reverseport 0.0.0-stage → 1.2.0

package/dist/domain/javascript/electronWrappedCallPaths.js

@@ -0,0 +1,399 @@
+import * as t from "@babel/types";
+import { JavaScriptSymbolicBindings } from "./javascriptSymbolicBindings.js";
+import { symbolicVariants, symbolicTruth, symbolicUnknown, } from "./javascriptSymbolicValues.js";
+import { childNodes, traverseJavaScriptAst, } from "./javascriptSemanticTraversal.js";
+import { range, calleeName } from "./javascriptStaticAnalysisHelpers.js";
+import { ipcDescriptor } from "./electronStaticAnalysisIpc.js";
+import { symbolicDefiniteExit, symbolicLogicalRight, } from "./javascriptSymbolicControlFlow.js";
+const callLabel = (node) => t.isSequenceExpression(node)
+    ? callLabel(node.expressions.at(-1) ?? node)
+    : calleeName(node) || "local call";
+/** Substitutes inert wrapper syntax; every emitted path remains a candidate. */
+export const collectElectronWrappedCallPaths = (program, state, source, accumulator, identity) => {
+    // Bounds repeated interprocedural expansion independently of bundle bytes.
+    // Exhaustion is reported as unknown coverage, never as a negative finding.
+    let remainingVisits = 1_000_000;
+    const resolver = new JavaScriptSymbolicBindings(state, program, identity);
+    const paths = [];
+    const seen = new Set();
+    const step = (node, kind, label) => {
+        const module = accumulator.moduleRangeIndex.find(node.start);
+        return {
+            kind,
+            label,
+            location: range(node),
+            module_key: module?.key ?? null,
+            module_runtime: module?.runtime ?? null,
+        };
+    };
+    const condition = (context, node, positive = true) => {
+        const expression = source
+            .slice(node.start ?? 0, node.end ?? 0)
+            .slice(0, 512);
+        return {
+            ...context,
+            conditions: [
+                ...context.conditions,
+                {
+                    expression: positive === "nullish"
+                        ? `(${expression}) === null || (${expression}) === undefined`
+                        : positive === "not-nullish"
+                            ? `(${expression}) !== null && (${expression}) !== undefined`
+                            : positive
+                                ? expression
+                                : `!(${expression})`,
+                    location: range(node),
+                },
+            ],
+        };
+    };
+    const metadataContext = (context, value) => {
+        if (value.conditionUnresolved) {
+            accumulator.unknownFindings += 1;
+            return null;
+        }
+        return (value.conditions?.reduce((current, branch) => condition(current, branch.node, branch.positive), context) ?? context);
+    };
+    const hasConditions = (value) => symbolicVariants(value).some((variant) => variant.conditions?.length);
+    const emit = (context, node, terminal, channel = context.channel) => {
+        if (context.entryKind === null)
+            return;
+        const path = {
+            entry_kind: context.entryKind,
+            entry: context.entry,
+            channel,
+            terminal,
+            resolution: "candidate",
+            steps: [...context.steps, step(node, "terminal", terminal)],
+            conditions: context.conditions,
+        };
+        const key = JSON.stringify(path);
+        if (seen.has(key))
+            return;
+        seen.add(key);
+        paths.push(path);
+    };
+    const functionBody = (fn, args, context, invocationNode) => {
+        if (context.active.has(fn.node))
+            return;
+        if (fn.conditionUnresolved === true) {
+            accumulator.unknownFindings += 1;
+            return;
+        }
+        const name = (t.isFunctionExpression(fn.node) || t.isFunctionDeclaration(fn.node)) &&
+            fn.node.id
+            ? fn.node.id.name
+            : "closure";
+        walk(fn.node.body, resolver.bind(fn, args, invocationNode), {
+            ...context,
+            steps: [
+                ...context.steps,
+                ...fn.origins.map((n) => step(n, "factory", t.isCallExpression(n) ? callLabel(n.callee) : "factory")),
+                step(fn.node, "function", name),
+            ],
+            active: new Set([...context.active, fn.node]),
+        });
+    };
+    const ipc = (node, descriptor, args, context, endpoint, guardedDispatch) => {
+        const first = args[0];
+        if (first?.kind !== "literal" || typeof first.value !== "string") {
+            accumulator.unknownFindings += 1;
+            return;
+        }
+        const channelContext = metadataContext(context, first);
+        if (!channelContext)
+            return;
+        const handlerValue = args[1] ?? symbolicUnknown("missing handler");
+        const handlerContext = metadataContext(channelContext, handlerValue);
+        if (!handlerContext)
+            return;
+        const channel = first.value;
+        const location = range(node);
+        const invocationLocation = JSON.stringify(range(context.entryNode)) === JSON.stringify(location)
+            ? undefined
+            : range(context.entryNode);
+        const findingContext = {
+            module_key: null,
+            location,
+            ...(invocationLocation === undefined
+                ? {}
+                : { invocation_location: invocationLocation }),
+        };
+        const handlers = symbolicVariants(handlerValue);
+        // A channel registration must not acquire one arbitrary handler from a union.
+        // Keep the unresolved registration so it still competes with other handlers.
+        const fn = handlers.length === 1 && handlers[0]?.kind === "function"
+            ? handlers[0]
+            : undefined;
+        const handlerNode = node.arguments[1];
+        const finding = descriptor.mode === "send" || descriptor.mode === "invoke"
+            ? {
+                ...descriptor,
+                channel,
+                channel_expression: null,
+                handler_kind: null,
+                handler_location: null,
+                ...findingContext,
+            }
+            : fn
+                ? {
+                    ...descriptor,
+                    channel,
+                    channel_expression: null,
+                    handler_kind: "inline-function",
+                    handler_location: range(fn.node),
+                    ...findingContext,
+                }
+                : handlerNode
+                    ? {
+                        ...descriptor,
+                        channel,
+                        channel_expression: null,
+                        handler_kind: "dynamic-expression",
+                        handler_location: range(handlerNode),
+                        ...findingContext,
+                    }
+                    : {
+                        ...descriptor,
+                        channel,
+                        channel_expression: null,
+                        handler_kind: "missing",
+                        handler_location: null,
+                        ...findingContext,
+                    };
+        // A fully observed transmission stays one source fact when its callback is
+        // traced. Registrations retain invocation identity because handlers compete.
+        const duplicate = accumulator.ipc.some(({ value }) => value.side === finding.side &&
+            value.operation === finding.operation &&
+            value.channel === channel &&
+            JSON.stringify(value.location) === JSON.stringify(location) &&
+            ((value.resolution_basis === undefined &&
+                (value.mode === "send" || value.mode === "invoke")) ||
+                JSON.stringify(value.invocation_location) ===
+                    JSON.stringify(invocationLocation)));
+        const findingGuarded = context.conditions.length > 0 || hasConditions(first) || guardedDispatch;
+        if (!duplicate && !findingGuarded) {
+            accumulator.ipc.push({
+                offset: node.start ?? -1,
+                value: { ...finding, resolution_basis: "wrapper-substitution" },
+            });
+            if (descriptor.mode !== "send" && descriptor.mode !== "invoke" && !fn)
+                accumulator.unknownFindings += 1;
+        }
+        else if (findingGuarded)
+            accumulator.unknownFindings += 1;
+        if (descriptor.mode === "send" || descriptor.mode === "invoke") {
+            emit(channelContext, node, endpoint, channel);
+            return;
+        }
+        if (descriptor.side === "main" && fn)
+            functionBody(fn, [
+                { kind: "external", path: ["ipc-event"] },
+                symbolicUnknown("IPC payload"),
+            ], {
+                ...handlerContext,
+                entryKind: "ipc-handler",
+                entry: channel,
+                channel,
+                steps: [...context.steps, step(node, "ipc", endpoint)],
+            }, node);
+    };
+    const bridge = (node, args, context, guardedDispatch) => {
+        const key = args[0];
+        const object = args[1];
+        if (key?.kind !== "literal" || typeof key.value !== "string" || !object) {
+            accumulator.unknownFindings += 1;
+            return;
+        }
+        const keyContext = metadataContext(context, key);
+        if (!keyContext || !metadataContext(keyContext, object))
+            return;
+        const members = [...resolver.members(object)].sort();
+        const location = range(node);
+        const existing = accumulator.contextBridgeApis.find(({ value }) => JSON.stringify(value.location) === JSON.stringify(location));
+        const finding = {
+            world: "main",
+            world_id: null,
+            api_key: key.value,
+            api_key_expression: null,
+            api_status: "dynamic",
+            resolution_basis: "wrapper-substitution",
+            members,
+            unknown_members: resolver.unknownMembers(object),
+            module_key: null,
+            location,
+        };
+        // This report shape has no predicate field, so a guarded world or object
+        // cannot be recorded as an unconditional exposure fact.
+        const guardedKey = hasConditions(key);
+        const guardedObject = hasConditions(object);
+        const guarded = context.conditions.length > 0 ||
+            guardedKey ||
+            guardedObject ||
+            guardedDispatch;
+        if (guarded)
+            accumulator.unknownFindings += 1;
+        // Existing entries are raw syntax observations and remain valid even when
+        // symbolic substitution can only describe this call under a predicate.
+        if (!guarded && existing)
+            (existing.value.api_status !== "object-literal" ||
+                existing.value.unknown_members > 0) &&
+                accumulator.contextBridgeApis.splice(accumulator.contextBridgeApis.indexOf(existing), 1, { offset: node.start ?? -1, value: finding });
+        else if (!guarded)
+            accumulator.contextBridgeApis.push({
+                offset: node.start ?? -1,
+                value: finding,
+            });
+        for (const name of members) {
+            const value = resolver.property(object, name);
+            for (const fn of symbolicVariants(value))
+                if (fn.kind === "function") {
+                    const memberContext = metadataContext(keyContext, fn);
+                    if (!memberContext)
+                        continue;
+                    functionBody(fn, fn.node.params.map(() => symbolicUnknown("public API argument")), {
+                        ...memberContext,
+                        entryNode: node,
+                        entryKind: "bridge-member",
+                        entry: `${key.value}.${name}`,
+                        channel: null,
+                        steps: [step(node, "exposure", `${key.value}.${name}`)],
+                        active: new Set(),
+                    }, node);
+                }
+        }
+    };
+    const call = (node, env, context) => {
+        const value = resolver.evaluate(node.callee, env);
+        const args = resolver.arguments(node, env);
+        for (const callee of symbolicVariants(value)) {
+            const branchContext = metadataContext(context, callee);
+            if (!branchContext)
+                continue;
+            if (callee.kind === "function") {
+                functionBody(callee, args, {
+                    ...branchContext,
+                    steps: [
+                        ...branchContext.steps,
+                        step(node, "call", callLabel(node.callee)),
+                    ],
+                }, node);
+            }
+            else if (callee.kind === "external") {
+                const path = callee.path;
+                const endpoint = path.join(".");
+                if (identity.intactExport(path)) {
+                    const descriptor = ipcDescriptor(path.slice(1));
+                    if (descriptor)
+                        ipc(node, descriptor, args, branchContext, endpoint, hasConditions(callee));
+                    else if (path.slice(1).join(".") === "contextBridge.exposeInMainWorld")
+                        bridge(node, args, branchContext, hasConditions(callee));
+                    else if (path[1] === "clipboard")
+                        emit(branchContext, node, endpoint);
+                }
+                else if ((path[0] === "navigator" && path[1] === "clipboard") ||
+                    (path[0] === "ipc-event" && path[1] === "sender"))
+                    emit(branchContext, node, endpoint);
+            }
+        }
+    };
+    function walk(node, env, context) {
+        if (--remainingVisits < 0 || t.isFunction(node) || t.isClass(node))
+            return;
+        if (t.isBlockStatement(node)) {
+            let next = context;
+            for (const statement of node.body) {
+                walk(statement, env, next);
+                if (symbolicDefiniteExit(statement))
+                    break;
+                if (t.isIfStatement(statement)) {
+                    const truth = symbolicTruth(resolver.evaluate(statement.test, env));
+                    if (truth !== undefined) {
+                        if (symbolicDefiniteExit(truth ? statement.consequent : statement.alternate))
+                            break;
+                    }
+                    else if (symbolicDefiniteExit(statement.consequent))
+                        next = condition(next, statement.test, false);
+                    else if (symbolicDefiniteExit(statement.alternate))
+                        next = condition(next, statement.test);
+                }
+            }
+            return;
+        }
+        if (t.isIfStatement(node) || t.isConditionalExpression(node)) {
+            const truth = symbolicTruth(resolver.evaluate(node.test, env));
+            if (truth !== false)
+                walk(node.consequent, env, truth === undefined ? condition(context, node.test) : context);
+            if (truth !== true && node.alternate)
+                walk(node.alternate, env, truth === undefined ? condition(context, node.test, false) : context);
+            return;
+        }
+        if (t.isLogicalExpression(node)) {
+            walk(node.left, env, context);
+            const right = symbolicLogicalRight(node.operator, resolver.evaluate(node.left, env));
+            if (right === false)
+                return;
+            walk(node.right, env, right === undefined
+                ? condition(context, node.left, node.operator === "??" ? "nullish" : node.operator === "&&")
+                : context);
+            return;
+        }
+        if (t.isCallExpression(node) || t.isOptionalCallExpression(node))
+            call(node, env, context);
+        for (const child of childNodes(node))
+            walk(child, env, context);
+    }
+    traverseJavaScriptAst(program, {
+        enter: (node) => {
+            if (!t.isCallExpression(node) && !t.isOptionalCallExpression(node))
+                return;
+            if (!t.isStringLiteral(node.arguments[0]))
+                return;
+            const env = resolver.environmentAt(node);
+            let context = {
+                entryNode: node,
+                entry: "",
+                entryKind: null,
+                channel: null,
+                steps: [],
+                conditions: [],
+                active: new Set(),
+            };
+            for (let child = node, parent = state.parentsByNode.get(child); parent && !t.isFunction(parent); child = parent, parent = state.parentsByNode.get(child)) {
+                if (t.isIfStatement(parent) || t.isConditionalExpression(parent)) {
+                    if (child === parent.test)
+                        continue;
+                    const truth = symbolicTruth(resolver.evaluate(parent.test, env));
+                    const positive = child === parent.consequent;
+                    if (truth !== undefined && truth !== positive)
+                        return;
+                    if (truth === undefined)
+                        context = condition(context, parent.test, positive);
+                }
+                else if (t.isLogicalExpression(parent) && child === parent.right) {
+                    const right = symbolicLogicalRight(parent.operator, resolver.evaluate(parent.left, env));
+                    if (right === false)
+                        return;
+                    if (right === undefined)
+                        context = condition(context, parent.left, parent.operator === "??" ? "nullish" : parent.operator === "&&");
+                }
+                else if (t.isBlockStatement(parent)) {
+                    const index = parent.body.findIndex((statement) => statement === child);
+                    if (index >= 0 &&
+                        parent.body
+                            .slice(0, index)
+                            .some((statement) => symbolicDefiniteExit(statement)))
+                        return;
+                }
+            }
+            call(node, env, context);
+        },
+    });
+    if (remainingVisits < 0 || resolver.truncated) {
+        accumulator.unknownFindings += 1;
+        accumulator.electronCallPathLimitReached = true;
+    }
+    if (resolver.unresolved)
+        accumulator.unknownFindings += 1;
+    return paths;
+};

package/dist/domain/javascript/htmlArtifactReferences.js

@@ -0,0 +1,40 @@
+import { defaultTreeAdapter, parse, } from "parse5";
+/** Extract inert HTML script references and the first document base href. */
+export const htmlArtifactReferences = (text) => {
+    const pending = [
+        parse(text, { sourceCodeLocationInfo: true }),
+    ];
+    const scripts = [];
+    let baseHref = null;
+    while (pending.length > 0) {
+        const node = pending.pop();
+        if (node === undefined)
+            continue;
+        if (defaultTreeAdapter.isElementNode(node) &&
+            node.namespaceURI === "http://www.w3.org/1999/xhtml") {
+            if (node.tagName === "base" && baseHref === null) {
+                const href = node.attrs.find(({ name }) => name === "href");
+                if (href !== undefined)
+                    baseHref = href.value;
+            }
+            if (node.tagName === "script") {
+                const src = node.attrs.find(({ name }) => name === "src");
+                const location = node.sourceCodeLocation?.startTag;
+                if (src !== undefined && src.value !== "" && location !== undefined) {
+                    scripts.push({
+                        scriptPath: src.value,
+                        startOffset: location.startOffset,
+                        endOffset: location.endOffset,
+                    });
+                }
+            }
+        }
+        // Template content belongs to a separate inert document fragment. Only
+        // traverse the actual document children, without recursion on deep input.
+        if ("childNodes" in node) {
+            for (const child of node.childNodes.toReversed())
+                pending.push(child);
+        }
+    }
+    return { baseHref, scripts };
+};

package/dist/domain/javascript/javascriptAnalysisResourceControls.js

@@ -0,0 +1,65 @@
+import { z } from "zod";
+/** Shared operational defaults for the isolated source-analysis boundary. */
+export const JAVASCRIPT_ANALYSIS_RESOURCE_DEFAULTS = {
+    heapMb: 1024,
+    timeoutMs: 300_000,
+    semanticNodes: 100_000,
+    semanticNodesPerFile: 20_000,
+};
+/** Maximum caller-selected node capacity; heap and transfer admission still apply. */
+export const JAVASCRIPT_SEMANTIC_NODE_MAXIMUM = 1_000_000;
+/** Project observed execution limits without inventing unmeasured values. */
+export const javaScriptAnalysisCoverageLimits = (limits) => {
+    const result = [];
+    for (const key of [
+        "worker_heap_limit_bytes",
+        "worker_process_memory_limit_bytes",
+        "worker_timeout_ms",
+        "parent_result_budget_bytes",
+        "parent_available_result_budget_bytes",
+        "semantic_result_budget_bytes",
+        "transfer_record_bytes",
+        "transfer_file_bytes",
+    ]) {
+        const value = limits?.[key];
+        if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0)
+            continue;
+        result.push({
+            name: `javascript_analysis_${key}`,
+            value,
+            unit: key.endsWith("_ms") ? "milliseconds" : "bytes",
+        });
+    }
+    return result;
+};
+/** Optional operational choices; omission keeps them out of Evidence parameters. */
+export const javaScriptAnalysisResourceControlsSchema = z.strictObject({
+    max_semantic_nodes: z
+        .number()
+        .int()
+        .min(1)
+        .max(JAVASCRIPT_SEMANTIC_NODE_MAXIMUM)
+        .optional()
+        .describe("Maximum retained semantic nodes across the application; defaults to 100000. Worker heap and parent result admission remain enforced."),
+    max_semantic_nodes_per_file: z
+        .number()
+        .int()
+        .min(1)
+        .max(JAVASCRIPT_SEMANTIC_NODE_MAXIMUM)
+        .optional()
+        .describe("Maximum retained semantic nodes per source file; defaults to 20000, additionally bounded by max_semantic_nodes and memory/transfer limits."),
+    max_heap_mb: z
+        .number()
+        .int()
+        .min(128)
+        .max(16_384)
+        .optional()
+        .describe("Maximum V8 old-space heap in MiB for the isolated JavaScript source analyzer; defaults to 1024. This does not change the CLI/MCP process heap. When REA runs on Bun, which ignores V8 heap flags, Windows instead limits the analyzer's committed memory to this budget plus a 512 MiB runtime reserve; other Bun hosts enforce no limit."),
+    analysis_timeout_ms: z
+        .number()
+        .int()
+        .min(1)
+        .max(2_147_483_647)
+        .optional()
+        .describe("Maximum startup, analysis and transfer time per JavaScript source, in milliseconds; defaults to 300000. On timeout, return collected partial Evidence and stop the analysis."),
+});

package/dist/domain/javascript/javascriptApplicationAnalysis.js

@@ -0,0 +1,146 @@
+import { z } from "zod";
+import { javascriptApplicationGraphSchema, isValidatedImmutableJavaScriptApplicationGraph, } from "./javascriptApplicationGraph.js";
+import { javaScriptSemanticGraphSchema, isValidatedImmutableJavaScriptSemanticGraph, } from "./javascriptSemanticGraph.js";
+import { digestSchema } from "../digests.js";
+import { prefixedDigestSchema } from "../digests.js";
+import { integrityContradictionSchema } from "../artifactGraph.js";
+import { artifactIntegrityPolicySchema } from "../artifactIntegrityPolicy.js";
+import { localPathStringSchema } from "../localPath.js";
+import { javaScriptAnalysisResourceControlsSchema } from "./javascriptAnalysisResourceControls.js";
+import { javaScriptSourcePathsSchema, javaScriptSourceSelectionSchema, } from "./javascriptSourceSelection.js";
+const countSchema = z.number().int().min(0);
+/** Public target-free request for static JavaScript application analysis. */
+export const analyzeJavaScriptApplicationInputSchema = z.strictObject({
+    input_path: localPathStringSchema,
+    format: z.enum(["auto", "asar", "directory"]).default("auto"),
+    integrity_policy: artifactIntegrityPolicySchema,
+    source_paths: javaScriptSourcePathsSchema.optional(),
+    ...javaScriptAnalysisResourceControlsSchema.shape,
+});
+/** Compact counts for the high-level Electron architecture/security surface. */
+const electronBoundarySummarySchema = z.strictObject({
+    browser_windows: countSchema,
+    explicit_web_preferences: countSchema,
+    preload_entrypoints: countSchema,
+    context_bridge_apis: countSchema,
+    exposed_api_members: countSchema,
+    ipc: z.strictObject({
+        operations: countSchema,
+        literal_channels: countSchema,
+        dynamic_channel_operations: countSchema,
+        renderer_transmissions: countSchema,
+        renderer_listeners: countSchema,
+        main_handlers: countSchema,
+        paired_renderer_transmissions: countSchema,
+        ambiguous_renderer_transmissions: countSchema,
+        unpaired_literal_renderer_transmissions: countSchema,
+    }),
+    sender_validation_observations: countSchema,
+    utility_processes: countSchema,
+    resolved_utility_entrypoints: countSchema,
+    native_addon_bindings: countSchema,
+    resolved_native_addon_bindings: countSchema,
+});
+const reconstructionStatisticsSchema = z.strictObject({
+    relevant_files: countSchema,
+    nested_asar_containers: countSchema,
+    text_bytes_read: countSchema,
+    invalid_utf8_files: countSchema,
+    parsed_javascript_files: countSchema,
+    visited_ast_nodes: countSchema,
+    findings: countSchema,
+    modules: countSchema,
+    parse_failures: countSchema,
+});
+const applicationAnalysisResultShape = z.strictObject({
+    input_path: z.string().min(1),
+    format: z.enum(["asar", "directory"]),
+    root_artifact_sha256: digestSchema,
+    inventory_manifest_id: prefixedDigestSchema("agm"),
+    inventory_graph_sha256: digestSchema,
+    integrity_contradictions: z.array(integrityContradictionSchema),
+    source_selection: javaScriptSourceSelectionSchema.exactOptional(),
+    graph: javascriptApplicationGraphSchema,
+    summary: electronBoundarySummarySchema,
+    statistics: reconstructionStatisticsSchema,
+    limitations: z.array(z.string().min(1)),
+    semantic_graph: javaScriptSemanticGraphSchema,
+});
+function* checkApplicationBindingsSteps(result, context) {
+    if (result.semantic_graph.application_graph_id !== result.graph.graph_id)
+        context.addIssue({
+            code: "custom",
+            path: ["semantic_graph", "application_graph_id"],
+            message: "Semantic graph must commit the containing application graph",
+        });
+    if (result.semantic_graph.root_artifact_sha256 !== result.root_artifact_sha256)
+        context.addIssue({
+            code: "custom",
+            path: ["semantic_graph", "root_artifact_sha256"],
+            message: "Semantic graph must commit the containing root artifact",
+        });
+    const applicationNodeIds = new Set();
+    let examined = 0;
+    try {
+        for (const node of result.graph.nodes) {
+            applicationNodeIds.add(node.node_id);
+            if (++examined === 4096) {
+                examined = 0;
+                yield;
+            }
+        }
+        for (const [nodeIndex, node] of result.semantic_graph.nodes.entries()) {
+            if (++examined === 4096) {
+                examined = 0;
+                yield;
+            }
+            for (const [identifierIndex, identifier,] of node.application_node_ids.entries()) {
+                if (!applicationNodeIds.has(identifier))
+                    context.addIssue({
+                        code: "custom",
+                        path: [
+                            "semantic_graph",
+                            "nodes",
+                            nodeIndex,
+                            "application_node_ids",
+                            identifierIndex,
+                        ],
+                        message: "Semantic node references an absent application node",
+                    });
+                if (++examined === 4096) {
+                    examined = 0;
+                    yield;
+                }
+            }
+        }
+    }
+    finally {
+        applicationNodeIds.clear();
+    }
+}
+/** JavaScript application analysis with an authenticated semantic companion. */
+export const javascriptApplicationAnalysisResultSchema = applicationAnalysisResultShape.superRefine((result, context) => {
+    const steps = checkApplicationBindingsSteps(result, context);
+    while (!steps.next().done) {
+        // Public/imported results still receive complete synchronous validation.
+    }
+});
+const ownedAnalysisResultShape = applicationAnalysisResultShape.extend({
+    graph: z.custom(isValidatedImmutableJavaScriptApplicationGraph),
+    semantic_graph: z.custom(isValidatedImmutableJavaScriptSemanticGraph),
+});
+/** Reuse exact owned graphs while validating metadata and cross-graph bindings. */
+export function* parseOwnedJavaScriptApplicationAnalysisSteps(input) {
+    const prepared = ownedAnalysisResultShape.safeParse(input);
+    if (!prepared.success)
+        return javascriptApplicationAnalysisResultSchema.parse(input);
+    const issues = [];
+    yield* checkApplicationBindingsSteps(prepared.data, {
+        addIssue: (issue) => {
+            issues.push(issue);
+        },
+    });
+    if (issues.length > 0)
+        throw new z.ZodError(issues);
+    return prepared.data;
+}