundedExpression, electronCalleePath, electronStaticValue, handlerKind, } from "./electronStaticAnalysisValues.js";
 import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
 import { argumentNode, calleeName, range, } from "./javascriptStaticAnalysisHelpers.js";
 import { semanticStaticPropertyName } from "./javascriptAstValues.js";
+import { compositeKey } from "../unicodeCodePointOrder.js";
 /** Inspect Electron IPC operations and validation candidates. */
 export const inspectElectronIpcNode = (node, context) => {
-    if (t.isCallExpression(node)) {
+    if (t.isCallExpression(node) || t.isOptionalCallExpression(node)) {
         inspectIpcCall(node, context);
         inspectValidationCall(node, context);
     }
@@ -13,8 +14,7 @@ export const inspectElectronIpcNode = (node, context) => {
         inspectValidationComparison(node, context);
 };
 const inspectIpcCall = (node, context) => {
-    const name = calleeName(node.callee);
-    const descriptor = ipcDescriptor(name);
+    const descriptor = ipcDescriptor(electronCalleePath(node.callee, context));
     if (descriptor === undefined)
         return;
     const channelNode = argumentNode(node.arguments[0]);
@@ -116,14 +116,24 @@ const addValidation = (context, node, input) => {
     };
     addLocatedFinding(context, {
         collection: context.accumulator.senderValidations,
-        key: `electron-validation\0${input.subject}\0${input.mechanism}\0${input.expected.status === "literal" ? String(input.expected.value) : input.expected.expression}`,
+        key: compositeKey([
+            "electron-validation",
+            input.subject,
+            input.mechanism,
+            input.expected.status === "literal"
+                ? String(input.expected.value)
+                : input.expected.expression,
+        ]),
         node,
         value: finding,
     });
 };
-const ipcDescriptor = (name) => {
-    const renderer = suffixOperation(name, "ipcRenderer");
-    if (renderer !== undefined) {
+const ipcDescriptor = (path) => {
+    if (path?.length !== 2)
+        return undefined;
+    const [object, operation] = path;
+    if (object === "ipcRenderer" && operation !== undefined) {
+        const renderer = operation;
         switch (renderer) {
             case "send":
                 return { side: "renderer", operation: "send", mode: "send" };
@@ -149,7 +159,7 @@ const ipcDescriptor = (name) => {
                 return { side: "renderer", operation: "once", mode: "listen" };
         }
     }
-    const main = suffixOperation(name, "ipcMain");
+    const main = object === "ipcMain" ? operation : undefined;
     switch (main) {
         case "on":
             return { side: "main", operation: "on", mode: "listen" };
@@ -163,19 +173,8 @@ const ipcDescriptor = (name) => {
             return undefined;
     }
 };
-const suffixOperation = (name, object) => {
-    const marker = `${object}.`;
-    const index = name.lastIndexOf(marker);
-    if (index < 0)
-        return undefined;
-    const prefix = name.slice(0, index);
-    if (prefix !== "" && !prefix.endsWith("."))
-        return undefined;
-    const operation = name.slice(index + marker.length);
-    return operation.includes(".") ? undefined : operation;
-};
 const senderSubject = (node) => {
-    const name = t.isCallExpression(node)
+    const name = t.isCallExpression(node) || t.isOptionalCallExpression(node)
         ? calleeName(node.callee)
         : calleeName(node);
     if (/(?:^|\.)sender\.getURL$/u.test(name))

package/dist/domain/javascript/electronStaticAnalysisNative.js

@@ -1,9 +1,9 @@
 import * as t from "@babel/types";
-import { compareCodePoints } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints, compositeKey, } from "../unicodeCodePointOrder.js";
 import { stripQueryAndFragment } from "../artifactPathSyntax.js";
 import { addLocatedFinding } from "./javascriptStaticAnalysisFindings.js";
 import { argumentNode, calleeName, range, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
-import { propertyName, semanticStaticPropertyName, } from "./javascriptAstValues.js";
+import { propertyName, semanticStaticPropertyKey, } from "./javascriptAstValues.js";
 /** Inspect JavaScript-side imports and re-exports of native .node addons. */
 export const inspectElectronNativeNode = (node, context) => {
     if (t.isImportDeclaration(node))
@@ -20,12 +20,12 @@ export const inspectElectronNativeNode = (node, context) => {
 const inspectImport = (node, context) => {
     if (!isNativeSpecifier(node.source.value, "import"))
         return;
-    const members = node.specifiers.map((specifier) => {
+    const members = node.specifiers.flatMap((specifier) => {
         if (t.isImportDefaultSpecifier(specifier))
-            return "default";
+            return ["default"];
         if (t.isImportNamespaceSpecifier(specifier))
-            return "*";
-        return propertyName(specifier.imported) || "[dynamic-import]";
+            return [];
+        return [propertyName(specifier.imported)];
     });
     addBinding({
         context,
@@ -34,6 +34,8 @@ const inspectImport = (node, context) => {
         kind: "import",
         moduleKind: "import",
         members,
+        namespaceAccess: node.specifiers.some((value) => t.isImportNamespaceSpecifier(value)),
+        dynamicMemberAccess: false,
     });
 };
 const inspectNamedExport = (node, context) => {
@@ -41,10 +43,12 @@ const inspectNamedExport = (node, context) => {
         node.source === undefined ||
         !isNativeSpecifier(node.source.value, "import"))
         return;
-    const members = node.specifiers.map((specifier) => {
+    const members = node.specifiers.flatMap((specifier) => {
         if (t.isExportSpecifier(specifier))
-            return propertyName(specifier.local);
-        return "*";
+            return [propertyName(specifier.local)];
+        if (t.isExportDefaultSpecifier(specifier))
+            return ["default"];
+        return [];
     });
     addBinding({
         context,
@@ -53,6 +57,8 @@ const inspectNamedExport = (node, context) => {
         kind: "re-export",
         moduleKind: "import",
         members,
+        namespaceAccess: node.specifiers.some((value) => t.isExportNamespaceSpecifier(value)),
+        dynamicMemberAccess: false,
     });
 };
 const inspectExportAll = (node, context) => {
@@ -65,7 +71,9 @@ const inspectExportAll = (node, context) => {
         specifier: node.source.value,
         kind: "re-export",
         moduleKind: "import",
-        members: ["*"],
+        members: [],
+        namespaceAccess: true,
+        dynamicMemberAccess: false,
     });
 };
 const inspectRequireBinding = (node, context) => {
@@ -78,7 +86,7 @@ const inspectRequireBinding = (node, context) => {
         specifier: required.specifier,
         kind: "require",
         moduleKind: "require",
-        members: required.member === null ? bindingMembers(node.id) : [required.member],
+        ...(required.hasMemberAccess ? required.access : bindingMembers(node.id)),
     });
 };
 const inspectReExport = (node, context) => {
@@ -91,24 +99,32 @@ const inspectReExport = (node, context) => {
         specifier: required.specifier,
         kind: "re-export",
         moduleKind: "require",
-        members: [required.member ?? exportedMember(node.left) ?? "*"],
+        ...required.access,
     });
 };
 const addBinding = (input) => {
     const { context, node, specifier, kind } = input;
-    const unique = [
-        ...new Set(input.members.filter((member) => member !== "")),
-    ].sort(compareCodePoints);
-    const members = unique.length === 0 ? ["*"] : unique;
+    const members = [...new Set(input.members)].sort(compareUnicodeCodePoints);
     addLocatedFinding(context, {
         collection: context.accumulator.nativeAddonBindings,
-        key: `native-addon-binding\0${kind}\0${specifier}\0${members.join("\0")}`,
+        // Members are a variable-length source-derived list: compositeKey keeps
+        // ["a\0b"] distinct from ["a", "b"] instead of collapsing one binding.
+        key: compositeKey([
+            "native-addon-binding",
+            kind,
+            specifier,
+            members,
+            input.namespaceAccess,
+            input.dynamicMemberAccess,
+        ]),
         node,
         value: {
             specifier,
             binding_kind: kind,
             module_kind: input.moduleKind,
             members,
+            namespace_access: input.namespaceAccess,
+            dynamic_member_access: input.dynamicMemberAccess,
             module_key: null,
             location: range(node),
         },
@@ -116,12 +132,14 @@ const addBinding = (input) => {
 };
 const nativeRequire = (node) => {
     let member = null;
+    let hasMemberAccess = false;
     while (t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) {
         if (!t.isNode(node.object))
             return undefined;
-        const property = semanticStaticPropertyName(node.property, node.computed);
-        if (member === null && property !== "")
-            member = property;
+        const property = semanticStaticPropertyKey(node.property, node.computed);
+        // Walking inward leaves the first member consumed from the addon itself.
+        member = property;
+        hasMemberAccess = true;
         node = node.object;
     }
     if (!t.isCallExpression(node))
@@ -133,33 +151,47 @@ const nativeRequire = (node) => {
         return undefined;
     const specifier = stringValue(argumentNode(node.arguments[0]));
     return specifier !== undefined && isNativeSpecifier(specifier, "require")
-        ? { specifier, member }
+        ? {
+            specifier,
+            hasMemberAccess,
+            access: {
+                members: member === null ? [] : [member],
+                namespaceAccess: !hasMemberAccess,
+                dynamicMemberAccess: hasMemberAccess && member === null,
+            },
+        }
         : undefined;
 };
 const bindingMembers = (pattern) => {
-    if (t.isIdentifier(pattern))
-        return ["*"];
     if (!t.isObjectPattern(pattern))
-        return ["*"];
-    return pattern.properties.map((property) => {
-        if (t.isRestElement(property))
-            return "*";
-        return propertyName(property.key) || "[dynamic-import]";
-    });
+        return { members: [], namespaceAccess: true, dynamicMemberAccess: false };
+    const members = [];
+    let namespaceAccess = false;
+    let dynamicMemberAccess = false;
+    for (const property of pattern.properties) {
+        if (t.isRestElement(property)) {
+            namespaceAccess = true;
+            continue;
+        }
+        const key = semanticStaticPropertyKey(property.key, property.computed);
+        if (key === null)
+            dynamicMemberAccess = true;
+        else
+            members.push(key);
+    }
+    return { members, namespaceAccess, dynamicMemberAccess };
 };
 const isModuleExport = (node) => {
-    const name = calleeName(node);
-    return (name === "module.exports" ||
-        name.startsWith("module.exports.") ||
-        name.startsWith("exports."));
-};
-const exportedMember = (node) => {
-    const name = calleeName(node);
-    if (name.startsWith("module.exports."))
-        return name.slice("module.exports.".length);
-    if (name.startsWith("exports."))
-        return name.slice("exports.".length);
-    return undefined;
+    const keys = [];
+    while (t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) {
+        keys.unshift(semanticStaticPropertyKey(node.property, node.computed));
+        node = node.object;
+    }
+    if (!t.isIdentifier(node))
+        return false;
+    return node.name === "exports"
+        ? keys.length > 0
+        : node.name === "module" && keys[0] === "exports";
 };
 const isNativeSpecifier = (specifier, moduleKind) => {
     const path = moduleKind === "require" ? specifier : stripQueryAndFragment(specifier);

package/dist/domain/javascript/electronStaticAnalysisValues.js

@@ -1,7 +1,23 @@
 import * as t from "@babel/types";
-import { compareCodePoints } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 import { readExactJavaScriptLiteral, semanticStaticPropertyName, } from "./javascriptAstValues.js";
 import { sourceSlice } from "./javascriptStaticAnalysisHelpers.js";
+/** Resolve a callee only when its root has a proven Electron module identity. */
+export const electronCalleePath = (callee, context) => {
+    const members = [];
+    let root = callee;
+    while (t.isMemberExpression(root) || t.isOptionalMemberExpression(root)) {
+        const member = semanticStaticPropertyName(root.property, root.computed);
+        if (member === "" || !t.isNode(root.object))
+            return undefined;
+        members.push(member);
+        root = root.object;
+    }
+    const exported = context.electronBindings?.get(root.start ?? -1);
+    return exported === undefined
+        ? undefined
+        : [...exported, ...members.toReversed()];
+};
 /** Preserve one literal value or the exact inert expression. */
 export const electronStaticValue = (source, node) => {
     const literal = literalValue(node);
@@ -72,7 +88,7 @@ export const collectContextBridgeMembers = (node) => {
         unknown: 0,
     };
     collectMembersAt(node, "", 0, state);
-    const members = [...new Set(state.members)].sort(compareCodePoints);
+    const members = [...new Set(state.members)].sort(compareUnicodeCodePoints);
     return {
         status: "object-literal",
         members,
@@ -107,7 +123,11 @@ const literalValue = (node) => {
     if (literal.found)
         return literal;
     if (t.isUnaryExpression(node, { operator: "-" }) &&
-        t.isNumericLiteral(node.argument))
-        return { found: true, value: -node.argument.value };
+        t.isNumericLiteral(node.argument)) {
+        const value = -node.argument.value;
+        return Number.isFinite(value) && !Object.is(value, -0)
+            ? { found: true, value }
+            : { found: false };
+    }
     return { found: false };
 };

package/dist/domain/javascript/javascriptAnalysisResourceControls.js

@@ -0,0 +1,45 @@
+import { z } from "zod";
+/** Shared operational defaults for the isolated source-analysis boundary. */
+export const JAVASCRIPT_ANALYSIS_RESOURCE_DEFAULTS = {
+    heapMb: 1024,
+    timeoutMs: 300_000,
+};
+/** Project observed execution limits without inventing unmeasured values. */
+export const javaScriptAnalysisCoverageLimits = (limits) => {
+    const result = [];
+    for (const key of [
+        "worker_heap_limit_bytes",
+        "worker_timeout_ms",
+        "parent_result_budget_bytes",
+        "semantic_result_budget_bytes",
+        "transfer_record_bytes",
+        "transfer_file_bytes",
+    ]) {
+        const value = limits?.[key];
+        if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0)
+            continue;
+        result.push({
+            name: `javascript_analysis_${key}`,
+            value,
+            unit: key.endsWith("_ms") ? "milliseconds" : "bytes",
+        });
+    }
+    return result;
+};
+/** Optional operational choices; omission keeps them out of Evidence parameters. */
+export const javaScriptAnalysisResourceControlsSchema = z.strictObject({
+    max_heap_mb: z
+        .number()
+        .int()
+        .min(128)
+        .max(16_384)
+        .optional()
+        .describe("Maximum V8 old-space heap in MiB for the isolated JavaScript source analyzer; defaults to 1024. This does not change the CLI/MCP process heap."),
+    analysis_timeout_ms: z
+        .number()
+        .int()
+        .min(1)
+        .max(2_147_483_647)
+        .optional()
+        .describe("Maximum startup, analysis and transfer time per JavaScript source, in milliseconds; defaults to 300000. On timeout, return collected partial Evidence and stop the analysis."),
+});

package/dist/domain/javascript/javascriptApplicationAnalysis.js

@@ -3,12 +3,17 @@ import { javascriptApplicationGraphSchema, isValidatedImmutableJavaScriptApplica
 import { javaScriptSemanticGraphSchema, isValidatedImmutableJavaScriptSemanticGraph, } from "./javascriptSemanticGraph.js";
 import { digestSchema } from "../digests.js";
 import { prefixedDigestSchema } from "../digests.js";
+import { integrityContradictionSchema } from "../artifactGraph.js";
+import { artifactIntegrityPolicySchema } from "../artifactIntegrityPolicy.js";
 import { localPathStringSchema } from "../localPath.js";
+import { javaScriptAnalysisResourceControlsSchema } from "./javascriptAnalysisResourceControls.js";
 const countSchema = z.number().int().min(0);
 /** Public target-free request for static JavaScript application analysis. */
 export const analyzeJavaScriptApplicationInputSchema = z.strictObject({
     input_path: localPathStringSchema,
     format: z.enum(["auto", "asar", "directory"]).default("auto"),
+    integrity_policy: artifactIntegrityPolicySchema,
+    ...javaScriptAnalysisResourceControlsSchema.shape,
 });
 /** Compact counts for the high-level Electron architecture/security surface. */
 const electronBoundarySummarySchema = z.strictObject({
@@ -44,7 +49,6 @@ const reconstructionStatisticsSchema = z.strictObject({
     findings: countSchema,
     modules: countSchema,
     parse_failures: countSchema,
-    truncated_scopes: countSchema,
 });
 const applicationAnalysisResultShape = z.strictObject({
     input_path: z.string().min(1),
@@ -52,6 +56,7 @@ const applicationAnalysisResultShape = z.strictObject({
     root_artifact_sha256: digestSchema,
     inventory_manifest_id: prefixedDigestSchema("agm"),
     inventory_graph_sha256: digestSchema,
+    integrity_contradictions: z.array(integrityContradictionSchema),
     graph: javascriptApplicationGraphSchema,
     summary: electronBoundarySummarySchema,
     statistics: reconstructionStatisticsSchema,

package/dist/domain/javascript/javascriptApplicationChangeGraph.js

@@ -1,5 +1,6 @@
-import { createJavaScriptApplicationEdge, createJavaScriptApplicationGraph, createJavaScriptApplicationNode, } from "./javascriptApplicationGraph.js";
-import { compareCodePoints, uniqueSorted } from "../canonicalOrdering.js";
+import { createJavaScriptApplicationEdge, createImmutableJavaScriptApplicationGraphSteps, createJavaScriptApplicationNode, } from "./javascriptApplicationGraph.js";
+import { uniqueSorted } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 /** Merge compared nodes and add inferred right-to-left changed_from edges. */
 export const buildJavaScriptApplicationChangeGraph = (input) => {
     const allNodes = nodeCandidates(input);
@@ -20,11 +21,13 @@ export const buildJavaScriptApplicationChangeGraph = (input) => {
         ...input.left.edges,
         ...input.right.edges,
     ]).filter(({ source_node_id: source, target_node_id: target }) => retained.has(source) && retained.has(target));
-    const comparisonEdges = input.items.flatMap((item) => changedFromEdge(item, input, retained));
+    const leftById = new Map(input.left.nodes.map((node) => [node.node_id, node]));
+    const rightById = new Map(input.right.nodes.map((node) => [node.node_id, node]));
+    const comparisonEdges = input.items.flatMap((item) => changedFromEdge(item, input, retained, leftById, rightById));
     const candidateEdges = uniqueEdges([...sourceEdges, ...comparisonEdges]);
     const rootNodeIds = preferredRoots.filter((nodeId) => retained.has(nodeId));
     const fallbackRoot = mergedNodes[0]?.node_id;
-    const graph = createJavaScriptApplicationGraph({
+    const steps = createImmutableJavaScriptApplicationGraphSteps({
         schema: "JavaScriptApplicationGraph",
         root_node_ids: rootNodeIds.length > 0
             ? rootNodeIds
@@ -41,7 +44,10 @@ export const buildJavaScriptApplicationChangeGraph = (input) => {
             "The change graph contains compared entities and their retained relationships; it is not an executable application.",
         ]),
     });
-    return { graph };
+    let next = steps.next();
+    while (!next.done)
+        next = steps.next();
+    return { graph: next.value };
 };
 const nodeCandidates = (input) => {
     const required = new Set([
@@ -58,7 +64,7 @@ const nodeCandidates = (input) => {
             output.set(node.node_id, [...(output.get(node.node_id) ?? []), node]);
     return output;
 };
-const changedFromEdge = (item, input, retained) => {
+const changedFromEdge = (item, input, retained, leftById, rightById) => {
     const left = item.left_node_id;
     const right = item.right_node_id;
     if (item.match.status !== "matched" ||
@@ -69,7 +75,7 @@ const changedFromEdge = (item, input, retained) => {
         !retained.has(left) ||
         !retained.has(right))
         return [];
-    const evidence = comparisonEvidence(item, input);
+    const evidence = comparisonEvidence(item, input, leftById.get(left), rightById.get(right));
     return [
         createJavaScriptApplicationEdge({
             source_node_id: right,
@@ -86,9 +92,7 @@ const changedFromEdge = (item, input, retained) => {
         }),
     ];
 };
-const comparisonEvidence = (item, input) => {
-    const right = input.right.nodes.find(({ node_id: id }) => id === item.right_node_id);
-    const left = input.left.nodes.find(({ node_id: id }) => id === item.left_node_id);
+const comparisonEvidence = (item, input, left, right) => {
     const source = right?.observations[0]?.evidence ?? left?.observations[0]?.evidence;
     const complete = input.left.coverage.status === "complete" &&
         input.right.coverage.status === "complete";
@@ -145,7 +149,7 @@ const changeGraphCoverage = (input) => {
 };
 const sourceCoverageLimits = (input) => [
     ...new Map([...input.left.coverage.limits, ...input.right.coverage.limits].map((limit) => [`${limit.name}\0${limit.value}\0${limit.unit}`, limit])).values(),
-].sort((left, right) => compareCodePoints(left.name, right.name));
+].sort((left, right) => compareUnicodeCodePoints(left.name, right.name));
 const combineOmittedCounts = (left, right) => left === null || right === null ? null : left + right;
 const mergeNodes = (nodes) => {
     const groups = new Map();
@@ -159,13 +163,13 @@ const mergeNodes = (nodes) => {
             ...new Map(group
                 .flatMap(({ observations: values }) => values)
                 .map((observation) => [observation.observation_id, observation])).values(),
-        ].sort((left, right) => compareCodePoints(left.observation_id, right.observation_id));
+        ].sort((left, right) => compareUnicodeCodePoints(left.observation_id, right.observation_id));
         return createJavaScriptApplicationNode({
             kind: first.kind,
             identity: first.identity,
             observations: observations.map(({ observation_id: _id, identifier_strategy: _strategy, ...value }) => value),
         });
     });
-    return merged.sort((left, right) => compareCodePoints(left.node_id, right.node_id));
+    return merged.sort((left, right) => compareUnicodeCodePoints(left.node_id, right.node_id));
 };
-const uniqueEdges = (edges) => [...new Map(edges.map((edge) => [edge.edge_id, edge])).values()].sort((left, right) => compareCodePoints(left.edge_id, right.edge_id));
+const uniqueEdges = (edges) => [...new Map(edges.map((edge) => [edge.edge_id, edge])).values()].sort((left, right) => compareUnicodeCodePoints(left.edge_id, right.edge_id));

package/dist/domain/javascript/javascriptApplicationEvidenceSchemas.js

@@ -232,6 +232,10 @@ const applicationGraphEvidenceBaseSchema = z.strictObject({
     limitations: z.array(boundedTextSchema),
     evidence_ids: z.array(prefixedDigestSchema("ev")),
 });
+/** Shared provenance fields apart from the fact-specific evidence location. */
+export const applicationGraphEvidenceContextSchema = applicationGraphEvidenceBaseSchema.omit({ location: true });
+/** Exact coordinates retained on each graph fact. */
+export const applicationGraphEvidenceLocationSchema = applicationLocationReferenceSchema;
 const checkAuthorityState = (evidence, context) => {
     if (evidence.authority === "static-relationship-inference" &&
         evidence.state !== "inferred")