rea-agents 6.2.0 → 6.4.0

package/dist/domain/javascript/javascriptRpcEndpoints.js

@@ -0,0 +1,253 @@
+import * as t from "@babel/types";
+import { unwrapJavaScriptExpression, semanticStaticPropertyKey, } from "./javascriptAstValues.js";
+import { calleeName } from "./javascriptStaticAnalysisHelpers.js";
+// tRPC proxies preserve router and procedure names as property names, so they
+// survive identifier minification. Method names follow @trpc/react-query and
+// @trpc/tanstack-react-query 11.19 documentation; cache-key helpers such as
+// queryKey are excluded because they never issue a request.
+const TRPC_HOOK_METHODS = new Set([
+    "useQuery",
+    "useSuspenseQuery",
+    "useInfiniteQuery",
+    "useSuspenseInfiniteQuery",
+    "usePrefetchQuery",
+    "usePrefetchInfiniteQuery",
+    "useMutation",
+    "useSubscription",
+    "queryOptions",
+    "infiniteQueryOptions",
+    "mutationOptions",
+    "subscriptionOptions",
+]);
+// @trpc/client 11.19 clientCallTypeMap methods; common outside tRPC (Apollo,
+// database pools, stores), so they need corroborating evidence.
+const TRPC_REQUEST_METHODS = new Set(["query", "mutate"]);
+// @trpc/client 11.19 TRPCSubscriptionObserver callbacks; RxJS observers use
+// next/error/complete instead.
+const TRPC_SUBSCRIPTION_CALLBACKS = new Set([
+    "onStarted",
+    "onData",
+    "onError",
+    "onStopped",
+    "onComplete",
+    "onConnectionStateChange",
+]);
+// @trpc/client 11.19 client factories (createTRPCProxyClient is the
+// deprecated alias of createTRPCClient).
+const TRPC_CLIENT_FACTORIES = new Set([
+    "createTRPCClient",
+    "createTRPCProxyClient",
+]);
+// Built-in HTTP links documented by tRPC 11.19 that carry a `url` option.
+const TRPC_URL_LINKS = new Set([
+    "httpLink",
+    "httpBatchLink",
+    "httpBatchStreamLink",
+    "httpSubscriptionLink",
+]);
+// Literals retained by @trpc/client 11.19 bundles (`this.name`, the default
+// accept header key) or by the conventional transport path.
+const TRPC_SOURCE_MARKERS = ["TRPCClientError", "trpc-accept", "/trpc"];
+// Browser-owned roots whose methods share tRPC names, such as
+// navigator.permissions.query.
+const BROWSER_GLOBAL_NAMES = new Set([
+    "window",
+    "self",
+    "globalThis",
+    "document",
+    "navigator",
+    "location",
+    "history",
+    "console",
+    "performance",
+    "screen",
+    "top",
+    "parent",
+    "frames",
+]);
+const PROCEDURE_SEGMENT = /^[A-Za-z_$][\w$]*$/u;
+/** Read a static member path and the expression it starts from. */
+const memberPath = (callee) => {
+    const reversed = [];
+    let current = callee;
+    while (t.isMemberExpression(current) ||
+        t.isOptionalMemberExpression(current)) {
+        const property = semanticStaticPropertyKey(current.property, current.computed);
+        if (property === null || !PROCEDURE_SEGMENT.test(property))
+            return undefined;
+        reversed.push(property);
+        current = current.object;
+    }
+    return { root: current, properties: reversed.reverse() };
+};
+const objectKeys = (node) => t.isObjectExpression(node)
+    ? node.properties.flatMap((property) => {
+        if (!t.isObjectProperty(property) && !t.isObjectMethod(property))
+            return [];
+        const key = semanticStaticPropertyKey(property.key, property.computed);
+        return key === null ? [] : [key];
+    })
+    : [];
+const objectStringProperty = (node, key) => {
+    for (const property of node.properties)
+        if (t.isObjectProperty(property) &&
+            semanticStaticPropertyKey(property.key, property.computed) === key &&
+            t.isStringLiteral(property.value))
+            return property.value.value;
+    return undefined;
+};
+const objectProperty = (node, key) => {
+    for (const property of node.properties)
+        if (t.isObjectProperty(property) &&
+            semanticStaticPropertyKey(property.key, property.computed) === key)
+            return property.value;
+    return undefined;
+};
+const GRAPHQL_OPERATION_TYPES = new Set([
+    "query",
+    "mutation",
+    "subscription",
+]);
+// A named GraphQL operation header (GraphQL October 2021, OperationDefinition):
+// type, name, then variable definitions starting with `$`, a directive, or a
+// selection set starting with a field name.
+const GRAPHQL_OPERATION_HEADER = /^(query|mutation|subscription)[\s,]+([_A-Za-z][_0-9A-Za-z]*)[\s,]*(?:\([\s,]*\$|@[_A-Za-z]|\{[\s,]*[_A-Za-z])/u;
+const isGraphqlIgnoredCharacter = (character) => character === "," || character === "" || /\s/u.test(character);
+/** Recover a named operation from GraphQL document text. */
+export const graphqlOperationFromText = (text) => {
+    // Skip GraphQL ignored tokens: whitespace, commas, BOM and # comments.
+    const limit = text.length;
+    let index = 0;
+    while (index < limit) {
+        const character = text.charAt(index);
+        if (isGraphqlIgnoredCharacter(character))
+            index += 1;
+        else if (character === "#") {
+            while (index < limit && !/[\n\r]/u.test(text.charAt(index)))
+                index += 1;
+        }
+        else
+            break;
+    }
+    if (index >= limit)
+        return undefined;
+    const header = GRAPHQL_OPERATION_HEADER.exec(text.slice(index));
+    const type = header?.[1];
+    const name = header?.[2];
+    return type === undefined || name === undefined
+        ? undefined
+        : { value: name, mechanism: `graphql:${type}` };
+};
+/** Recover a named operation from a precompiled GraphQL document object. */
+export const graphqlOperationFromDocumentNode = (node) => {
+    if (objectStringProperty(node, "kind") !== "OperationDefinition")
+        return undefined;
+    const type = objectStringProperty(node, "operation");
+    if (type === undefined || !GRAPHQL_OPERATION_TYPES.has(type))
+        return undefined;
+    const name = objectProperty(node, "name");
+    if (!t.isObjectExpression(name) ||
+        objectStringProperty(name, "kind") !== "Name")
+        return undefined;
+    const value = objectStringProperty(name, "value");
+    return value === undefined
+        ? undefined
+        : { value, mechanism: `graphql:${type}` };
+};
+/** Bundlers use `(0, imported.factory)` to call an import without a receiver. */
+const rpcFactoryName = (callee) => {
+    let current = unwrapJavaScriptExpression(callee).node;
+    while (t.isSequenceExpression(current)) {
+        const last = current.expressions.at(-1);
+        if (last === undefined)
+            return "";
+        current = unwrapJavaScriptExpression(last).node;
+    }
+    return calleeName(current);
+};
+/** Whether an initializer has the syntax of a documented tRPC client factory. */
+export const isJavaScriptRpcClientFactory = (node) => {
+    const call = unwrapJavaScriptExpression(node).node;
+    return ((t.isCallExpression(call) || t.isOptionalCallExpression(call)) &&
+        TRPC_CLIENT_FACTORIES.has(rpcFactoryName(call.callee).split(".").pop() ?? ""));
+};
+/** Recover the literal `url` option passed to a documented tRPC HTTP link. */
+const trpcLinkUrl = (node) => {
+    const name = rpcFactoryName(node.callee);
+    const factory = name.slice(name.lastIndexOf(".") + 1);
+    if (!TRPC_URL_LINKS.has(factory))
+        return undefined;
+    const options = node.arguments[0];
+    if (!t.isObjectExpression(options))
+        return undefined;
+    const url = objectStringProperty(options, "url");
+    return url === undefined
+        ? undefined
+        : { value: url, mechanism: `trpc:link:${factory}` };
+};
+/**
+ * Create the per-source scan. Hook and option-factory methods are distinctive.
+ * `query`/`mutate` need a root bound to a tRPC client factory, or a tRPC source
+ * marker with a router path of at least two segments; `subscribe` needs the
+ * marker and a tRPC observer argument. `this` roots, browser globals and RTK
+ * Query `endpoints` chains are never procedures.
+ */
+export const createJavaScriptRpcScan = (source, clientRoots) => {
+    let marker;
+    const hasMarker = () => (marker ??= TRPC_SOURCE_MARKERS.some((value) => source.includes(value)));
+    // graphql-tag documents retain their source text in loc.source.body; that
+    // text repeats the OperationDefinition already recovered from the object.
+    const documentSourceBodies = new WeakSet();
+    const procedure = (node) => {
+        const path = memberPath(node.callee);
+        if (path === undefined || t.isThisExpression(path.root))
+            return undefined;
+        if (t.isIdentifier(path.root) && BROWSER_GLOBAL_NAMES.has(path.root.name))
+            return undefined;
+        const method = path.properties[path.properties.length - 1];
+        const segments = path.properties.slice(0, -1);
+        const first = segments[0];
+        if (method === undefined || first === undefined)
+            return undefined;
+        if (BROWSER_GLOBAL_NAMES.has(first) || segments.includes("endpoints"))
+            return undefined;
+        const bound = clientRoots.has(path.root);
+        const recognized = TRPC_HOOK_METHODS.has(method)
+            ? true
+            : TRPC_REQUEST_METHODS.has(method)
+                ? bound || (segments.length >= 2 && hasMarker())
+                : method === "subscribe" &&
+                    (bound || hasMarker()) &&
+                    objectKeys(node.arguments[1]).some((key) => TRPC_SUBSCRIPTION_CALLBACKS.has(key));
+        return recognized
+            ? { value: segments.join("."), mechanism: `trpc:procedure:${method}` }
+            : undefined;
+    };
+    return {
+        inspect: (node) => {
+            if (t.isCallExpression(node) || t.isOptionalCallExpression(node))
+                return trpcLinkUrl(node) ?? procedure(node);
+            if (t.isObjectExpression(node)) {
+                const body = objectProperty(node, "body");
+                if (t.isStringLiteral(body) &&
+                    objectProperty(node, "locationOffset") !== undefined) {
+                    documentSourceBodies.add(body);
+                    return undefined;
+                }
+                return graphqlOperationFromDocumentNode(node);
+            }
+            if (t.isStringLiteral(node))
+                return documentSourceBodies.has(node)
+                    ? undefined
+                    : graphqlOperationFromText(node.value);
+            if (t.isTemplateLiteral(node)) {
+                // A template recovered without a cooked value stays dynamic.
+                const cooked = node.quasis[0]?.value.cooked;
+                return cooked === undefined || cooked === null
+                    ? undefined
+                    : graphqlOperationFromText(cooked);
+            }
+            return undefined;
+        },
+    };
+};

package/dist/domain/javascript/javascriptRuntimeLoadState.js

@@ -25,7 +25,7 @@ const classifyLayer = (layer, runtimeEntities, matches, options) => {
     const layerComplete = options.reconciliationComplete &&
         layer.graph.coverage.status === "complete" &&
         scopedEntities.length > 0 &&
-        scopedEntities.every(({ capture }) => captureScriptsComplete(capture.evidence.evidence_id, runtimeEntities));
+        scopedEntities.every(({ capture }) => capture.scriptsCompleteWithinScope);
     const states = nodes.map((node) => {
         const runtimeNodeIds = uniqueSorted(direct.get(node.node_id) ?? []);
         if (runtimeNodeIds.length > 0)
@@ -85,8 +85,6 @@ const append = (values, key, value) => {
     else
         current.push(value);
 };
-const captureScriptsComplete = (evidenceId, entities) => entities.find(({ capture }) => capture.evidence.evidence_id === evidenceId)
-    ?.capture.scriptsCompleteWithinScope === true;
 const isLoadStateNode = (node) => node.kind === "javascript-asset" ||
     node.kind === "javascript-chunk" ||
     node.kind === "javascript-module";

package/dist/domain/javascript/javascriptRuntimeObservation.js

@@ -16,7 +16,6 @@ export const javascriptRuntimeKindSchema = z.enum([
     "electron-renderer",
 ]);
 const observedJavaScriptRuntimeKindSchema = javascriptRuntimeKindSchema.or(z.literal("unknown"));
-/** Input for one bounded, attach-only V8 Inspector observation. */
 /** Input for one passive attach-only V8 Inspector observation. */
 export const observeJavaScriptRuntimeInputSchema = z.strictObject({
     ...runtimeEndpoint,
@@ -33,7 +32,6 @@ export const javascriptRuntimeLocationSchema = z.discriminatedUnion("kind", [
     z.strictObject({
         kind: z.literal("file"),
         file_path: z.string().min(1),
-        authority: z.literal("scope-fallback").optional(),
     }),
     z.strictObject({
         kind: z.literal("url"),
@@ -48,8 +46,13 @@ export const javascriptRuntimeLocationSchema = z.discriminatedUnion("kind", [
 /** Discovery metadata can identify an endpoint target without verifying its file location. */
 export const javascriptRuntimeUnresolvedLocationSchema = z.strictObject({
     kind: z.literal("unresolved"),
-    reported_url: z.string().min(1),
-    reason: z.literal("unverifiable-file-location"),
+    reported_url: z
+        .string()
+        .describe("Raw Inspector URL, which may be empty for anonymous or evaluated code."),
+    reason: z.enum([
+        "unverifiable-file-location",
+        "location-authorization-not-attempted",
+    ]),
 });
 /** Verified locations and explicitly unresolved discovery metadata. */
 export const javascriptRuntimeTargetLocationSchema = z.union([
@@ -74,7 +77,7 @@ export const javascriptRuntimeTargetListSchema = z.strictObject({
 });
 const javascriptRuntimeScriptSchema = z.strictObject({
     script_key: prefixedDigestSchema("v8_script"),
-    location: javascriptRuntimeLocationSchema,
+    location: javascriptRuntimeTargetLocationSchema,
     execution_context_key: z.string().nullable(),
     cdp_hash: z.string().nullable(),
     length: z

package/dist/domain/javascript/javascriptRuntimeReconciliation.js

@@ -1,16 +1,22 @@
 import { classifyStaticLoadStates } from "./javascriptRuntimeLoadState.js";
 import { buildReconciledApplicationGraph } from "./javascriptRuntimeReconciliationGraph.js";
 import { reconcileRuntimeEntities } from "./javascriptRuntimeReconciliationMatching.js";
-import { parseRuntimeCaptures, parseStaticLayers, } from "./javascriptRuntimeReconciliationParsing.js";
+import { parseStaticLayers, } from "./javascriptRuntimeReconciliationParsing.js";
+import { parseRuntimeCaptures, } from "./javascriptRuntimeReconciliationCaptureParsing.js";
 import { createJavaScriptRuntimeReconciliationResult } from "./javascriptRuntimeReconciliationResult.js";
-import { reconcileJavaScriptRuntimeInputSchema } from "./javascriptRuntimeReconciliationSchemas.js";
 import { projectRuntimeCaptures } from "./javascriptRuntimeReconciliationRuntime.js";
 import { collectStaticRuntimeCandidates } from "./javascriptRuntimeStaticCandidates.js";
+/** Parse caller Evidence once into the owner consumed by reconciliation. */
+export const parseRuntimeReconciliationInput = (input) => ({
+    input,
+    layers: parseStaticLayers(input.static_layers, ["static_layers"]),
+    captures: parseRuntimeCaptures(input.runtime_observations, [
+        "runtime_observations",
+    ]),
+});
 /** Reconcile static JAG layers with authorized passive CDP Evidence. */
-export const reconcileJavaScriptRuntime = (input) => {
-    const parsed = reconcileJavaScriptRuntimeInputSchema.parse(input);
-    const layers = parseStaticLayers(parsed.static_layers);
-    const captures = parseRuntimeCaptures(parsed.runtime_observations);
+export const reconcileJavaScriptRuntime = (parsed) => {
+    const { layers, captures } = parsed;
     const runtime = projectRuntimeCaptures(captures);
     const candidates = collectStaticRuntimeCandidates(layers);
     const matching = reconcileRuntimeEntities({

package/dist/domain/javascript/javascriptRuntimeReconciliationActive.js

@@ -1,28 +1,29 @@
 import { isAbsolute } from "node:path";
-import { canonicalDigest } from "../comparisonSemantics.js";
+import { digestCanonicalValue } from "../canonicalDigest.js";
 import { isPathWithinRoot } from "../localPath.js";
 import { z } from "zod";
+import { invalidInput, parseAtPath, } from "./javascriptRuntimeReconciliationInputValidation.js";
 import { classifyBrowserCompleteness, } from "../browserCompleteness.js";
 import { electronActiveObservationResultSchema, } from "./electronActiveObservation.js";
 /** Parse active Electron Evidence as a bounded, target-only runtime capture. */
 export const parseActiveElectronCapture = (evidence) => {
     assertIdentity(evidence);
-    const result = electronActiveObservationResultSchema.parse(evidence.normalized_result);
-    const parameters = z
+    const result = parseAtPath((value) => electronActiveObservationResultSchema.parse(value), evidence.normalized_result, ["normalized_result"]);
+    const parameters = parseAtPath((value) => z
         .object({
         application_path: absolutePathSchema,
         application_root: absolutePathSchema,
     })
         .passthrough()
-        .parse(evidence.parameters);
+        .parse(value), evidence.parameters, ["parameters"]);
     if (result.application.application_path !== parameters.application_path ||
         !isPathWithinRoot(parameters.application_root, result.application.application_path))
-        throw new TypeError("Active Electron Evidence application path disagrees with its configured root");
+        throw invalidInput(["normalized_result", "application", "application_path"], "Active Electron Evidence application path disagrees with its configured root");
     return {
         kind: "electron-active",
         evidence,
         inspection: normalizeInspection(result),
-        captureSha256: canonicalDigest(result, "Runtime reconciliation"),
+        captureSha256: digestCanonicalValue(result, "Runtime reconciliation"),
         scriptsCompleteWithinScope: false,
     };
 };
@@ -36,11 +37,11 @@ const assertIdentity = (evidence) => {
         evidence.provider.version !== "1" ||
         evidence.authority !== "controlled-replay" ||
         evidence.confidence !== "observed")
-        throw new TypeError("Evidence does not match the supported capture_electron_scenario contract");
+        throw invalidInput([], "Evidence does not match the supported capture_electron_scenario contract");
 };
 const normalizeInspection = (result) => ({
     target: {
-        target_id: `electron-active:${canonicalDigest(result.application.application_path, "Runtime reconciliation").slice(0, 32)}`,
+        target_id: `electron-active:${digestCanonicalValue(result.application.application_path, "Runtime reconciliation").slice(0, 32)}`,
         type: "electron-application",
         title: result.application.application_path,
         attached: true,

package/dist/domain/javascript/javascriptRuntimeReconciliationCaptureParsing.js

@@ -0,0 +1,212 @@
+import { z } from "zod";
+import { browserAllowedOriginsSchema, browserEndpointSchema, } from "../browserObservation.js";
+import { webPageInspectionSchema, } from "../browserObservationSchemas.js";
+import { classifyBrowserCompleteness, } from "../browserCompleteness.js";
+import { electronPageInspectionSchema, } from "./electronObservation.js";
+import { javascriptRuntimeObservationSchema, javascriptRuntimeKindSchema, } from "./javascriptRuntimeObservation.js";
+import { digestCanonicalValue } from "../canonicalDigest.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
+import { parseEvidence } from "../evidence.js";
+import { parseActiveElectronCapture } from "./javascriptRuntimeReconciliationActive.js";
+import { assertEvidenceIdentity, invalidInput, parseAtPath, } from "./javascriptRuntimeReconciliationInputValidation.js";
+/** Parse only supported passive web/Electron inspection Evidence. */
+export const parseRuntimeCaptures = (observations, path = ["runtime_observations"]) => observations
+    .map((observation, index) => parseRuntimeCapture(observation, [...path, index]))
+    .sort((left, right) => compareUnicodeCodePoints(left.evidence.evidence_id, right.evidence.evidence_id));
+const parseRuntimeCapture = (input, evidencePath) => {
+    const evidence = parseAtPath(parseEvidence, input, evidencePath);
+    if (evidence.operation === "inspect_web_page")
+        return parseBrowserCapture(evidence, evidencePath);
+    if (evidence.operation === "inspect_electron_page")
+        return parseElectronCapture(evidence, evidencePath);
+    if (evidence.operation === "observe_javascript_runtime")
+        return parseV8Capture(evidence, evidencePath);
+    if (evidence.operation === "capture_electron_scenario") {
+        return parseAtPath(() => parseActiveElectronCapture(evidence), evidence, evidencePath);
+    }
+    throw invalidInput(evidencePath, "Runtime reconciliation requires inspect_web_page, inspect_electron_page, observe_javascript_runtime, or capture_electron_scenario Evidence");
+};
+const parseBrowserCapture = (evidence, path) => {
+    assertEvidenceIdentity(evidence, {
+        operation: "inspect_web_page",
+        predicate: "rea.web-page-inspection",
+        providerId: "rea-cdp-browser",
+        providerName: "REA Chrome DevTools Protocol observation provider",
+        providerVersion: "2",
+        authority: "external-service",
+        confidence: "observed",
+    }, path);
+    const inspection = parseAtPath((value) => webPageInspectionSchema.parse(value), evidence.normalized_result, [...path, "normalized_result"]);
+    assertRuntimeParameters(evidence, {
+        kind: "browser",
+        targetId: inspection.target.target_id,
+        targetOrigin: inspection.target.origin,
+        sourceIncluded: inspection.scripts.items.some(({ source }) => source.included),
+    }, path);
+    return {
+        kind: "browser",
+        evidence,
+        inspection,
+        captureSha256: digestCanonicalValue(inspection, "Runtime reconciliation"),
+        scriptsCompleteWithinScope: scriptsComplete(inspection.completeness),
+    };
+};
+const parseElectronCapture = (evidence, path) => {
+    assertEvidenceIdentity(evidence, {
+        operation: "inspect_electron_page",
+        predicate: "rea.electron-page-inspection",
+        providerId: "rea-cdp-electron",
+        providerName: "REA Electron file-page CDP observation provider",
+        providerVersion: "1",
+        authority: "external-service",
+        confidence: "observed",
+    }, path);
+    const inspection = parseAtPath((value) => electronPageInspectionSchema.parse(value), evidence.normalized_result, [...path, "normalized_result"]);
+    assertRuntimeParameters(evidence, {
+        kind: "electron",
+        targetId: inspection.target.target_id,
+        sourceIncluded: inspection.scripts.items.some(({ source }) => source.included),
+    }, path);
+    return {
+        kind: "electron",
+        evidence,
+        inspection,
+        captureSha256: digestCanonicalValue(inspection, "Runtime reconciliation"),
+        scriptsCompleteWithinScope: scriptsComplete(inspection.completeness),
+    };
+};
+const parseV8Capture = (evidence, path) => {
+    assertEvidenceIdentity(evidence, {
+        operation: "observe_javascript_runtime",
+        predicate: "rea.javascript-runtime-observation",
+        providerId: "rea-v8-inspector",
+        providerName: "REA passive Node/Electron V8 Inspector provider",
+        providerVersion: "1",
+        authority: "external-service",
+        confidence: "observed",
+    }, path);
+    const result = parseAtPath((value) => javascriptRuntimeObservationSchema.parse(value), evidence.normalized_result, [...path, "normalized_result"]);
+    assertV8RuntimeParameters(evidence, result, path);
+    return {
+        kind: "v8-inspector",
+        evidence,
+        inspection: normalizeV8Inspection(result),
+        captureSha256: digestCanonicalValue(result, "Runtime reconciliation"),
+        scriptsCompleteWithinScope: false,
+    };
+};
+const assertV8RuntimeParameters = (evidence, result, path) => {
+    const parameters = parseAtPath((value) => z
+        .object({
+        inspector_endpoint: browserEndpointSchema,
+        target_id: z.string().trim().min(1),
+        runtime_kind: javascriptRuntimeKindSchema.optional(),
+    })
+        .passthrough()
+        .parse(value), evidence.parameters, [...path, "parameters"]);
+    if (parameters.target_id !== result.target.target_id ||
+        (parameters.runtime_kind !== undefined &&
+            parameters.runtime_kind !== result.target.runtime_kind))
+        throw invalidInput([...path, "parameters", "target_id"], "Runtime Evidence target or declared role disagrees with its result");
+    if (result.target.location.kind === "builtin" &&
+        !result.target.location.specifier.startsWith("node:"))
+        throw invalidInput([...path, "normalized_result", "target", "location"], "Runtime Evidence contains an invalid builtin location");
+    for (const [index, { location }] of result.scripts.items.entries())
+        if (location.kind === "builtin" && !location.specifier.startsWith("node:"))
+            throw invalidInput([...path, "normalized_result", "scripts", "items", index, "location"], "Runtime Evidence contains an invalid builtin location");
+};
+const normalizeV8Inspection = (result) => ({
+    target: {
+        target_id: result.target.target_id,
+        type: result.target.protocol_type,
+        title: result.target.runtime_kind,
+        attached: result.target.attached,
+        ...(result.target.location.kind === "unresolved"
+            ? { unresolved_location: result.target.location }
+            : runtimeLocation(result.target.location)),
+    },
+    frames: [],
+    scripts: {
+        items: result.scripts.items.map((script) => ({
+            script_key: script.script_key,
+            frame_id: script.execution_context_key,
+            ...runtimeLocation(script.location),
+            cdp_hash: script.cdp_hash,
+            length: script.length,
+            is_module: script.is_module,
+            language: null,
+            source: {
+                included: false,
+                reason: "V8 Inspector source capture is outside passive authority.",
+            },
+        })),
+    },
+    workers: [],
+    completeness: classifyBrowserCompleteness({
+        policyFilteredSections: new Set(excludedV8Scripts(result) > 0 ? ["scripts"] : []),
+        attachLimitedSections: new Set([
+            "frames",
+            "scripts",
+            "script_sources",
+            "workers",
+        ]),
+        truncatedSections: new Set(result.capture.truncated ? ["scripts"] : []),
+        unavailableSections: new Set(["frames", "script_sources", "workers"]),
+        excluded: excludedV8Scripts(result) === 0
+            ? []
+            : [
+                {
+                    section: "scripts",
+                    reason: "out_of_target_scope",
+                    count: excludedV8Scripts(result),
+                },
+            ],
+        droppedEvents: {
+            scripts: result.capture.events_dropped,
+            network_requests: 0,
+            console_events: 0,
+            websocket_connections: 0,
+            websocket_frames: 0,
+            webmcp_tools: 0,
+            timeline_events: 0,
+        },
+    }),
+});
+const runtimeLocation = (location) => {
+    if (location.kind === "unresolved")
+        return { unresolved_location: location };
+    if (location.kind === "file")
+        return { file_path: location.file_path };
+    if (location.kind === "url")
+        return { url: location.sanitized_url };
+    return { url: location.specifier };
+};
+const excludedV8Scripts = (result) => Object.values(result.scripts.excluded).reduce((total, count) => total + count, 0);
+const assertRuntimeParameters = (evidence, expected, path) => {
+    const common = {
+        target_id: z.string().trim().min(1),
+        cdp_endpoint: browserEndpointSchema,
+        include_script_sources: z.boolean(),
+    };
+    if (expected.kind === "browser") {
+        const parameters = parseAtPath((value) => z
+            .object({ ...common, allowed_origins: browserAllowedOriginsSchema })
+            .passthrough()
+            .parse(value), evidence.parameters, [...path, "parameters"]);
+        if (parameters.target_id !== expected.targetId)
+            throw invalidInput([...path, "parameters", "target_id"], "Runtime Evidence target disagrees with its captured result");
+        if (!parameters.allowed_origins.includes(expected.targetOrigin))
+            throw invalidInput([...path, "parameters", "allowed_origins"], "Browser Evidence target is outside its recorded origin scope");
+        if (expected.sourceIncluded && !parameters.include_script_sources)
+            throw invalidInput([...path, "parameters", "include_script_sources"], "Runtime Evidence contains source without source-capture selection");
+        return;
+    }
+    const parameters = parseAtPath((value) => z.object(common).passthrough().parse(value), evidence.parameters, [...path, "parameters"]);
+    if (parameters.target_id !== expected.targetId)
+        throw invalidInput([...path, "parameters", "target_id"], "Runtime Evidence target disagrees with its captured result");
+    if (expected.sourceIncluded && !parameters.include_script_sources)
+        throw invalidInput([...path, "parameters", "include_script_sources"], "Runtime Evidence contains source without source-capture selection");
+};
+const scriptsComplete = (completeness) => !completeness.truncated_sections.includes("scripts") &&
+    !completeness.unavailable_sections.includes("scripts") &&
+    completeness.dropped_events.scripts === 0;

package/dist/domain/javascript/javascriptRuntimeReconciliationGraph.js

@@ -1,5 +1,6 @@
 import { createJavaScriptApplicationGraph, createJavaScriptApplicationNode, } from "./javascriptApplicationGraph.js";
-import { compareCodePoints, uniqueSorted } from "../canonicalOrdering.js";
+import { uniqueSorted } from "../canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 /** Merge source graphs, runtime nodes, and inferred mappings into one valid JAG. */
 export const buildReconciledApplicationGraph = (input) => {
     const merged = mergeNodes([
@@ -44,11 +45,11 @@ export const buildReconciledApplicationGraph = (input) => {
 const boundGraphContent = (input, nodes, edges) => {
     const allRoots = preferredRootIds(input);
     const rootNodeIds = allRoots;
-    const sortedNodes = [...nodes].sort((left, right) => compareCodePoints(left.node_id, right.node_id));
+    const sortedNodes = [...nodes].sort((left, right) => compareUnicodeCodePoints(left.node_id, right.node_id));
     const retainedNodes = sortedNodes;
     const retainedIds = new Set(retainedNodes.map(({ node_id: id }) => id));
     const retainedEdges = [...edges]
-        .sort((left, right) => compareCodePoints(left.edge_id, right.edge_id))
+        .sort((left, right) => compareUnicodeCodePoints(left.edge_id, right.edge_id))
         .filter(({ source_node_id: source, target_node_id: target }) => retainedIds.has(source) && retainedIds.has(target));
     return {
         rootNodeIds,
@@ -130,8 +131,13 @@ const graphCoverage = (input, facts, nodeCount) => facts.inputStatus === "comple
         };
 const mergeNodes = (nodes) => {
     const grouped = new Map();
-    for (const node of nodes)
-        grouped.set(node.node_id, [...(grouped.get(node.node_id) ?? []), node]);
+    for (const node of nodes) {
+        const group = grouped.get(node.node_id);
+        if (group === undefined)
+            grouped.set(node.node_id, [node]);
+        else
+            group.push(node);
+    }
     const merged = [...grouped.values()].map((group) => {
         const first = group[0];
         if (first === undefined)
@@ -143,7 +149,7 @@ const mergeNodes = (nodes) => {
             ...new Map(group
                 .flatMap(({ observations: values }) => values)
                 .map((observation) => [observation.observation_id, observation])).values(),
-        ].sort((left, right) => compareCodePoints(left.observation_id, right.observation_id));
+        ].sort((left, right) => compareUnicodeCodePoints(left.observation_id, right.observation_id));
         return createJavaScriptApplicationNode({
             kind: first.kind,
             identity: first.identity,