rea-agents 6.3.0 → 6.5.0

package/dist/application/investigation/EvidenceLedger.js

@@ -1,10 +1,12 @@
 import canonicalize from "canonicalize";
 import { createEvidenceBundle, createImmutableEvidenceBundle, describeEvidenceBundleFailure, parseEvidenceBundle, validateResidualUnknownAddition, } from "../../domain/evidenceBundle.js";
+import { AnalysisInputError } from "../../domain/analysisErrorCore.js";
 import { EvidenceIntegrityError } from "../../domain/evidenceErrors.js";
 import { UnknownRegistryError } from "../../domain/unknownRegistryError.js";
-import { immutableEvidence, parseEvidence, } from "../../domain/evidence.js";
+import { immutableEvidence } from "../../domain/evidence.js";
 import { createResidualUnknown, updateResidualUnknown, } from "../../domain/residualUnknown.js";
 import { err, ok } from "../../domain/result.js";
+import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";
 /** Session-owned set of immutable evidence records. */
 export class EvidenceLedger {
     #records = new Map();
@@ -42,9 +44,15 @@ export class EvidenceLedger {
             bundle = parseEvidenceBundle(input);
         }
         catch (cause) {
+            const failure = describeEvidenceBundleFailure(input, cause);
+            if (failure.kind === "single-record")
+                return err(new AnalysisInputError("import_evidence_bundle", {
+                    cause,
+                    userMessage: failure.message,
+                }));
             return err(new EvidenceIntegrityError("Evidence bundle validation failed", {
                 cause,
-                userMessage: describeEvidenceBundleFailure(input, cause),
+                userMessage: failure.message,
             }));
         }
         // A record-only bundle cannot change the already-valid unknown graph. The
@@ -144,7 +152,7 @@ export class EvidenceLedger {
     recordUnknown(input, mutationEvidence) {
         let parsedMutation;
         try {
-            parsedMutation = parseEvidence(mutationEvidence);
+            parsedMutation = immutableEvidence(mutationEvidence);
         }
         catch (cause) {
             return err(new EvidenceIntegrityError("Unknown mutation evidence is invalid", {
@@ -167,8 +175,8 @@ export class EvidenceLedger {
         let evidence;
         let mutation;
         try {
-            evidence = parseEvidence(evidenceInput);
-            mutation = parseEvidence(mutationInput);
+            evidence = immutableEvidence(evidenceInput);
+            mutation = immutableEvidence(mutationInput);
         }
         catch (cause) {
             return err(new EvidenceIntegrityError("Atomic Evidence validation failed", {
@@ -219,13 +227,31 @@ export class EvidenceLedger {
     }
     /** Query current heads in stable ID order. */
     listUnknowns(filters = {}) {
-        return [...this.#unknownHeads.values()]
-            .filter((unknown) => (filters.status === undefined || unknown.status === filters.status) &&
-            (filters.severity === undefined ||
-                unknown.severity === filters.severity) &&
-            (filters.domain === undefined || unknown.domain === filters.domain))
-            .sort((left, right) => left.unknown_id.localeCompare(right.unknown_id))
-            .map((unknown) => structuredClone(unknown));
+        return this.listUnknownsPage(filters).items;
+    }
+    /** Select a stable page of current heads before detaching record payloads. */
+    listUnknownsPage(query = {}) {
+        const offset = query.offset ?? 0;
+        const matching = [...this.#unknownHeads.values()]
+            .filter((unknown) => (query.status === undefined || unknown.status === query.status) &&
+            (query.severity === undefined ||
+                unknown.severity === query.severity) &&
+            (query.domain === undefined || unknown.domain === query.domain))
+            .sort((left, right) => compareUnicodeCodePoints(left.unknown_id, right.unknown_id));
+        const start = Math.min(offset, matching.length);
+        const end = query.limit === undefined
+            ? undefined
+            : start + Math.min(query.limit, matching.length - start);
+        const page = matching.slice(start, end);
+        const nextOffset = offset <= matching.length && start + page.length < matching.length
+            ? start + page.length
+            : null;
+        return {
+            items: page.map((unknown) => structuredClone(unknown)),
+            total: matching.length,
+            offset,
+            next_offset: nextOffset,
+        };
     }
     /** Return current resolution validity; imported invalid states are rejected. */
     verifyUnknownResolution(unknownId) {
@@ -247,7 +273,7 @@ export class EvidenceLedger {
     #appendUnknown(unknown, mutationEvidenceInput) {
         let mutationEvidence;
         try {
-            mutationEvidence = parseEvidence(mutationEvidenceInput);
+            mutationEvidence = immutableEvidence(mutationEvidenceInput);
         }
         catch (cause) {
             return err(new EvidenceIntegrityError("Unknown mutation evidence is invalid", {
@@ -294,7 +320,7 @@ export class EvidenceLedger {
     }
     #validateCandidate(records, unknowns) {
         try {
-            parseEvidenceBundle(createEvidenceBundle([...records.values()], [...unknowns.values()]));
+            createImmutableEvidenceBundle([...records.values()], [...unknowns.values()]);
         }
         catch (cause) {
             return err(new UnknownRegistryError("integrity", { cause }));

package/dist/application/investigation/InspectEvidenceBundle.js

@@ -0,0 +1,18 @@
+import { AnalysisInputError } from "../../domain/analysisErrorCore.js";
+import { err, ok } from "../../domain/result.js";
+import { summarizeEvidenceBundle, } from "../../domain/evidenceRecordSummary.js";
+/** Select complete bundle delivery or discovery metadata without analysis payloads. */
+export const inspectEvidenceBundle = (bundle, options) => {
+    if (options.detail === "complete" && options.filters !== undefined)
+        return err(new AnalysisInputError("get_evidence_bundle", undefined, [
+            {
+                path: ["filters"],
+                reason: "invalid_value",
+                message: "Record filters require detail: summary; complete returns the canonical bundle.",
+                expected: "detail: summary",
+            },
+        ]));
+    return ok(options.detail === "summary"
+        ? summarizeEvidenceBundle(bundle, options.filters)
+        : bundle);
+};

package/dist/application/investigation/InvestigationRecords.js

@@ -1,6 +1,5 @@
-import { createEvidence } from "../../domain/evidence.js";
 import { EvidenceLedger } from "./EvidenceLedger.js";
-import { UNKNOWN_REGISTRY_PROVIDER, unknownEvidenceLinks, unknownMutationEvidence, } from "./UnknownEvidence.js";
+import { unknownMutationEvidence } from "./UnknownEvidence.js";
 /** One investigation's validated record owner, independent of binary execution. */
 export class InvestigationRecords {
     #evidence = new EvidenceLedger();
@@ -38,38 +37,30 @@ export class InvestigationRecords {
     }
     /** Record an Unknown with an explicitly supplied Evidence subject, if any. */
     recordUnknown(input, target) {
-        const recorded = this.#evidence.recordUnknown(input, unknownMutationEvidence(target, input));
-        return recorded;
+        return this.#evidence.recordUnknown(input, unknownMutationEvidence(target, { operation: "record_unknown", input }));
     }
     /** Commit derived Evidence and its Unknown atomically without an implicit subject. */
     recordEvidenceWithUnknown(evidence, input) {
-        const recorded = this.#evidence.recordWithUnknown(evidence, input, unknownMutationEvidence(undefined, input));
-        return recorded;
+        return this.#evidence.recordWithUnknown(evidence, input, unknownMutationEvidence(undefined, {
+            operation: "record_unknown",
+            input,
+        }));
     }
     /** Update an optimistic revision with an explicitly supplied Evidence subject. */
     updateUnknown(input, target) {
-        const evidence = createEvidence(target, UNKNOWN_REGISTRY_PROVIDER, {
-            predicateType: "rea.residual-unknown-mutation",
+        const evidence = unknownMutationEvidence(target, {
             operation: "update_unknown",
-            parameters: {
-                unknown_id: input.unknown_id,
-                expected_revision: input.expected_revision,
-            },
-            result: { action: "update", status: input.status },
-            confidence: "derived",
-            authority: "analyst-inference",
-            evidenceLinks: unknownEvidenceLinks(input),
-            limitations: [
-                "Registry mutation evidence records analyst intent, not proof of the answer.",
-            ],
+            input,
         });
-        const updated = this.#evidence.updateUnknown(input, evidence);
-        return updated;
+        return this.#evidence.updateUnknown(input, evidence);
     }
     /** Return detached current Unknown revisions matching the selected filters. */
     listUnknowns(filters = {}) {
         return this.#evidence.listUnknowns(filters);
     }
+    listUnknownsPage(query = {}) {
+        return this.#evidence.listUnknownsPage(query);
+    }
     /** Verify registry consistency without asserting the answer is true. */
     verifyUnknownResolution(unknownId) {
         return this.#evidence.verifyUnknownResolution(unknownId);

package/dist/application/investigation/UnknownEvidence.js

@@ -1,33 +1,37 @@
 import { createEvidence } from "../../domain/evidence.js";
 /** Provider identity for analyst-authored residual-unknown mutations. */
-export const UNKNOWN_REGISTRY_PROVIDER = {
+const UNKNOWN_REGISTRY_PROVIDER = {
     id: "rea-unknown-registry",
     name: "REA residual unknown registry",
     version: "1",
 };
 /** Create immutable evidence for one approved residual-unknown mutation. */
-export const unknownMutationEvidence = (target, input) => createEvidence(target, UNKNOWN_REGISTRY_PROVIDER, {
+export const unknownMutationEvidence = (target, mutation) => createEvidence(target, UNKNOWN_REGISTRY_PROVIDER, {
     predicateType: "rea.residual-unknown-mutation",
-    operation: "record_unknown",
-    parameters: { domain: input.domain, severity: input.severity },
-    result: {
-        action: "record",
-        question: input.question,
-        required_authority: input.required_authority,
-        required_confidence: input.required_confidence,
-    },
+    operation: mutation.operation,
+    parameters: { ...mutation.input },
+    result: mutation.operation === "record_unknown"
+        ? {
+            action: "record",
+            question: mutation.input.question,
+            required_authority: mutation.input.required_authority,
+            required_confidence: mutation.input.required_confidence,
+        }
+        : { action: "update", status: mutation.input.status },
     confidence: "derived",
     authority: "analyst-inference",
-    evidenceLinks: unknownEvidenceLinks(input),
+    evidenceLinks: unknownEvidenceLinks(mutation.input),
     limitations: [
         "Registry mutation evidence records analyst intent, not proof of the answer.",
     ],
 });
 /** Deduplicate evidence links carried by an unknown mutation. */
-export const unknownEvidenceLinks = (input) => [
-    ...input.supporting_evidence_ids,
-    ...input.contradicting_evidence_ids,
-    ...("resolution" in input && input.resolution !== null
-        ? input.resolution.evidence_ids
-        : []),
-].filter((id, index, values) => values.indexOf(id) === index);
+const unknownEvidenceLinks = (input) => [
+    ...new Set([
+        ...input.supporting_evidence_ids,
+        ...input.contradicting_evidence_ids,
+        ...("resolution" in input && input.resolution !== null
+            ? input.resolution.evidence_ids
+            : []),
+    ]),
+];

package/dist/application/javascript/ElectronActiveObservationService.js

@@ -1,39 +1,69 @@
 import { dirname } from "node:path";
-import { realpath } from "node:fs/promises";
+import { constants } from "node:fs";
+import { access, realpath, stat } from "node:fs/promises";
 import { AnalysisCapabilityUnavailableError, AnalysisInputError, } from "../../domain/analysisErrorCore.js";
-import {} from "../../domain/analysisErrorBase.js";
-import { err } from "../../domain/result.js";
+import { err, ok } from "../../domain/result.js";
 import { createElectronActiveEvidence } from "./ElectronActiveEvidence.js";
 const OPERATION = "capture_electron_scenario";
 const PROVIDER_ID = "rea-playwright-electron-active";
-const canonicalizeInput = async (input) => {
+const resolveInputPath = async (field, selected) => {
     try {
-        const [executablePath, applicationPath] = await Promise.all([
-            realpath(input.executable_path),
-            realpath(input.application_path),
-        ]);
-        const applicationRoot = input.application_root === undefined
-            ? dirname(applicationPath)
-            : await realpath(input.application_root);
-        return {
-            ok: true,
-            value: {
-                ...input,
-                executable_path: executablePath,
-                application_path: applicationPath,
-                application_root: applicationRoot,
+        return ok(await realpath(selected));
+    }
+    catch (cause) {
+        return err({
+            issue: {
+                path: [field],
+                reason: "invalid_value",
+                message: `Cannot resolve ${field} ${selected}: ${cause instanceof Error ? cause.message : String(cause)}`,
             },
-        };
+            cause,
+        });
+    }
+};
+/** Resolve the executable and require a launchable regular file before any spawn. */
+const resolveExecutablePath = async (selected) => {
+    const resolved = await resolveInputPath("executable_path", selected);
+    if (!resolved.ok)
+        return resolved;
+    try {
+        if (!(await stat(resolved.value)).isFile())
+            throw new Error("not a regular file");
+        if (process.platform !== "win32")
+            await access(resolved.value, constants.X_OK);
+        return resolved;
     }
     catch (cause) {
-        return err(new AnalysisInputError(OPERATION, { cause }, [
-            {
-                path: ["application_path"],
-                reason: "invalid_format",
-                message: "Electron executable, application, and root must resolve to existing paths",
+        return err({
+            issue: {
+                path: ["executable_path"],
+                reason: "invalid_value",
+                message: `executable_path ${selected} is not an executable file: ${cause instanceof Error ? cause.message : String(cause)}`,
             },
-        ]));
+            cause,
+        });
+    }
+};
+const canonicalizeInput = async (input) => {
+    const [executable, application, root] = await Promise.all([
+        resolveExecutablePath(input.executable_path),
+        resolveInputPath("application_path", input.application_path),
+        input.application_root === undefined
+            ? Promise.resolve(ok(undefined))
+            : resolveInputPath("application_root", input.application_root),
+    ]);
+    if (!executable.ok || !application.ok || !root.ok) {
+        const failures = [executable, application, root].flatMap((result) => result.ok ? [] : [result.error]);
+        return err(new AnalysisInputError(OPERATION, {
+            cause: new AggregateError(failures.map(({ cause }) => cause), "Electron paths could not be resolved"),
+        }, failures.map(({ issue }) => issue)));
     }
+    return ok({
+        ...input,
+        executable_path: executable.value,
+        application_path: application.value,
+        application_root: root.value ?? dirname(application.value),
+    });
 };
 /** Canonicalize request paths and execute one provider-owned Electron run. */
 export const captureElectronScenario = async (provider, input, options = {}) => {

package/dist/application/javascript/ElectronBoundaryAnalysis.js

@@ -1,5 +1,5 @@
 import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";
-import { resolveArtifactPathByContext } from "./JavaScriptArtifactPathResolution.js";
+import { resolveArtifactPathByContext, } from "./JavaScriptArtifactPathResolution.js";
 /** Flatten all per-file IPC facts into deterministic application records. */
 export const collectElectronIpcRecords = (analysis) => analysis.files
     .flatMap(({ file, javascript }) => (javascript?.electron.ipc ?? []).map((finding) => ({
@@ -35,7 +35,7 @@ export const unambiguousElectronIpcPairings = (records) => classifyElectronIpcPa
         : [];
 });
 /** Summarize static Electron findings without treating gaps as absence. */
-export const summarizeElectronBoundaries = (analysis) => {
+export const summarizeElectronBoundaries = (analysis, directoryPaths) => {
     const files = new Map(analysis.files.map(({ file }) => [file.path, file]));
     const javascript = analysis.files.flatMap(({ javascript: value }) => value === null ? [] : [value]);
     const windows = javascript.flatMap(({ electron }) => electron.browser_windows);
@@ -77,6 +77,8 @@ export const summarizeElectronBoundaries = (analysis) => {
                 specifier: finding.module_path,
                 context: finding.module_resolution_context,
                 files,
+                directoryPaths,
+                runtimePathKind: "node-entrypoint",
             })).length,
         native_addon_bindings: nativeBindings.length,
         resolved_native_addon_bindings: nativeBindings.filter(({ file, finding }) => resolvesToFile({
@@ -84,6 +86,7 @@ export const summarizeElectronBoundaries = (analysis) => {
             specifier: finding.specifier,
             context: "module-specifier",
             files,
+            directoryPaths,
             kind: "native-addon",
             moduleKind: finding.module_kind,
         })).length,
@@ -105,9 +108,20 @@ const resolvesToFile = (input) => {
         sourcePath: input.file.path,
         context: input.context,
         files: input.files,
+        ...(input.directoryPaths === undefined
+            ? {}
+            : { directoryPaths: input.directoryPaths }),
+        ...(input.runtimePathKind === undefined
+            ? {}
+            : { runtimePathKind: input.runtimePathKind }),
         ...(input.moduleKind === undefined ? {} : { moduleKind: input.moduleKind }),
     }).resolved_path;
     return (resolved !== null &&
         (input.kind === undefined || input.files.get(resolved)?.kind === input.kind));
 };
-const ipcRecordKey = (path, finding) => `${path}\0${String(finding.location.start.line)}:${String(finding.location.start.column)}\0${finding.side}\0${finding.operation}`;
+const ipcRecordKey = (path, finding) => {
+    const identity = `${path}\0${String(finding.location.start.line)}:${String(finding.location.start.column)}\0${finding.side}\0${finding.operation}\0${finding.channel ?? finding.channel_expression}\0${JSON.stringify(finding.handler_location)}`;
+    return finding.invocation_location === undefined
+        ? identity
+        : `${identity}\0${String(finding.invocation_location.start.line)}:${String(finding.invocation_location.start.column)}`;
+};

package/dist/application/javascript/ElectronBoundaryGraph.js

@@ -1,9 +1,11 @@
 import { addElectronIpcBoundaries } from "./ElectronBoundaryGraphIpc.js";
 import { addElectronNativeBoundaries } from "./ElectronBoundaryGraphNative.js";
 import { addElectronWindowBoundaries } from "./ElectronBoundaryGraphWindows.js";
+import { addElectronCallPaths } from "./ElectronBoundaryGraphCallPaths.js";
 /** Add every static Electron process and security-boundary fact to the JAG. */
 export const addElectronBoundaries = (context) => {
     addElectronWindowBoundaries(context);
     addElectronIpcBoundaries(context);
     addElectronNativeBoundaries(context);
+    addElectronCallPaths(context);
 };

package/dist/application/javascript/ElectronBoundaryGraphCallPaths.js

@@ -0,0 +1,144 @@
+import { sha256Text } from "../../domain/javascript/javascriptStaticAnalysisHelpers.js";
+import { collectElectronIpcRecords, unambiguousElectronIpcPairings, } from "./ElectronBoundaryAnalysis.js";
+import { addElectronInferenceEdge, electronFindingSourceNode, electronRangeKey, } from "./ElectronBoundaryGraphContext.js";
+import { artifactLocalIdentity, javascriptAnalysisCoverage, } from "./JavaScriptArtifactGraphContext.js";
+import { staticInferenceEvidence } from "./JavaScriptArtifactGraphEvidence.js";
+/** Retain context-specific wrapper paths, then join only unique IPC records. */
+export const addElectronCallPaths = (context) => {
+    const projected = [];
+    for (const { file, javascript } of context.analysis.files) {
+        if (javascript === null)
+            continue;
+        const coverage = javascriptAnalysisCoverage(javascript);
+        for (const path of javascript.electron.call_paths ?? []) {
+            const pathId = sha256Text(JSON.stringify(path));
+            const nodes = path.steps.map((step, index) => context.accumulator.addNode({
+                kind: "javascript-expression",
+                identity: artifactLocalIdentity(file.sha256, "electron-call-path-step", `${pathId}:${String(index)}`),
+                observations: [
+                    {
+                        label: step.label,
+                        properties: {
+                            path_id: pathId,
+                            entry: path.entry,
+                            ...(path.entry_path === undefined
+                                ? {}
+                                : { entry_path: [...path.entry_path] }),
+                            entry_kind: path.entry_kind,
+                            channel: path.channel,
+                            terminal: path.terminal,
+                            step_kind: step.kind,
+                            step_index: index,
+                            module_key: step.module_key,
+                            module_runtime: step.module_runtime,
+                            conditions: path.conditions,
+                            resolution: "candidate",
+                        },
+                        evidence: staticInferenceEvidence({
+                            sha256: file.sha256,
+                            path: file.path,
+                            range: step.location,
+                            operation: "substitute-electron-wrapper",
+                            coverage,
+                            limitations: [
+                                "Lexical wrapper substitution is a static candidate; guards, runtime overrides and execution remain unverified.",
+                            ],
+                        }),
+                    },
+                ],
+            }));
+            const first = nodes[0], entry = path.steps[0];
+            const owner = entry
+                ? electronFindingSourceNode(context, file, entry.module_key, entry.module_runtime ?? undefined)
+                : undefined;
+            if (first && entry && owner)
+                addElectronInferenceEdge(context, {
+                    source: owner,
+                    target: first,
+                    file,
+                    range: entry.location,
+                    coverage,
+                    relation: "contains",
+                    operation: "locate-electron-wrapper-path",
+                    properties: {
+                        path_id: pathId,
+                        entry: path.entry,
+                        ...(path.entry_path === undefined
+                            ? {}
+                            : { entry_path: [...path.entry_path] }),
+                        resolution: "candidate",
+                    },
+                });
+            for (let i = 1; i < nodes.length; i += 1) {
+                const source = nodes[i - 1], target = nodes[i], previous = path.steps[i - 1], step = path.steps[i];
+                if (!source || !target || !previous || !step)
+                    continue;
+                addElectronInferenceEdge(context, {
+                    source,
+                    target,
+                    file,
+                    range: step.location,
+                    coverage,
+                    relation: ["exposure", "factory", "ipc"].includes(previous.kind)
+                        ? "maps_to"
+                        : "calls",
+                    operation: "trace-electron-wrapper-path",
+                    properties: {
+                        path_id: pathId,
+                        entry: path.entry,
+                        ...(path.entry_path === undefined
+                            ? {}
+                            : { entry_path: [...path.entry_path] }),
+                        channel: path.channel,
+                        resolution: "candidate",
+                        conditions: path.conditions,
+                    },
+                });
+            }
+            projected.push({ file, path, coverage, nodes });
+        }
+    }
+    for (const { transmission, handler } of unambiguousElectronIpcPairings(collectElectronIpcRecords(context.analysis))) {
+        const sources = projected.filter((p) => p.path.entry_kind === "bridge-member" && matches(p, transmission));
+        const targets = projected.filter((p) => p.path.entry_kind === "ipc-handler" && matches(p, handler));
+        for (const from of sources)
+            for (const to of targets) {
+                const source = from.nodes.at(-1), target = to.nodes[0];
+                if (!source || !target)
+                    continue;
+                addElectronInferenceEdge(context, {
+                    source,
+                    target,
+                    file: from.file,
+                    range: transmission.finding.location,
+                    coverage: from.coverage,
+                    relation: transmission.finding.mode === "invoke" ? "invokes" : "sends",
+                    operation: "join-electron-wrapper-paths",
+                    properties: {
+                        channel: transmission.finding.channel,
+                        pairing_basis: "unique-exact-literal-channel",
+                        resolution: "candidate",
+                        handler_path: to.file.path,
+                        bridge_conditions: from.path.conditions,
+                        handler_conditions: to.path.conditions,
+                    },
+                    limitations: [
+                        "The unique static channel match does not establish runtime registration, sender acceptance, or dispatch.",
+                    ],
+                });
+            }
+    }
+};
+const matches = (projected, record) => {
+    const { path } = projected;
+    const { finding } = record;
+    const invocation = finding.invocation_location;
+    const sourceStepKind = finding.mode === "send" || finding.mode === "invoke" ? "terminal" : "ipc";
+    return (projected.file.path === record.file.path &&
+        path.channel === finding.channel &&
+        path.steps.some((step) => step.kind === sourceStepKind &&
+            electronRangeKey(step.location) === electronRangeKey(finding.location)) &&
+        (invocation === undefined ||
+            path.steps.some((step) => (step.kind === "call" || step.kind === "exposure") &&
+                electronRangeKey(step.location) === electronRangeKey(invocation))));
+};

package/dist/application/javascript/ElectronBoundaryGraphContext.js

@@ -1,9 +1,10 @@
 import { sha256Text } from "../../domain/javascript/javascriptStaticAnalysisHelpers.js";
+import { sourceNodeFor, } from "./JavaScriptArtifactGraphContext.js";
 import { astObservationEvidence, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
 /** Resolve the file or recovered bundle module that owns one finding. */
-export const electronFindingSourceNode = (context, file, moduleKey) => moduleKey === null
+export const electronFindingSourceNode = (context, file, moduleKey, runtime) => moduleKey === null
     ? (context.assetNodes.get(file.path) ?? context.fileNodes.get(file.path))
-    : context.moduleNodes.get(`${file.path}\0${moduleKey}`);
+    : sourceNodeFor(context, file.path, moduleKey, runtime);
 /** Observation-scoped identity shared safely across different artifact files. */
 export const electronObservationIdentity = (context, scope, key) => ({
     strategy: "observation-fingerprint",

package/dist/application/javascript/ElectronBoundaryGraphIpc.js

@@ -1,5 +1,5 @@
 import { artifactLocalIdentity, javascriptAnalysisCoverage, } from "./JavaScriptArtifactGraphContext.js";
-import { astObservationEvidence } from "./JavaScriptArtifactGraphEvidence.js";
+import { astObservationEvidence, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
 import { collectElectronIpcRecords, unambiguousElectronIpcPairings, } from "./ElectronBoundaryAnalysis.js";
 import { addElectronAstEdge, addElectronInferenceEdge, electronFindingSourceNode, electronObservationIdentity, electronRangeContains, electronRangeKey, } from "./ElectronBoundaryGraphContext.js";
 /** Project IPC syntax, handler locations, validations, and exact pairings. */
@@ -21,7 +21,7 @@ const addIpcRecord = (state, record) => {
     const coverage = coverageFor(context, record.file);
     if (coverage === undefined)
         return;
-    const source = electronFindingSourceNode(context, record.file, record.finding.module_key);
+    const source = electronFindingSourceNode(context, record.file, record.finding.module_key, record.finding.module_runtime);
     if (source === undefined)
         return;
     state.sources.set(record.key, source);
@@ -62,7 +62,9 @@ const addChannelNode = (context, record, coverage) => {
         : `literal:${finding.channel}`;
     return context.accumulator.addNode({
         kind: "ipc-channel",
-        identity: electronObservationIdentity(context, "electron-ipc-channel", identityKey),
+        identity: finding.resolution_basis === "wrapper-substitution"
+            ? artifactLocalIdentity(file.sha256, "electron-inferred-ipc-channel", identityKey)
+            : electronObservationIdentity(context, "electron-ipc-channel", identityKey),
         observations: [
             {
                 label: finding.channel ?? finding.channel_expression,
@@ -73,18 +75,27 @@ const addChannelNode = (context, record, coverage) => {
                     channel: finding.channel,
                     channel_expression: finding.channel_expression,
                     resolution: finding.channel === null ? "dynamic" : "literal",
+                    ...(finding.invocation_location === undefined
+                        ? {}
+                        : { invocation_location: finding.invocation_location }),
                 },
-                evidence: astObservationEvidence({
+                evidence: (finding.resolution_basis === "wrapper-substitution"
+                    ? staticInferenceEvidence
+                    : astObservationEvidence)({
                     sha256: file.sha256,
                     path: file.path,
                     range: finding.location,
                     operation: "observe-ipc-channel-expression",
                     coverage,
-                    limitations: finding.channel === null
+                    limitations: finding.resolution_basis === "wrapper-substitution"
                         ? [
-                            "The channel expression is dynamic; its runtime value and pairings remain unknown.",
+                            "The channel is inferred through lexical wrapper substitution; runtime registration and dispatch remain unverified.",
                         ]
-                        : [],
+                        : finding.channel === null
+                            ? [
+                                "The channel expression is dynamic; its runtime value and pairings remain unknown.",
+                            ]
+                            : [],
                 }),
             },
         ],
@@ -108,8 +119,13 @@ const addHandlerNode = (input) => {
                     channel_expression: finding.channel_expression,
                     handler_kind: finding.handler_kind,
                     handler_location: finding.handler_location,
+                    ...(finding.invocation_location === undefined
+                        ? {}
+                        : { invocation_location: finding.invocation_location }),
                 },
-                evidence: astObservationEvidence({
+                evidence: (finding.resolution_basis === "wrapper-substitution"
+                    ? staticInferenceEvidence
+                    : astObservationEvidence)({
                     sha256: file.sha256,
                     path: file.path,
                     range: handlerRange,
@@ -141,6 +157,9 @@ const addHandlerNode = (input) => {
             channel: finding.channel,
             channel_expression: finding.channel_expression,
             resolution: finding.channel === null ? "dynamic" : "literal",
+            ...(finding.invocation_location === undefined
+                ? {}
+                : { invocation_location: finding.invocation_location }),
         },
     });
     return handler;
@@ -181,7 +200,7 @@ const addValidationObservations = (state) => {
         for (const validation of javascript.electron.sender_validations) {
             const handlerRecord = containingHandler(state.records, file, validation);
             const target = handlerRecord === undefined
-                ? electronFindingSourceNode(state.context, file, validation.module_key)
+                ? electronFindingSourceNode(state.context, file, validation.module_key, validation.module_runtime)
                 : state.handlers.get(handlerRecord.key);
             if (target !== undefined)
                 addValidationObservation({