reverseport 0.0.0-stage → 1.2.0

package/dist/domain/staticRuntimeCorrelation.js

@@ -0,0 +1,334 @@
+import { createHash } from "node:crypto";
+import canonicalize from "canonicalize";
+import { z } from "zod";
+import { artifactComparisonResultSchema } from "./artifactComparison.js";
+import { uniqueSorted } from "./canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
+import { comparisonSourceEvidenceIds } from "./comparisonSourceEvidence.js";
+import { evidenceSchema, parseEvidence } from "./evidence.js";
+import { functionComparisonResultSchema } from "./functionComparisonSchemas.js";
+import { PROCESS_PROVIDER, isProcessEvidenceProvider, } from "./process/processEvidenceProvider.js";
+import { comparisonStatusSchema, processCaptureComparisonSchema, } from "./process/processComparison.js";
+import { PROCESS_COMPARISON_DIMENSIONS } from "./process/processComparison.js";
+import { prefixedDigestSchema } from "./../domain/digests.js";
+const evidenceIdSchema = prefixedDigestSchema("ev");
+const functionDimensionSchema = z.enum([
+    "identity",
+    "pseudocode",
+    "assembly",
+    "comments",
+    "calls",
+    "references",
+    "strings_names",
+    "cfg",
+]);
+const runtimeDimensionSchema = z.enum(PROCESS_COMPARISON_DIMENSIONS);
+const expectedPatternSchema = z.enum([
+    "cochanged",
+    "static_only",
+    "runtime_only",
+    "both_unchanged",
+]);
+const observedPatternSchema = z.enum([
+    ...expectedPatternSchema.options,
+    "unknown",
+    "truncated",
+]);
+const artifactSelectorSchema = z
+    .object({
+    kind: z.literal("artifact"),
+    logical_path: z.string().min(1),
+})
+    .strict();
+const functionSelectorSchema = z
+    .object({ kind: z.literal("function"), dimension: functionDimensionSchema })
+    .strict();
+const staticSelectorSchema = z.discriminatedUnion("kind", [
+    artifactSelectorSchema,
+    functionSelectorSchema,
+]);
+const mappingSchema = z
+    .object({
+    static: z
+        .object({
+        comparison_evidence_id: evidenceIdSchema,
+        selector: staticSelectorSchema,
+    })
+        .strict(),
+    runtime: z
+        .object({
+        comparison_evidence_id: evidenceIdSchema,
+        dimension: runtimeDimensionSchema,
+    })
+        .strict(),
+    side_alignment: z.enum(["left_to_left", "left_to_right"]),
+    hypothesis: z
+        .object({
+        statement: z.string().trim().min(1),
+        expected_pattern: expectedPatternSchema,
+    })
+        .strict(),
+})
+    .strict();
+/** Strict input for explicit static/runtime hypothesis correlation. */
+export const staticRuntimeCorrelationInputSchema = z
+    .object({
+    static_comparisons: z.array(evidenceSchema).min(1),
+    runtime_comparisons: z.array(evidenceSchema).min(1),
+    mappings: z.array(mappingSchema).min(1),
+})
+    .strict();
+const correlationItemSchema = z.object({
+    correlation_id: prefixedDigestSchema("cor"),
+    static: z.object({
+        comparison_evidence_id: evidenceIdSchema,
+        selector: staticSelectorSchema,
+        status: comparisonStatusSchema,
+        conclusion_kind: z.enum([
+            "derived_relationship",
+            "contradiction",
+            "unresolved_branch",
+        ]),
+    }),
+    runtime: z.object({
+        comparison_evidence_id: evidenceIdSchema,
+        dimension: runtimeDimensionSchema,
+        status: comparisonStatusSchema,
+    }),
+    side_alignment: z.enum(["left_to_left", "left_to_right"]),
+    hypothesis: z.object({
+        statement: z.string().min(1),
+        expected_pattern: expectedPatternSchema,
+    }),
+    observed_pattern: observedPatternSchema,
+    classification: z.enum(["hypothesis", "contradiction", "unresolved_branch"]),
+    evidence_links: z.array(evidenceIdSchema).min(2),
+    limitations: z.array(z.string()),
+});
+/** Deterministic static/runtime correlation payload. */
+export const staticRuntimeCorrelationResultSchema = z.object({
+    status: z.enum(["correlated", "contradicted", "unknown", "truncated"]),
+    summary: z.object({
+        hypotheses: z.number().int().min(0),
+        contradictions: z.number().int().min(0),
+        unresolved: z.number().int().min(0),
+    }),
+    correlations: z.object({
+        items: z.array(correlationItemSchema),
+    }),
+    evidence_links: z.array(evidenceIdSchema).min(2),
+    limitations: z.array(z.string()),
+});
+const EXPECTED = {
+    compare_artifacts: [
+        "rea.artifact-comparison",
+        "rea-artifact-comparison",
+        "REA artifact comparison",
+    ],
+    compare_functions: [
+        "rea.function-comparison",
+        "rea-function-comparison",
+        "REA function comparison",
+    ],
+    compare_process_captures: [
+        "rea.process-comparison",
+        PROCESS_PROVIDER.id,
+        PROCESS_PROVIDER.name,
+    ],
+};
+/** Correlate only caller-declared static/runtime hypotheses. */
+export const correlateStaticAndRuntime = (input) => {
+    const parsed = staticRuntimeCorrelationInputSchema.parse(input);
+    const staticEvidence = parsed.static_comparisons.map(parseStatic);
+    const runtimeEvidence = parsed.runtime_comparisons.map(parseRuntime);
+    assertUnique(staticEvidence, "static comparison Evidence");
+    assertUnique(runtimeEvidence, "runtime comparison Evidence");
+    const staticById = byId(staticEvidence);
+    const runtimeById = byId(runtimeEvidence);
+    const correlations = parsed.mappings
+        .map((mapping) => correlate(mapping, staticById, runtimeById))
+        .sort((left, right) => compareUnicodeCodePoints(left.correlation_id, right.correlation_id));
+    if (new Set(correlations.map(({ correlation_id: id }) => id)).size !==
+        correlations.length)
+        throw new TypeError("Static/runtime correlation rejects duplicate mappings");
+    const links = uniqueSorted(correlations.flatMap(({ evidence_links: evidenceLinks }) => evidenceLinks));
+    const unresolved = correlations.filter(({ classification }) => classification === "unresolved_branch");
+    const contradictions = correlations.filter(({ classification }) => classification === "contradiction");
+    return staticRuntimeCorrelationResultSchema.parse({
+        status: correlations.some(({ observed_pattern: pattern }) => pattern === "truncated")
+            ? "truncated"
+            : unresolved.length > 0
+                ? "unknown"
+                : contradictions.length > 0
+                    ? "contradicted"
+                    : "correlated",
+        summary: {
+            hypotheses: correlations.length - contradictions.length - unresolved.length,
+            contradictions: contradictions.length,
+            unresolved: unresolved.length,
+        },
+        correlations: {
+            items: correlations,
+        },
+        evidence_links: links,
+        limitations: [
+            "Mappings are caller-declared hypotheses; consistency does not establish causality.",
+            "Only explicit mappings were evaluated; similar unmapped observations were not correlated.",
+        ],
+    });
+};
+const correlate = (mapping, staticById, runtimeById) => {
+    const staticEvidence = required(staticById, mapping.static.comparison_evidence_id, "static comparison");
+    const runtimeEvidence = required(runtimeById, mapping.runtime.comparison_evidence_id, "runtime comparison");
+    const selectedStatic = selectStatic(staticEvidence, mapping.static.selector);
+    const process = processCaptureComparisonSchema.parse(runtimeEvidence.normalized_result);
+    const runtimeStatus = process[mapping.runtime.dimension];
+    const pattern = observedPattern(selectedStatic.status, runtimeStatus);
+    const classification = pattern === "unknown" || pattern === "truncated"
+        ? "unresolved_branch"
+        : pattern === mapping.hypothesis.expected_pattern
+            ? "hypothesis"
+            : "contradiction";
+    const projection = {
+        static: mapping.static,
+        runtime: mapping.runtime,
+        side_alignment: mapping.side_alignment,
+        hypothesis: mapping.hypothesis,
+    };
+    return correlationItemSchema.parse({
+        correlation_id: `cor_${sha256(canonicalJson(projection))}`,
+        static: { ...mapping.static, ...selectedStatic },
+        runtime: { ...mapping.runtime, status: runtimeStatus },
+        side_alignment: mapping.side_alignment,
+        hypothesis: mapping.hypothesis,
+        observed_pattern: pattern,
+        classification,
+        evidence_links: uniqueSorted([
+            staticEvidence.evidence_id,
+            ...staticEvidence.evidence_links,
+            runtimeEvidence.evidence_id,
+            ...runtimeEvidence.evidence_links,
+        ]),
+        limitations: uniqueSorted([
+            ...staticEvidence.limitations,
+            ...runtimeEvidence.limitations,
+            ...process.limitations,
+            "This correlation tests an explicit hypothesis and does not establish causality.",
+            "Side alignment is caller-declared and was not independently validated against source subjects or environments.",
+        ]),
+    });
+};
+const selectStatic = (evidence, selector) => {
+    if (selector.kind === "function") {
+        if (evidence.operation !== "compare_functions")
+            throw new TypeError("Function selector requires function comparison Evidence");
+        const result = functionComparisonResultSchema.parse(evidence.normalized_result);
+        const matches = result.dimensions.filter(({ dimension }) => dimension === selector.dimension);
+        const match = matches.at(0);
+        if (matches.length !== 1 || match === undefined)
+            throw new TypeError("Function selector must resolve exactly once");
+        return {
+            status: match.status,
+            conclusion_kind: match.conclusion_kind,
+        };
+    }
+    if (evidence.operation !== "compare_artifacts")
+        throw new TypeError("Artifact selector requires artifact comparison Evidence");
+    const result = artifactComparisonResultSchema.parse(evidence.normalized_result);
+    const matches = result.changes.filter(({ logical_path: path }) => path === selector.logical_path);
+    const match = matches.at(0);
+    if (matches.length !== 1 || match === undefined)
+        throw new TypeError("Artifact selector must resolve exactly one reported delta");
+    const status = match.classification;
+    return {
+        status,
+        conclusion_kind: status === "contradiction"
+            ? "contradiction"
+            : status === "unknown"
+                ? "unresolved_branch"
+                : "derived_relationship",
+    };
+};
+const parseStatic = (input) => {
+    const evidence = parseEvidence(input);
+    if (evidence.operation !== "compare_artifacts" &&
+        evidence.operation !== "compare_functions")
+        throw new TypeError("Static/runtime correlation requires artifact or function comparison Evidence");
+    assertComparisonIdentity(evidence);
+    if (evidence.operation === "compare_artifacts") {
+        const result = artifactComparisonResultSchema.parse(evidence.normalized_result);
+        assertNestedLinks(evidence, result.changes.flatMap(({ evidence_links: links }) => links));
+    }
+    else {
+        const result = functionComparisonResultSchema.parse(evidence.normalized_result);
+        assertNestedLinks(evidence, result.dimensions.flatMap(({ evidence_links: links }) => links));
+    }
+    return evidence;
+};
+const assertNestedLinks = (evidence, nestedLinks) => {
+    const closure = new Set(evidence.evidence_links);
+    if (nestedLinks.some((evidenceId) => !closure.has(evidenceId)))
+        throw new TypeError("Comparison finding cites Evidence outside its top-level closure");
+};
+const parseRuntime = (input) => {
+    const evidence = parseEvidence(input);
+    if (evidence.operation !== "compare_process_captures")
+        throw new TypeError("Static/runtime correlation requires process comparison Evidence");
+    assertComparisonIdentity(evidence);
+    processCaptureComparisonSchema.parse(evidence.normalized_result);
+    return evidence;
+};
+const assertComparisonIdentity = (evidence) => {
+    const expected = EXPECTED[evidence.operation];
+    if (expected === undefined ||
+        !(Array.isArray(expected[0])
+            ? expected[0].includes(evidence.predicate_type)
+            : evidence.predicate_type === expected[0]) ||
+        (evidence.operation === "compare_process_captures"
+            ? !isProcessEvidenceProvider(evidence.provider)
+            : evidence.provider.id !== expected[1] ||
+                evidence.provider.name !== expected[2] ||
+                evidence.provider.version !== "1") ||
+        evidence.confidence !== "derived" ||
+        evidence.authority !== "analyst-inference" ||
+        evidence.subject !== null)
+        throw new TypeError("Comparison Evidence operation, predicate, provider, or citations disagree");
+    const expectedLinks = comparisonSourceEvidenceIds(evidence);
+    const actualLinks = uniqueSorted(evidence.evidence_links);
+    if (expectedLinks.length !== actualLinks.length ||
+        expectedLinks.some((id, index) => id !== actualLinks[index]))
+        throw new TypeError("Comparison Evidence closure disagrees with its source parameters");
+};
+const observedPattern = (staticStatus, runtimeStatus) => {
+    if (staticStatus === "truncated" || runtimeStatus === "truncated")
+        return "truncated";
+    if (staticStatus === "unknown" || runtimeStatus === "unknown")
+        return "unknown";
+    const staticChanged = staticStatus !== "unchanged";
+    const runtimeChanged = runtimeStatus !== "unchanged";
+    if (staticChanged && runtimeChanged)
+        return "cochanged";
+    if (staticChanged)
+        return "static_only";
+    if (runtimeChanged)
+        return "runtime_only";
+    return "both_unchanged";
+};
+const required = (values, id, label) => {
+    const value = values.get(id);
+    if (value === undefined)
+        throw new TypeError(`Mapping references absent ${label} Evidence`);
+    return value;
+};
+const byId = (evidence) => new Map(evidence.map((item) => [item.evidence_id, item]));
+const assertUnique = (evidence, label) => {
+    if (new Set(evidence.map(({ evidence_id: id }) => id)).size !== evidence.length)
+        throw new TypeError(`Static/runtime correlation rejects duplicate ${label}`);
+};
+const sha256 = (value) => createHash("sha256").update(value).digest("hex");
+const canonicalJson = (value) => {
+    const serialized = canonicalize(value);
+    if (serialized === undefined)
+        throw new TypeError("RFC 8785 canonicalization rejected correlation mapping");
+    return serialized;
+};

package/dist/domain/stringPatterns.js

@@ -0,0 +1,6 @@
+/** Portable ASCII identifier starting with a letter. */
+export const IDENTIFIER_PATTERN = /^[A-Za-z][A-Za-z0-9._\x2d]*$/u;
+/** Stable evidence identifier, also admitting namespace and path separators. */
+export const STABLE_IDENTIFIER_PATTERN = /^[A-Za-z][A-Za-z0-9._:\x2f\x2d]*$/u;
+/** Canonical padded base64, including zero pad bits and the empty encoding. */
+export const CANONICAL_BASE64_PATTERN = /^(?:[A-Za-z0-9+\x2f]{4})*(?:[A-Za-z0-9+\x2f][AQgw]==|[A-Za-z0-9+\x2f]{2}[AEIMQUYcgkosw048]=)?$/;

package/dist/domain/swiftSymbolClassification.js

@@ -0,0 +1,66 @@
+const LEGACY_CATEGORIES = [
+    ["_TtC", "classes"],
+    ["_TtV", "structs"],
+    ["_TtO", "enums"],
+    ["_TtP", "protocols"],
+    ["_TtE", "extensions"],
+];
+const NOMINAL_CATEGORIES = new Map([
+    ["C", "classes"],
+    ["V", "structs"],
+    ["O", "enums"],
+    ["P", "protocols"],
+]);
+/**
+ * Recognize Swift manglings and decode literal module/nominal contexts.
+ * Substitutions, generic contexts, and other encodings remain unknown.
+ */
+export const classifySwiftSymbol = (name) => {
+    const prefix = /^_?(?:\$[sS]|_T0)/u.exec(name);
+    if (prefix === null) {
+        if (!name.includes("_Tt"))
+            return undefined;
+        return {
+            category: LEGACY_CATEGORIES.find(([prefix]) => name.startsWith(prefix))?.[1] ??
+                null,
+        };
+    }
+    const mangling = name.slice(prefix[0].length);
+    let offset = identifierEnd(mangling, 0);
+    if (offset === undefined)
+        return { category: null };
+    let category = null;
+    for (;;) {
+        const end = identifierEnd(mangling, offset);
+        if (end === undefined)
+            break;
+        const kind = mangling.charAt(end);
+        const nominal = NOMINAL_CATEGORIES.get(kind);
+        if (nominal === undefined) {
+            // Current swiftc emits protocol descriptors as `…<Nominal>Mp` without
+            // the nominal `P` marker (e.g. `_$s4main7ScoringMp`). Decode that exact
+            // suffix; unknown substitution encodings stay unclassified, never guessed.
+            if (mangling.slice(end) === "Mp")
+                category = "protocols";
+            else if (kind === "E" && category !== null)
+                category = "extensions";
+            break;
+        }
+        category = nominal;
+        offset = end + 1;
+    }
+    return { category };
+};
+const identifierEnd = (mangling, offset) => {
+    const lengthToken = /^[1-9][0-9]*/u.exec(mangling.slice(offset))?.[0];
+    if (lengthToken === undefined)
+        return undefined;
+    const start = offset + lengthToken.length;
+    const end = start + Number(lengthToken);
+    // Swift identifiers with substitutions/punycode need a fuller decoder.
+    if (!Number.isSafeInteger(end) ||
+        end > mangling.length ||
+        !/^[A-Za-z_][A-Za-z0-9_]*$/u.test(mangling.slice(start, end)))
+        return undefined;
+    return end;
+};

package/dist/domain/symbolAnalysis.js

@@ -0,0 +1,122 @@
+import { classifySwiftSymbol, } from "./swiftSymbolClassification.js";
+/** Objective-C class definition markers emitted by modern Apple clang. */
+const OBJC_CLASS_MARKER = "OBJC_CLASS_$_";
+/** Local class records emitted by Apple's fragile Objective-C ABI. */
+const LEGACY_OBJC_CLASS_PREFIX = "l_OBJC_CLASS_";
+/**
+ * Objective-C protocol declaration marker. `PROTOCOL_REFERENCE` slots
+ * share the substring but are uses, not definitions.
+ */
+const OBJC_PROTOCOL_MARKER = "OBJC_PROTOCOL_$_";
+/** Select and deduplicate Objective-C class labels. */
+export const discoverObjcClasses = (names, pattern) => {
+    const classes = uniqueByName(names
+        .filter(({ name }) => name.includes(OBJC_CLASS_MARKER) ||
+        (name.startsWith(LEGACY_OBJC_CLASS_PREFIX) &&
+            name.length > LEGACY_OBJC_CLASS_PREFIX.length &&
+            !/^l_OBJC_CLASS_NAME_(?:\.\d+)?$/u.test(name)))
+        .filter(({ name }) => pattern.length === 0 || name.includes(pattern)));
+    return {
+        count: classes.length,
+        classes: classes.map(toJsonEntry),
+    };
+};
+/** Select and deduplicate Objective-C and Swift protocol labels. */
+export const discoverObjcProtocols = (names) => {
+    const protocols = uniqueByName(names.filter(({ name }) => name.includes(OBJC_PROTOCOL_MARKER) ||
+        name.includes("_TtP") ||
+        (name.endsWith("Mp") &&
+            classifySwiftSymbol(name)?.category === "protocols")));
+    return {
+        count: protocols.length,
+        protocols: protocols.map(toJsonEntry),
+    };
+};
+/** Categorize procedure names using Swift manglings at their exact addresses. */
+export const categorizeSwiftTypes = (procedures, filter = {}, symbols = []) => {
+    const groups = Object.fromEntries(["classes", "structs", "enums", "protocols", "extensions", "other"].map((category) => [category, []]));
+    const aliases = swiftAliasesByAddress(symbols);
+    const pattern = filter.pattern;
+    const seen = new Set();
+    const unclassifiedNames = new Set();
+    const unclassified = [];
+    for (const entry of procedures) {
+        if (seen.has(entry.name))
+            continue;
+        const mangledNames = [
+            ...new Set([
+                ...(classifySwiftSymbol(entry.name) === undefined ? [] : [entry.name]),
+                ...(aliases.get(entry.address) ?? []),
+            ]),
+        ];
+        if (mangledNames.length === 0)
+            continue;
+        if (pattern !== undefined &&
+            ![entry.name, ...mangledNames].some((name) => name.includes(pattern)))
+            continue;
+        const kinds = new Set(mangledNames.map((name) => classifySwiftSymbol(name)?.category ?? null));
+        const category = kinds.size === 1 ? ([...kinds][0] ?? null) : null;
+        const item = {
+            address: entry.address,
+            name: entry.name,
+            mangled_names: mangledNames,
+        };
+        if (category === null && !unclassifiedNames.has(entry.name)) {
+            unclassifiedNames.add(entry.name);
+            unclassified.push({
+                ...item,
+                reason: kinds.size > 1 && !kinds.has(null)
+                    ? "conflicting_categories"
+                    : "category_not_decoded",
+            });
+        }
+        const bucket = category ?? "other";
+        if (filter.category === undefined || filter.category === bucket) {
+            seen.add(entry.name);
+            groups[bucket]?.push(item);
+        }
+    }
+    const categories = Object.fromEntries(Object.entries(groups).map(([category, items]) => [
+        category,
+        { count: items.length, items },
+    ]));
+    return {
+        total: Object.values(groups).reduce((sum, items) => sum + items.length, 0),
+        categories,
+        unclassified,
+        limitations: [
+            "Identification uses Swift mangled procedure names or same-address symbol aliases. Demangled names without retained Swift manglings cannot be identified. Counts deduplicate procedure names, not source declarations.",
+            ...(unclassified.length === 0
+                ? []
+                : [
+                    "Some Swift categories could not be established from the retained manglings. Unclassified observations remain inline regardless of the category filter.",
+                ]),
+        ],
+    };
+};
+const swiftAliasesByAddress = (symbols) => {
+    const aliases = new Map();
+    for (const { address, name } of symbols) {
+        if (classifySwiftSymbol(name) === undefined)
+            continue;
+        const existing = aliases.get(address);
+        if (existing === undefined)
+            aliases.set(address, [name]);
+        else
+            existing.push(name);
+    }
+    return aliases;
+};
+const uniqueByName = (entries) => {
+    const seen = new Set();
+    return entries.filter(({ name }) => {
+        if (seen.has(name))
+            return false;
+        seen.add(name);
+        return true;
+    });
+};
+const toJsonEntry = ({ address, name }) => ({
+    address,
+    name,
+});

package/dist/domain/unicodeCodePointOrder.js

@@ -0,0 +1,23 @@
+/** Compare strings lexicographically by Unicode code point, independent of locale. */
+export const compareUnicodeCodePoints = (left, right) => {
+    let leftIndex = 0;
+    let rightIndex = 0;
+    while (leftIndex < left.length && rightIndex < right.length) {
+        const leftPoint = left.codePointAt(leftIndex) ?? 0;
+        const rightPoint = right.codePointAt(rightIndex) ?? 0;
+        const difference = leftPoint - rightPoint;
+        if (difference !== 0)
+            return difference;
+        leftIndex += leftPoint > 0xffff ? 2 : 1;
+        rightIndex += rightPoint > 0xffff ? 2 : 1;
+    }
+    if (leftIndex === left.length && rightIndex === right.length)
+        return 0;
+    return leftIndex === left.length ? -1 : 1;
+};
+/**
+ * Collision-free composite key for deduplication/sorting. `\0`-joins
+ * collide when any component contains NUL (valid in JS property names);
+ * a JSON tuple escapes every component. Single owner for composite keys.
+ */
+export const compositeKey = (parts) => JSON.stringify(parts);

package/dist/domain/unknownRegistryError.js

@@ -0,0 +1,10 @@
+import { AnalysisError } from "./analysisErrorBase.js";
+/** Residual-unknown mutation failed a lifecycle, reference, or CAS invariant. */
+export class UnknownRegistryError extends AnalysisError {
+    reason;
+    _tag = "UnknownRegistryError";
+    constructor(reason, options) {
+        super(`Residual unknown registry mutation failed: ${reason}`, options);
+        this.reason = reason;
+    }
+}

package/dist/domain/wasm/wasmArtifact.js

@@ -0,0 +1,105 @@
+import { z } from "zod";
+import { localPathStringSchema } from "../localPath.js";
+const digest = z.string().regex(/^[a-f0-9]{64}$/);
+const artifact = z.strictObject({
+    path: z.string().min(1),
+    sha256: digest,
+    bytes: z.number().int().nonnegative(),
+});
+/** All artifacts are explicitly selected local files; references never trigger acquisition. */
+export const inspectWasmArtifactInputSchema = z.strictObject({
+    path: localPathStringSchema.describe("Absolute selected local WASM artifact path"),
+    glue_paths: z.array(localPathStringSchema).max(16).default([]),
+    candidate_paths: z.array(localPathStringSchema).max(16).default([]),
+});
+/** Upstream output stays intact; import/export names are never split on ambiguous punctuation. */
+export const wasmArtifactSchema = z
+    .strictObject({
+    artifact,
+    validation: z.literal("valid"),
+    sections: z.array(z.strictObject({
+        kind: z.string().min(1),
+        start: z.number().int().nonnegative(),
+        end: z.number().int().nonnegative(),
+        bytes: z.number().int().nonnegative(),
+        description: z.string(),
+    })),
+    imports: z.array(z.string()),
+    exports: z.array(z.string()),
+    headers: z.string(),
+    details: z.string(),
+    wat: z.strictObject({
+        text: z.string().min(1),
+        sha256: digest,
+        representation: z.literal("decoded-wat"),
+    }),
+    tool_profile: z.strictObject({
+        source: z.literal("https://github.com/WebAssembly/wabt"),
+        release: z.literal("1.0.42"),
+        source_commit: z.literal("ff0ef7e0009402740c805a9744c09b05be063e48"),
+        commands: z
+            .array(z.strictObject({
+            tool: z.enum(["wasm-validate", "wasm-objdump", "wasm2wat"]),
+            path: z.string().min(1),
+            sha256: digest,
+            version_banner: z.string(),
+            arguments: z.array(z.string()),
+        }))
+            .length(3),
+        timeout_ms: z.number().int().positive(),
+        output_budget_bytes: z.number().int().positive(),
+    }),
+    candidates: z.array(artifact),
+    glue: z.array(z.strictObject({
+        artifact,
+        parse_status: z.enum(["complete", "partial", "failed"]),
+        references: z.array(z.strictObject({
+            value: z.string(),
+            line: z.number().int().positive(),
+            column: z.number().int().nonnegative(),
+            candidate_paths: z.array(z.string()),
+            association: z.enum([
+                "local-path-candidate",
+                "basename-candidates",
+                "unresolved",
+            ]),
+            evidence_kind: z.literal("static-literal"),
+        })),
+    })),
+    runtime_execution: z.literal("not-performed"),
+    network_fetch: z.literal("not-performed"),
+    limitations: z.array(z.string()),
+})
+    .superRefine((value, context) => {
+    const selected = value.candidates[0];
+    if (selected?.path !== value.artifact.path ||
+        selected.sha256 !== value.artifact.sha256 ||
+        selected.bytes !== value.artifact.bytes)
+        context.addIssue({
+            code: "custom",
+            path: ["candidates"],
+            message: "Selected candidate does not match artifact identity.",
+        });
+    for (const [index, command] of value.tool_profile.commands.entries()) {
+        const expected = ["wasm-validate", "wasm-objdump", "wasm2wat"][index];
+        const argumentsExpected = command.tool === "wasm-objdump"
+            ? ["-h", "-x", "module.wasm"]
+            : ["--enable-all", "module.wasm"];
+        if (command.tool !== expected ||
+            command.version_banner.trim() !== "1.0.42" ||
+            JSON.stringify(command.arguments) !== JSON.stringify(argumentsExpected))
+            context.addIssue({
+                code: "custom",
+                path: ["tool_profile", "commands", index],
+                message: "Unexpected WABT command profile.",
+            });
+    }
+    for (const [index, section] of value.sections.entries())
+        if (section.end > value.artifact.bytes ||
+            section.end - section.start !== section.bytes)
+            context.addIssue({
+                code: "custom",
+                path: ["sections", index],
+                message: "Section range does not match selected artifact bytes.",
+            });
+});