reverseport 0.0.0-stage → 1.2.0

package/dist/cli-runtime/javascriptApplicationGraph-DUWeec4O.js

@@ -0,0 +1,940 @@
+import { __esmMin } from "./rolldown-runtime-DXoylpqc.js";
+import { freezeJsonSnapshot, freezeOwnedJsonSnapshotSteps, init_immutableJson, init_jsonValue, jsonValueSchema } from "./providerOperationHealth-DSTcYPJe.js";
+import { canonicalJson, canonicalJsonDigestSteps, compareUnicodeCodePoints, digestCanonicalValue, digestSchema, init_canonicalDigest, init_canonicalJsonDigestSteps, init_canonicalOrdering, init_comparisonSemantics, init_digests, init_unicodeCodePointOrder, prefixedDigestSchema, uniqueSorted } from "./reconstructionObligationLedgerSchemas-dvp6PEnZ.js";
+import { posix } from "node:path";
+import { z } from "zod";
+import { domainToASCII, fileURLToPath, pathToFileURL } from "node:url";
+
+//#region dist/domain/zodCollectionSteps.js
+/** Elements validated between yields, in the issues and paths a whole-array parse reports. */
+function* parseElementSteps(element, values, path, issues) {
+	const parsed = [];
+	for (const [index, value] of values.entries()) {
+		if (index % 64 === 0) yield;
+		const result = element.safeParse(value);
+		if (result.success) parsed.push(result.data);
+		else issues.push(...result.error.issues.map((issue) => ({
+			...issue,
+			path: [
+				...path,
+				index,
+				...issue.path
+			]
+		})));
+	}
+	return parsed;
+}
+var arrayContainerSchema;
+function init_zodCollectionSteps() {
+	return (init_zodCollectionSteps = __esmMin((() => {
+		arrayContainerSchema = (array) => array.clone({
+			...array.def,
+			element: z.unknown()
+		});
+	})))();
+}
+
+//#endregion
+//#region dist/domain/javascript/javascriptSourceMapPaths.js
+var javascriptSourceMapReferenceSchema, resolveJavaScriptSourceMapReference, resolveJavaScriptSourceMapPath, unusableHost, carriesUsableHost, windowsFileUrl, decodedUrlPath;
+function init_javascriptSourceMapPaths() {
+	return (init_javascriptSourceMapPaths = __esmMin((() => {
+		javascriptSourceMapReferenceSchema = z.strictObject({
+			source_name: z.string(),
+			source_root: z.string().nullable(),
+			map_path: z.string().min(1),
+			resolution: z.discriminatedUnion("kind", [z.strictObject({
+				kind: z.enum(["artifact-relative", "suffix"]),
+				path: z.string().min(1)
+			}), z.strictObject({
+				kind: z.literal("unresolved"),
+				reason: z.string().min(1)
+			})])
+		});
+		resolveJavaScriptSourceMapReference = (sourceName, sourceRoot, mapPath) => {
+			const reference = `${sourceRoot ? `${sourceRoot}/` : ""}${sourceName}`;
+			return {
+				source_name: sourceName,
+				source_root: sourceRoot,
+				map_path: mapPath,
+				resolution: resolveJavaScriptSourceMapPath(reference, mapPath)
+			};
+		};
+		resolveJavaScriptSourceMapPath = (source, mapPath) => {
+			const portable = source.replaceAll("\\", "/");
+			const windowsPath = /^[a-z]:\//iu.test(portable) || source.startsWith("\\\\");
+			const anchor = `/${"source/".repeat(portable.split("/").length + 1)}`;
+			const directory = posix.join(anchor, posix.dirname(mapPath.replaceAll("\\", "/")));
+			const base = pathToFileURL(`${directory}/`, { windows: false });
+			const absolute = windowsPath ? windowsFileUrl(source) : URL.parse(source);
+			const resolved = windowsPath ? absolute : URL.parse(source, base);
+			if (resolved === null) return {
+				kind: "unresolved",
+				reason: "Source reference is not a valid URL or filesystem path."
+			};
+			if (!resolved.pathname.startsWith("/")) return {
+				kind: "unresolved",
+				reason: "Source reference uses a non-hierarchical URL without a file pathname."
+			};
+			if (resolved.pathname.endsWith("/")) return {
+				kind: "unresolved",
+				reason: "Source reference names a directory rather than a file."
+			};
+			if (/%(?:2f|5c)/iu.test(resolved.pathname)) return {
+				kind: "unresolved",
+				reason: "Source reference contains an encoded path separator."
+			};
+			const relative = absolute === null ? !portable.startsWith("/") : absolute.href !== resolved.href;
+			const path = decodedUrlPath(resolved);
+			if (path === null) return {
+				kind: "unresolved",
+				reason: "Source reference has malformed URL encoding or an invalid file URL."
+			};
+			const value = relative ? posix.relative(anchor, path) : path.replace(/^\/+/, "");
+			if (value === "" || value === ".." || value.startsWith("../")) return {
+				kind: "unresolved",
+				reason: "Source reference resolves outside the inventoried artifact."
+			};
+			return {
+				path: value,
+				kind: relative ? "artifact-relative" : "suffix"
+			};
+		};
+		unusableHost = /[\0\t\n\r #/:<>?@[\\\]^|%]/u;
+		carriesUsableHost = (host) => !unusableHost.test(host) && domainToASCII(host) !== "";
+		windowsFileUrl = (path) => {
+			if (path.startsWith("\\\\") && !carriesUsableHost(path.slice(2).split("\\")[0] ?? "")) return null;
+			try {
+				return pathToFileURL(path, { windows: true });
+			} catch (cause) {
+				if (cause instanceof TypeError) return null;
+				throw cause;
+			}
+		};
+		decodedUrlPath = (url) => {
+			try {
+				if (url.protocol === "file:") return fileURLToPath(url, { windows: url.hostname !== "" && url.hostname !== "localhost" }).replaceAll("\\", "/");
+				return `${url.host}${decodeURIComponent(url.pathname)}`;
+			} catch (cause) {
+				if (cause instanceof URIError || cause instanceof TypeError) return null;
+				throw cause;
+			}
+		};
+	})))();
+}
+
+//#endregion
+//#region dist/domain/javascript/javascriptApplicationEvidenceSchemas.js
+var boundedTextSchema$1, boundedKeySchema, unsafePathSegments, isSafeRelativePath, relativePathSchema, applicationEvidenceAuthoritySchema, applicationFactStateSchema, applicationConfidenceSchema, applicationUnavailableReasonSchema, unavailableFactSchema, availableArtifactSchema, applicationArtifactReferenceSchema, sourceRangeSchema, fileOffsetRangeSchema, applicationLocationSchema, applicationLocationReferenceSchema, applicationExtractorSchema, applicationLimitSchema, coverageLimitsSchema, omittedCountSchema, applicationCoverageSchema, completeApplicationCoverage, partialApplicationCoverage, truncatedApplicationCoverage, applicationGraphEvidenceBaseSchema, applicationGraphEvidenceContextSchema, applicationGraphEvidenceLocationSchema, checkAuthorityState, checkStateConfidence, checkTraceability, checkArtifactBacking, applicationGraphEvidenceSchema, applicationNodeIdentitySchema;
+function init_javascriptApplicationEvidenceSchemas() {
+	return (init_javascriptApplicationEvidenceSchemas = __esmMin((() => {
+		init_digests();
+		boundedTextSchema$1 = z.string().min(1);
+		boundedKeySchema = z.string().min(1);
+		unsafePathSegments = new Set([
+			"",
+			".",
+			".."
+		]);
+		isSafeRelativePath = (path) => {
+			if (path.startsWith("/") || path.includes("\\")) return false;
+			return path.split("/").every((part) => !unsafePathSegments.has(part));
+		};
+		relativePathSchema = z.string().min(1).refine(isSafeRelativePath, "Expected a normalized relative POSIX path without traversal");
+		applicationEvidenceAuthoritySchema = z.enum([
+			"artifact-bytes",
+			"ast-static-analysis",
+			"static-relationship-inference",
+			"passive-cdp-runtime",
+			"cross-layer-reconciliation",
+			"cross-version-comparison",
+			"controlled-replay",
+			"native-analysis-provider",
+			"managed-static-analysis",
+			"historical-reference",
+			"user-assertion",
+			"unknown"
+		]);
+		applicationFactStateSchema = z.enum([
+			"observed",
+			"inferred",
+			"unknown",
+			"unavailable"
+		]);
+		applicationConfidenceSchema = z.enum([
+			"exact",
+			"high",
+			"medium",
+			"low",
+			"unknown"
+		]);
+		applicationUnavailableReasonSchema = z.enum([
+			"not-applicable",
+			"not-observed",
+			"truncated",
+			"provider-unavailable",
+			"unresolved",
+			"unknown"
+		]);
+		unavailableFactSchema = z.strictObject({
+			available: z.literal(false),
+			reason: applicationUnavailableReasonSchema,
+			detail: boundedTextSchema$1
+		});
+		availableArtifactSchema = z.strictObject({
+			available: z.literal(true),
+			artifact_id: prefixedDigestSchema("art"),
+			sha256: digestSchema
+		}).superRefine((artifact, context) => {
+			if (artifact.artifact_id !== `art_${artifact.sha256}`) context.addIssue({
+				code: "custom",
+				path: ["artifact_id"],
+				message: "Artifact identifier must commit the same SHA-256 digest"
+			});
+		});
+		applicationArtifactReferenceSchema = z.discriminatedUnion("available", [availableArtifactSchema, unavailableFactSchema]);
+		sourceRangeSchema = z.strictObject({
+			kind: z.literal("source-range"),
+			source: boundedTextSchema$1,
+			start: z.strictObject({
+				line: z.number().int().min(1),
+				column: z.number().int().min(0)
+			}),
+			end: z.strictObject({
+				line: z.number().int().min(1),
+				column: z.number().int().min(0)
+			})
+		}).superRefine((location, context) => {
+			if (location.end.line < location.start.line || location.end.line === location.start.line && location.end.column < location.start.column) context.addIssue({
+				code: "custom",
+				path: ["end"],
+				message: "Source range end must not precede its start"
+			});
+		});
+		fileOffsetRangeSchema = z.strictObject({
+			kind: z.literal("file-offset-range"),
+			start: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+			end: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER)
+		}).superRefine((location, context) => {
+			if (location.end < location.start) context.addIssue({
+				code: "custom",
+				path: ["end"],
+				message: "File offset range end must not precede its start"
+			});
+		});
+		applicationLocationSchema = z.discriminatedUnion("kind", [
+			z.strictObject({
+				kind: z.literal("artifact-path"),
+				path: relativePathSchema
+			}),
+			sourceRangeSchema,
+			fileOffsetRangeSchema,
+			z.strictObject({
+				kind: z.literal("url"),
+				url: z.string().min(1)
+			}),
+			z.strictObject({
+				kind: z.literal("runtime"),
+				capture_sha256: digestSchema,
+				target_key: boundedKeySchema,
+				frame_key: boundedKeySchema.nullable(),
+				script_key: boundedKeySchema.nullable()
+			}),
+			z.strictObject({
+				kind: z.literal("native-address"),
+				address: boundedKeySchema,
+				symbol: boundedTextSchema$1.nullable()
+			}),
+			z.strictObject({
+				kind: z.literal("package-export"),
+				package_name: boundedKeySchema,
+				export_path: boundedTextSchema$1
+			})
+		]);
+		applicationLocationReferenceSchema = z.discriminatedUnion("available", [z.strictObject({
+			available: z.literal(true),
+			value: applicationLocationSchema
+		}), unavailableFactSchema]);
+		applicationExtractorSchema = z.strictObject({
+			name: z.string().min(1),
+			version: z.string().min(1),
+			operation: z.string().min(1),
+			executable_sha256: digestSchema.nullable()
+		});
+		applicationLimitSchema = z.strictObject({
+			name: z.string().min(1),
+			value: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+			unit: z.enum([
+				"items",
+				"bytes",
+				"milliseconds",
+				"depth",
+				"characters",
+				"instructions",
+				"other"
+			])
+		});
+		coverageLimitsSchema = z.array(applicationLimitSchema);
+		omittedCountSchema = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
+		applicationCoverageSchema = z.union([
+			z.strictObject({
+				status: z.literal("complete"),
+				truncated: z.literal(false),
+				omitted_count: z.literal(0),
+				limits: coverageLimitsSchema
+			}),
+			z.strictObject({
+				status: z.literal("partial"),
+				truncated: z.literal(false),
+				omitted_count: omittedCountSchema.nullable(),
+				limits: coverageLimitsSchema
+			}),
+			z.strictObject({
+				status: z.literal("partial"),
+				truncated: z.literal(true),
+				omitted_count: z.union([omittedCountSchema.positive(), z.null()]),
+				limits: z.array(applicationLimitSchema).min(1)
+			}),
+			z.strictObject({
+				status: z.enum(["unknown", "unavailable"]),
+				truncated: z.literal(false),
+				omitted_count: z.null(),
+				limits: coverageLimitsSchema
+			})
+		]);
+		completeApplicationCoverage = (limits = []) => applicationCoverageSchema.parse({
+			status: "complete",
+			truncated: false,
+			omitted_count: 0,
+			limits
+		});
+		partialApplicationCoverage = (limits, omittedCount) => applicationCoverageSchema.parse({
+			status: "partial",
+			truncated: false,
+			omitted_count: omittedCount,
+			limits
+		});
+		truncatedApplicationCoverage = (limits, omittedCount) => applicationCoverageSchema.parse({
+			status: "partial",
+			truncated: true,
+			omitted_count: omittedCount,
+			limits
+		});
+		applicationGraphEvidenceBaseSchema = z.strictObject({
+			authority: applicationEvidenceAuthoritySchema,
+			state: applicationFactStateSchema,
+			confidence: applicationConfidenceSchema,
+			artifact: applicationArtifactReferenceSchema,
+			location: applicationLocationReferenceSchema,
+			extractor: applicationExtractorSchema,
+			coverage: applicationCoverageSchema,
+			limitations: z.array(boundedTextSchema$1),
+			evidence_ids: z.array(prefixedDigestSchema("ev"))
+		});
+		applicationGraphEvidenceContextSchema = applicationGraphEvidenceBaseSchema.omit({ location: true });
+		applicationGraphEvidenceLocationSchema = applicationLocationReferenceSchema;
+		checkAuthorityState = (evidence, context) => {
+			if (evidence.authority === "static-relationship-inference" && evidence.state !== "inferred") context.addIssue({
+				code: "custom",
+				path: ["state"],
+				message: "Static relationship authority must remain inferred"
+			});
+			if (evidence.authority === "cross-layer-reconciliation" && evidence.state !== "inferred") context.addIssue({
+				code: "custom",
+				path: ["state"],
+				message: "Cross-layer reconciliation authority must remain inferred"
+			});
+			if (evidence.authority === "cross-version-comparison" && evidence.state !== "inferred") context.addIssue({
+				code: "custom",
+				path: ["state"],
+				message: "Cross-version comparison authority must remain inferred"
+			});
+			if (evidence.authority === "unknown" && !["unknown", "unavailable"].includes(evidence.state)) context.addIssue({
+				code: "custom",
+				path: ["state"],
+				message: "Unknown authority cannot claim an observed fact"
+			});
+		};
+		checkStateConfidence = (evidence, context) => {
+			if (["unknown", "unavailable"].includes(evidence.state) && (evidence.confidence !== "unknown" || evidence.limitations.length === 0)) context.addIssue({
+				code: "custom",
+				message: "Unknown and unavailable facts require unknown confidence and an explicit limitation"
+			});
+			if (evidence.state === "observed" && evidence.confidence === "unknown") context.addIssue({
+				code: "custom",
+				path: ["confidence"],
+				message: "Observed facts require a bounded non-unknown confidence"
+			});
+			if (evidence.state === "inferred" && ![
+				"high",
+				"medium",
+				"low"
+			].includes(evidence.confidence)) context.addIssue({
+				code: "custom",
+				path: ["confidence"],
+				message: "Inferred facts require high, medium, or low confidence"
+			});
+			if (evidence.confidence === "exact" && evidence.state !== "observed") context.addIssue({
+				code: "custom",
+				path: ["confidence"],
+				message: "Exact confidence is reserved for observed facts"
+			});
+		};
+		checkTraceability = (evidence, context) => {
+			if (evidence.state === "observed" && !evidence.location.available) context.addIssue({
+				code: "custom",
+				path: ["location"],
+				message: "Observed facts require an actionable location"
+			});
+			if (evidence.state === "inferred" && evidence.limitations.length === 0) context.addIssue({
+				code: "custom",
+				path: ["limitations"],
+				message: "Inferred facts require an explicit limitation"
+			});
+			if (evidence.coverage.status !== "complete" && evidence.limitations.length === 0) context.addIssue({
+				code: "custom",
+				path: ["limitations"],
+				message: "Non-complete coverage requires an explicit limitation"
+			});
+		};
+		checkArtifactBacking = (evidence, context) => {
+			const artifactBacked = [
+				"artifact-bytes",
+				"ast-static-analysis",
+				"controlled-replay",
+				"native-analysis-provider",
+				"managed-static-analysis"
+			].includes(evidence.authority);
+			if (artifactBacked && evidence.state !== "unavailable" && !evidence.artifact.available) context.addIssue({
+				code: "custom",
+				path: ["artifact"],
+				message: "Artifact-backed facts require a content digest"
+			});
+		};
+		applicationGraphEvidenceSchema = applicationGraphEvidenceBaseSchema.superRefine((evidence, context) => {
+			checkAuthorityState(evidence, context);
+			checkStateConfidence(evidence, context);
+			checkTraceability(evidence, context);
+			checkArtifactBacking(evidence, context);
+		});
+		applicationNodeIdentitySchema = z.discriminatedUnion("strategy", [
+			z.strictObject({
+				strategy: z.literal("content-digest"),
+				stability: z.literal("global-exact"),
+				sha256: digestSchema
+			}),
+			z.strictObject({
+				strategy: z.literal("source-map-original"),
+				stability: z.literal("source-map-exact"),
+				source_map_sha256: digestSchema,
+				original_source: z.string(),
+				source_root: z.string().nullable(),
+				source_sha256: digestSchema.nullable()
+			}),
+			z.strictObject({
+				strategy: z.literal("canonical-path"),
+				stability: z.literal("artifact-version"),
+				artifact_sha256: digestSchema,
+				path: relativePathSchema
+			}),
+			z.strictObject({
+				strategy: z.literal("structural-fingerprint"),
+				stability: z.literal("cross-version-inference"),
+				algorithm: z.string().min(1),
+				fingerprint_sha256: digestSchema,
+				basis: z.array(z.enum([
+					"syntax-tree",
+					"control-flow",
+					"imports",
+					"exports",
+					"literals",
+					"api-usage"
+				])).min(1)
+			}),
+			z.strictObject({
+				strategy: z.literal("artifact-local-key"),
+				stability: z.literal("artifact-version"),
+				artifact_sha256: digestSchema,
+				namespace: boundedKeySchema,
+				key: z.string()
+			}),
+			z.strictObject({
+				strategy: z.literal("runtime-instance"),
+				stability: z.literal("capture-only"),
+				capture_sha256: digestSchema,
+				runtime_key: boundedTextSchema$1
+			}),
+			z.strictObject({
+				strategy: z.literal("observation-fingerprint"),
+				stability: z.literal("observation-only"),
+				observation_sha256: digestSchema,
+				scope: boundedTextSchema$1
+			})
+		]);
+	})))();
+}
+
+//#endregion
+//#region dist/domain/javascript/javascriptApplicationGraphSchemas.js
+var boundedTextSchema, JAVASCRIPT_APPLICATION_NODE_KINDS, applicationNodeKindSchema, JAVASCRIPT_APPLICATION_RELATIONS, applicationRelationSchema, applicationPropertiesSchema, applicationNodeObservationBaseSchema, applicationNodeObservationInputSchema, applicationNodeObservationSchema, applicationNodeInputSchema, applicationNodeSchema, applicationEdgeInputSchema, applicationEdgeSchema, javascriptApplicationGraphInputSchema, javascriptApplicationGraphRecordSchema;
+function init_javascriptApplicationGraphSchemas() {
+	return (init_javascriptApplicationGraphSchemas = __esmMin((() => {
+		init_javascriptSourceMapPaths();
+		init_javascriptApplicationEvidenceSchemas();
+		init_jsonValue();
+		init_digests();
+		boundedTextSchema = z.string().min(1);
+		JAVASCRIPT_APPLICATION_NODE_KINDS = [
+			"package",
+			"installer",
+			"artifact",
+			"asar-entry",
+			"electron-main",
+			"electron-preload",
+			"electron-renderer",
+			"electron-utility",
+			"javascript-asset",
+			"javascript-chunk",
+			"javascript-module",
+			"javascript-expression",
+			"source-map",
+			"source-module",
+			"browser-window",
+			"frame",
+			"target",
+			"context-bridge-api",
+			"ipc-channel",
+			"ipc-handler",
+			"worker",
+			"service-worker",
+			"endpoint",
+			"storage",
+			"native-addon",
+			"native-export",
+			"managed-assembly",
+			"managed-module",
+			"managed-type",
+			"managed-method",
+			"managed-field",
+			"managed-pinvoke-import",
+			"managed-native-implementation",
+			"runtime-script-instance",
+			"unknown"
+		];
+		applicationNodeKindSchema = z.enum(JAVASCRIPT_APPLICATION_NODE_KINDS);
+		JAVASCRIPT_APPLICATION_RELATIONS = [
+			"contains",
+			"loads",
+			"imports",
+			"maps_to",
+			"exposes",
+			"sends",
+			"invokes",
+			"handles",
+			"calls",
+			"persists_to",
+			"observed_as",
+			"changed_from"
+		];
+		applicationRelationSchema = z.enum(JAVASCRIPT_APPLICATION_RELATIONS);
+		applicationPropertiesSchema = z.record(z.string().min(1), jsonValueSchema);
+		applicationNodeObservationBaseSchema = z.strictObject({
+			label: z.string().min(1).nullable(),
+			source_map_reference: javascriptSourceMapReferenceSchema.nullable(),
+			properties: applicationPropertiesSchema,
+			evidence: applicationGraphEvidenceSchema
+		});
+		applicationNodeObservationInputSchema = applicationNodeObservationBaseSchema.extend({ source_map_reference: javascriptSourceMapReferenceSchema.nullable().default(null) });
+		applicationNodeObservationSchema = applicationNodeObservationBaseSchema.extend({
+			observation_id: prefixedDigestSchema("jag_observation"),
+			identifier_strategy: z.strictObject({
+				strategy: z.literal("semantic-content-sha256"),
+				stability: z.literal("observation-exact")
+			})
+		});
+		applicationNodeInputSchema = z.strictObject({
+			kind: applicationNodeKindSchema,
+			identity: applicationNodeIdentitySchema,
+			observations: z.array(applicationNodeObservationInputSchema).min(1)
+		});
+		applicationNodeSchema = z.strictObject({
+			node_id: prefixedDigestSchema("jag_node"),
+			kind: applicationNodeKindSchema,
+			identity: applicationNodeIdentitySchema,
+			observations: z.array(applicationNodeObservationSchema).min(1)
+		});
+		applicationEdgeInputSchema = z.strictObject({
+			source_node_id: prefixedDigestSchema("jag_node"),
+			target_node_id: prefixedDigestSchema("jag_node"),
+			relation: applicationRelationSchema,
+			properties: applicationPropertiesSchema,
+			evidence: applicationGraphEvidenceSchema
+		});
+		applicationEdgeSchema = applicationEdgeInputSchema.extend({
+			edge_id: prefixedDigestSchema("jag_edge"),
+			identifier_strategy: z.strictObject({
+				strategy: z.literal("semantic-content-sha256"),
+				stability: z.literal("relationship-exact")
+			})
+		});
+		javascriptApplicationGraphInputSchema = z.strictObject({
+			schema: z.literal("JavaScriptApplicationGraph"),
+			root_node_ids: z.array(prefixedDigestSchema("jag_node")).min(1),
+			nodes: z.array(applicationNodeSchema).min(1),
+			edges: z.array(applicationEdgeSchema),
+			coverage: applicationCoverageSchema,
+			limitations: z.array(boundedTextSchema)
+		});
+		javascriptApplicationGraphRecordSchema = javascriptApplicationGraphInputSchema.extend({ graph_id: prefixedDigestSchema("jag") });
+	})))();
+}
+
+//#endregion
+//#region dist/domain/javascript/javascriptApplicationGraph.js
+function* checkGraphContentSteps(graph, context) {
+	sortedUniqueIssue(graph.root_node_ids, ["root_node_ids"], "Root nodes", context);
+	sortedUniqueIssue(graph.nodes.map(({ node_id: id }) => id), ["nodes"], "Nodes", context);
+	sortedUniqueIssue(graph.edges.map(({ edge_id: id }) => id), ["edges"], "Edges", context);
+	sortedUniqueIssue(graph.limitations, ["limitations"], "Graph limitations", context);
+	sortedUniqueIssue(graph.coverage.limits.map(limitKey), ["coverage", "limits"], "Graph limits", context);
+	if (graph.coverage.status !== "complete" && graph.limitations.length === 0) context.addIssue({
+		code: "custom",
+		message: "Non-complete graph coverage requires an explicit limitation",
+		path: ["limitations"]
+	});
+	const nodesById = new Map(graph.nodes.map((node) => [node.node_id, node]));
+	for (const root of graph.root_node_ids) if (!nodesById.has(root)) context.addIssue({
+		code: "custom",
+		message: "Root identifier must name a graph node",
+		path: ["root_node_ids"]
+	});
+	for (const [index, node] of graph.nodes.entries()) {
+		if (index % 64 === 0) yield;
+		checkNode(node, index, context);
+	}
+	for (const [index, edge] of graph.edges.entries()) {
+		if (index % 64 === 0) yield;
+		const { edge_id: identifier, ...semantic } = edge;
+		if (identifier !== edgeId(semantic)) context.addIssue({
+			code: "custom",
+			message: "Edge identifier does not match its semantic content",
+			path: [
+				"edges",
+				index,
+				"edge_id"
+			]
+		});
+		if (!nodesById.has(edge.source_node_id) || !nodesById.has(edge.target_node_id)) context.addIssue({
+			code: "custom",
+			message: "Edge endpoints must name graph nodes",
+			path: ["edges", index]
+		});
+		if (edge.source_node_id === edge.target_node_id) context.addIssue({
+			code: "custom",
+			message: "Application graph edges cannot be self-referential",
+			path: ["edges", index]
+		});
+		if (edge.relation === "changed_from" && nodesById.get(edge.source_node_id)?.kind !== nodesById.get(edge.target_node_id)?.kind) context.addIssue({
+			code: "custom",
+			message: "changed_from endpoints must have the same node kind",
+			path: [
+				"edges",
+				index,
+				"relation"
+			]
+		});
+		checkEvidenceNormalization(edge.evidence, [
+			"edges",
+			index,
+			"evidence"
+		], context);
+	}
+}
+function* parseAndSealApplicationGraphSteps(container) {
+	const issues = [];
+	const parsed = {
+		...container,
+		nodes: yield* parseElementSteps(applicationGraphShape.nodes.element, container.nodes, ["nodes"], issues),
+		edges: yield* parseElementSteps(applicationGraphShape.edges.element, container.edges, ["edges"], issues)
+	};
+	if (issues.length > 0) throw new z.ZodError(issues);
+	const content = normalizeGraphInput(parsed);
+	let invalid = false;
+	yield* checkGraphContentSteps(content, { addIssue: () => {
+		invalid = true;
+	} });
+	if (invalid) {
+		javascriptApplicationGraphContentSchema.parse(content);
+		throw new TypeError("Application graph checks disagree with its schema");
+	}
+	return yield* sealValidatedApplicationGraphSteps({
+		...content,
+		graph_id: `jag_${yield* canonicalJsonDigestSteps(content)}`
+	});
+}
+function* sealValidatedApplicationGraphSteps(graph) {
+	yield* freezeOwnedJsonSnapshotSteps(graph);
+	validatedImmutableApplicationGraphs.add(graph);
+	return graph;
+}
+var OBSERVATION_IDENTIFIER_STRATEGY, EDGE_IDENTIFIER_STRATEGY, limitKey, normalizeLimits, normalizeEvidence, normalizeIdentity, nodeSemantic, nodeId, observationSemantic, observationId, edgeId, sortedUniqueIssue, checkEvidenceNormalization, sourceMapObservationMatchesIdentity, observationMatchesIdentity, checkNode, checkGraphContent, checkGraphInvariants, javascriptApplicationGraphSchema, javascriptApplicationGraphContentSchema, createJavaScriptApplicationNode, createJavaScriptApplicationEdge, createJavaScriptApplicationGraph, normalizeGraphInput, validatedImmutableApplicationGraphs, createImmutableJavaScriptApplicationGraphSteps, applicationGraphShape, applicationGraphContainerSchema, sealTransferredJavaScriptApplicationGraphSteps, isValidatedImmutableJavaScriptApplicationGraph, parseJavaScriptApplicationGraph, computeJavaScriptApplicationGraphSha256, serializeJavaScriptApplicationGraph;
+function init_javascriptApplicationGraph() {
+	return (init_javascriptApplicationGraph = __esmMin((() => {
+		init_zodCollectionSteps();
+		init_canonicalJsonDigestSteps();
+		init_comparisonSemantics();
+		init_canonicalDigest();
+		init_canonicalOrdering();
+		init_unicodeCodePointOrder();
+		init_immutableJson();
+		init_javascriptApplicationGraphSchemas();
+		OBSERVATION_IDENTIFIER_STRATEGY = {
+			strategy: "semantic-content-sha256",
+			stability: "observation-exact"
+		};
+		EDGE_IDENTIFIER_STRATEGY = {
+			strategy: "semantic-content-sha256",
+			stability: "relationship-exact"
+		};
+		limitKey = (limit) => canonicalJson(limit, "JavaScript Application Graph");
+		normalizeLimits = (limits) => [...new Map(limits.map((limit) => [limitKey(limit), limit])).values()].sort((left, right) => compareUnicodeCodePoints(limitKey(left), limitKey(right)));
+		normalizeEvidence = (evidence) => ({
+			...evidence,
+			coverage: {
+				...evidence.coverage,
+				limits: normalizeLimits(evidence.coverage.limits)
+			},
+			limitations: uniqueSorted(evidence.limitations),
+			evidence_ids: uniqueSorted(evidence.evidence_ids)
+		});
+		normalizeIdentity = (identity) => identity.strategy === "structural-fingerprint" ? {
+			...identity,
+			basis: uniqueSorted(identity.basis)
+		} : identity;
+		nodeSemantic = (node) => ({
+			kind: node.kind,
+			identity: node.identity
+		});
+		nodeId = (node) => `jag_node_${digestCanonicalValue(nodeSemantic(node), "JavaScript Application Graph")}`;
+		observationSemantic = (nodeIdentifier, observation) => ({
+			node_id: nodeIdentifier,
+			...observation
+		});
+		observationId = (nodeIdentifier, observation) => `jag_observation_${digestCanonicalValue(observationSemantic(nodeIdentifier, observation))}`;
+		edgeId = (edge) => `jag_edge_${digestCanonicalValue(edge, "JavaScript Application Graph")}`;
+		sortedUniqueIssue = (values, path, label, context) => {
+			for (let index = 1; index < values.length; index += 1) {
+				if (compareUnicodeCodePoints(values[index - 1] ?? "", values[index] ?? "") < 0) continue;
+				context.addIssue({
+					code: "custom",
+					message: `${label} must be sorted and unique by Unicode code point`,
+					path: [...path, index]
+				});
+				return;
+			}
+		};
+		checkEvidenceNormalization = (evidence, path, context) => {
+			sortedUniqueIssue(evidence.limitations, [...path, "limitations"], "Evidence limitations", context);
+			sortedUniqueIssue(evidence.evidence_ids, [...path, "evidence_ids"], "Evidence identifiers", context);
+			sortedUniqueIssue(evidence.coverage.limits.map(limitKey), [
+				...path,
+				"coverage",
+				"limits"
+			], "Evidence limits", context);
+			const runtimeLocation = evidence.location.available && evidence.location.value.kind === "runtime";
+			const staticAuthority = [
+				"artifact-bytes",
+				"ast-static-analysis",
+				"static-relationship-inference",
+				"native-analysis-provider"
+			].includes(evidence.authority);
+			if (runtimeLocation && staticAuthority) context.addIssue({
+				code: "custom",
+				message: "Static and native authorities cannot claim a runtime location",
+				path: [...path, "location"]
+			});
+		};
+		sourceMapObservationMatchesIdentity = (identity, observation) => {
+			const { evidence, source_map_reference: reference } = observation;
+			const sourceDigests = [observation.properties.content_sha256, observation.properties.source_sha256];
+			const hasKnownSourceDigest = identity.source_sha256 !== null;
+			const sourceDigestMatches = sourceDigests.every((digest) => digest === undefined || digest === null || digest === identity.source_sha256) && (!hasKnownSourceDigest || sourceDigests.includes(identity.source_sha256));
+			const contentAvailabilityMatches = (observation.properties.content_available !== true || hasKnownSourceDigest) && (observation.properties.content_available !== false || !hasKnownSourceDigest);
+			return sourceDigestMatches && contentAvailabilityMatches && reference !== null && evidence.state === "observed" && evidence.artifact.available && evidence.artifact.sha256 === identity.source_map_sha256 && reference.source_name === identity.original_source && reference.source_root === identity.source_root && evidence.location.available && evidence.location.value.kind === "artifact-path" && reference.map_path === evidence.location.value.path;
+		};
+		observationMatchesIdentity = (node, observation) => {
+			const { identity } = node;
+			const { evidence } = observation;
+			if (identity.strategy === "content-digest") return evidence.state === "observed" && evidence.artifact.available && evidence.artifact.sha256 === identity.sha256;
+			if (identity.strategy === "source-map-original") return sourceMapObservationMatchesIdentity(identity, observation);
+			if (identity.strategy === "canonical-path") return evidence.artifact.available && evidence.artifact.sha256 === identity.artifact_sha256 && evidence.location.available && evidence.location.value.kind === "artifact-path" && evidence.location.value.path === identity.path;
+			if (identity.strategy === "artifact-local-key") return evidence.artifact.available && evidence.artifact.sha256 === identity.artifact_sha256;
+			if (identity.strategy === "runtime-instance") {
+				if (!["passive-cdp-runtime", "controlled-replay"].includes(evidence.authority) || !evidence.location.available || evidence.location.value.kind !== "runtime") return false;
+				const location = evidence.location.value;
+				return location.capture_sha256 === identity.capture_sha256 && [
+					location.target_key,
+					location.frame_key,
+					location.script_key
+				].includes(identity.runtime_key);
+			}
+			if (identity.strategy === "structural-fingerprint") return evidence.state === "inferred";
+			return evidence.state === "observed";
+		};
+		checkNode = (node, index, context) => {
+			if (node.node_id !== nodeId(node)) context.addIssue({
+				code: "custom",
+				message: "Node identifier does not match its kind and identity",
+				path: [
+					"nodes",
+					index,
+					"node_id"
+				]
+			});
+			if (node.identity.strategy === "structural-fingerprint" && canonicalJson(node.identity.basis, "JavaScript Application Graph") !== canonicalJson(uniqueSorted(node.identity.basis), "JavaScript Application Graph")) context.addIssue({
+				code: "custom",
+				message: "Structural fingerprint basis must be sorted and unique",
+				path: [
+					"nodes",
+					index,
+					"identity",
+					"basis"
+				]
+			});
+			sortedUniqueIssue(node.observations.map(({ observation_id: id }) => id), [
+				"nodes",
+				index,
+				"observations"
+			], "Node observations", context);
+			for (const [observationIndex, observation] of node.observations.entries()) {
+				const { observation_id: identifier, ...semantic } = observation;
+				if (identifier !== observationId(node.node_id, semantic)) context.addIssue({
+					code: "custom",
+					message: "Observation identifier does not match its semantic content",
+					path: [
+						"nodes",
+						index,
+						"observations",
+						observationIndex,
+						"observation_id"
+					]
+				});
+				if (node.identity.strategy === "source-map-original" && !observationMatchesIdentity(node, observation)) context.addIssue({
+					code: "custom",
+					message: "Source-map observation must retain its exact declaration and map location",
+					path: [
+						"nodes",
+						index,
+						"observations",
+						observationIndex,
+						"source_map_reference"
+					]
+				});
+				checkEvidenceNormalization(observation.evidence, [
+					"nodes",
+					index,
+					"observations",
+					observationIndex,
+					"evidence"
+				], context);
+			}
+			if (!node.observations.some((observation) => observationMatchesIdentity(node, observation))) context.addIssue({
+				code: "custom",
+				message: "Node identity is not supported by a compatible observation",
+				path: [
+					"nodes",
+					index,
+					"identity"
+				]
+			});
+		};
+		checkGraphContent = (graph, context) => {
+			const steps = checkGraphContentSteps(graph, context);
+			while (steps.next().done !== true);
+		};
+		checkGraphInvariants = (graph, context) => {
+			checkGraphContent(graph, context);
+			const { graph_id: identifier, ...semantic } = graph;
+			if (identifier !== `jag_${digestCanonicalValue(semantic, "JavaScript Application Graph")}`) context.addIssue({
+				code: "custom",
+				message: "Graph identifier does not match its semantic content",
+				path: ["graph_id"]
+			});
+		};
+		javascriptApplicationGraphSchema = javascriptApplicationGraphRecordSchema.superRefine(checkGraphInvariants);
+		javascriptApplicationGraphContentSchema = javascriptApplicationGraphInputSchema.superRefine(checkGraphContent);
+		createJavaScriptApplicationNode = (input) => {
+			const parsed = applicationNodeInputSchema.parse(input);
+			for (const observation of parsed.observations) freezeJsonSnapshot(observation.properties);
+			const identity = normalizeIdentity(parsed.identity);
+			const identifier = nodeId({
+				kind: parsed.kind,
+				identity
+			});
+			const observations = parsed.observations.map((observation) => {
+				const semantic = {
+					...observation,
+					evidence: normalizeEvidence(observation.evidence),
+					identifier_strategy: OBSERVATION_IDENTIFIER_STRATEGY
+				};
+				return applicationNodeObservationSchema.parse({
+					...semantic,
+					observation_id: observationId(identifier, semantic)
+				});
+			}).sort((left, right) => compareUnicodeCodePoints(left.observation_id, right.observation_id));
+			return applicationNodeSchema.parse({
+				node_id: identifier,
+				kind: parsed.kind,
+				identity,
+				observations
+			});
+		};
+		createJavaScriptApplicationEdge = (input) => {
+			const parsed = applicationEdgeInputSchema.parse(input);
+			freezeJsonSnapshot(parsed.properties);
+			const semantic = {
+				...parsed,
+				evidence: normalizeEvidence(parsed.evidence),
+				identifier_strategy: EDGE_IDENTIFIER_STRATEGY
+			};
+			return applicationEdgeSchema.parse({
+				...semantic,
+				edge_id: edgeId(semantic)
+			});
+		};
+		createJavaScriptApplicationGraph = (input) => {
+			const semantic = normalizeGraphInput(javascriptApplicationGraphInputSchema.parse(input));
+			const content = javascriptApplicationGraphContentSchema.parse(semantic);
+			return {
+				...content,
+				graph_id: `jag_${digestCanonicalValue(content, "JavaScript Application Graph")}`
+			};
+		};
+		normalizeGraphInput = (parsed) => ({
+			...parsed,
+			root_node_ids: uniqueSorted(parsed.root_node_ids),
+			nodes: [...parsed.nodes].sort((left, right) => compareUnicodeCodePoints(left.node_id, right.node_id)),
+			edges: [...parsed.edges].sort((left, right) => compareUnicodeCodePoints(left.edge_id, right.edge_id)),
+			coverage: {
+				...parsed.coverage,
+				limits: normalizeLimits(parsed.coverage.limits)
+			},
+			limitations: uniqueSorted(parsed.limitations)
+		});
+		validatedImmutableApplicationGraphs = new WeakSet();
+		createImmutableJavaScriptApplicationGraphSteps = (input) => sealValidatedApplicationGraphSteps(createJavaScriptApplicationGraph(input));
+		applicationGraphShape = javascriptApplicationGraphInputSchema.shape;
+		applicationGraphContainerSchema = javascriptApplicationGraphInputSchema.extend({
+			nodes: arrayContainerSchema(applicationGraphShape.nodes),
+			edges: arrayContainerSchema(applicationGraphShape.edges)
+		});
+		sealTransferredJavaScriptApplicationGraphSteps = (input) => parseAndSealApplicationGraphSteps(applicationGraphContainerSchema.parse(input));
+		isValidatedImmutableJavaScriptApplicationGraph = (value) => typeof value === "object" && value !== null && validatedImmutableApplicationGraphs.has(value);
+		parseJavaScriptApplicationGraph = (input) => javascriptApplicationGraphSchema.parse(input);
+		computeJavaScriptApplicationGraphSha256 = (input) => digestCanonicalValue(parseJavaScriptApplicationGraph(input), "JavaScript Application Graph");
+		serializeJavaScriptApplicationGraph = (input) => canonicalJson(parseJavaScriptApplicationGraph(input), "JavaScript Application Graph");
+	})))();
+}
+
+//#endregion
+export { JAVASCRIPT_APPLICATION_NODE_KINDS, applicationGraphEvidenceContextSchema, applicationGraphEvidenceLocationSchema, applicationGraphEvidenceSchema, arrayContainerSchema, completeApplicationCoverage, createImmutableJavaScriptApplicationGraphSteps, createJavaScriptApplicationEdge, createJavaScriptApplicationGraph, createJavaScriptApplicationNode, init_javascriptApplicationEvidenceSchemas, init_javascriptApplicationGraph, init_javascriptApplicationGraphSchemas, init_javascriptSourceMapPaths, init_zodCollectionSteps, isValidatedImmutableJavaScriptApplicationGraph, javascriptApplicationGraphSchema, parseElementSteps, partialApplicationCoverage, resolveJavaScriptSourceMapReference, sealTransferredJavaScriptApplicationGraphSteps, truncatedApplicationCoverage };