reverseport 0.0.0-stage → 1.2.0

package/dist/application/javascript/ElectronBoundaryGraphNative.js

@@ -0,0 +1,102 @@
+import { javascriptAnalysisCoverage, resolveArtifactPath, } from "./JavaScriptArtifactGraphContext.js";
+import { astObservationEvidence } from "./JavaScriptArtifactGraphEvidence.js";
+import { compositeKey } from "../../domain/unicodeCodePointOrder.js";
+import { javascriptDisplayText } from "../../domain/javascript/javascriptAstValues.js";
+import { addElectronInferenceEdge, electronFindingSourceNode, electronObservationIdentity, electronRangeKey, } from "./ElectronBoundaryGraphContext.js";
+/** Project JavaScript-requested native addon binding and re-export surfaces. */
+export const addElectronNativeBoundaries = (context) => {
+    for (const analyzed of context.analysis.files) {
+        const { file, javascript } = analyzed;
+        if (javascript === null)
+            continue;
+        const coverage = javascriptAnalysisCoverage(javascript);
+        for (const value of javascript.electron.native_addon_bindings)
+            addNativeBinding({ context, file, value, coverage });
+    }
+};
+const addNativeBinding = (input) => {
+    const { context, file, value, coverage } = input;
+    const source = electronFindingSourceNode(context, file, value.module_key, value.module_runtime);
+    if (source === undefined)
+        return;
+    const resolved = resolveArtifactPath(value.specifier, file.path, context.filesByPath, value.module_kind);
+    const addon = resolved === null ? undefined : context.fileNodes.get(resolved);
+    const binding = context.accumulator.addNode({
+        kind: "native-export",
+        identity: electronObservationIdentity(context, "javascript-requested-native-export", compositeKey([
+            file.path,
+            value.specifier,
+            value.binding_kind,
+            value.members,
+            value.namespace_access ?? null,
+            value.dynamic_member_access ?? null,
+            electronRangeKey(value.location),
+        ])),
+        observations: [
+            {
+                label: value.members.map(javascriptDisplayText).join(", ") ||
+                    value.specifier,
+                properties: {
+                    specifier: value.specifier,
+                    binding_kind: value.binding_kind,
+                    requested_members: value.members,
+                    namespace_access: value.namespace_access ?? null,
+                    dynamic_member_access: value.dynamic_member_access ?? null,
+                    resolved_path: resolved,
+                    native_export_verification: "not-performed",
+                },
+                evidence: astObservationEvidence({
+                    sha256: file.sha256,
+                    path: file.path,
+                    range: value.location,
+                    operation: "observe-native-addon-binding",
+                    coverage,
+                    limitations: [
+                        "JavaScript syntax identifies requested member names; it does not prove that the native binary exports or implements them.",
+                    ],
+                }),
+            },
+        ],
+    });
+    addElectronInferenceEdge(context, {
+        source,
+        target: binding,
+        file,
+        range: value.location,
+        coverage,
+        relation: value.binding_kind === "re-export" ? "exposes" : "imports",
+        operation: "map-native-addon-binding",
+        properties: {
+            specifier: value.specifier,
+            binding_kind: value.binding_kind,
+            requested_members: value.members,
+            namespace_access: value.namespace_access ?? null,
+            dynamic_member_access: value.dynamic_member_access ?? null,
+        },
+        limitations: [
+            "Requested JavaScript members are not verified native exports.",
+        ],
+    });
+    if (addon === undefined || resolved === null)
+        return;
+    addElectronInferenceEdge(context, {
+        source: addon,
+        target: binding,
+        file,
+        range: value.location,
+        coverage,
+        relation: "exposes",
+        operation: "associate-native-addon-requested-exports",
+        properties: {
+            resolved_path: resolved,
+            requested_members: value.members,
+            namespace_access: value.namespace_access ?? null,
+            dynamic_member_access: value.dynamic_member_access ?? null,
+            verified: false,
+        },
+        confidence: "medium",
+        limitations: [
+            "The .node artifact path is resolved, but requested JavaScript members have not been verified against native symbols.",
+        ],
+    });
+};

package/dist/application/javascript/ElectronBoundaryGraphWindows.js

@@ -0,0 +1,224 @@
+import { artifactLocalIdentity, createElectronRoleNode, javascriptAnalysisCoverage, linkElectronRoleToAsset, } from "./JavaScriptArtifactGraphContext.js";
+import { astObservationEvidence, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
+import { addElectronAstEdge, addElectronInferenceEdge, electronFindingSourceNode, electronRangeKey, } from "./ElectronBoundaryGraphContext.js";
+import { resolveArtifactPathByContext } from "./JavaScriptArtifactPathResolution.js";
+/** Project BrowserWindow, contextBridge, preload, and utility-process facts. */
+export const addElectronWindowBoundaries = (context) => {
+    for (const analyzed of context.analysis.files) {
+        const { file, javascript } = analyzed;
+        if (javascript === null)
+            continue;
+        const coverage = javascriptAnalysisCoverage(javascript);
+        for (const value of javascript.electron.browser_windows) {
+            const source = electronFindingSourceNode(context, file, value.module_key, value.module_runtime);
+            if (source !== undefined)
+                addBrowserWindow({ context, file, source, value, coverage });
+        }
+        for (const value of javascript.electron.context_bridge_apis) {
+            const source = electronFindingSourceNode(context, file, value.module_key, value.module_runtime);
+            if (source !== undefined)
+                addContextBridge({ context, file, source, value, coverage });
+        }
+        for (const value of javascript.electron.utility_processes) {
+            const source = electronFindingSourceNode(context, file, value.module_key, value.module_runtime);
+            if (source !== undefined)
+                addUtilityProcess({ context, file, source, value, coverage });
+        }
+    }
+};
+const addBrowserWindow = (input) => {
+    const { context, file, value, coverage } = input;
+    const window = context.accumulator.addNode({
+        kind: "browser-window",
+        identity: artifactLocalIdentity(file.sha256, "electron-browser-window", electronRangeKey(value.location)),
+        observations: [
+            {
+                label: `BrowserWindow@${electronRangeKey(value.location)}`,
+                properties: {
+                    source_path: file.path,
+                    options_status: value.options_status,
+                    web_preferences_status: value.web_preferences_status,
+                    web_preferences: value.web_preferences,
+                    preload_path: value.preload_path,
+                    preload_resolution_context: value.preload_resolution_context,
+                    absence_means_default: false,
+                },
+                evidence: astObservationEvidence({
+                    sha256: file.sha256,
+                    path: file.path,
+                    range: value.location,
+                    operation: "observe-browser-window-construction",
+                    coverage,
+                    limitations: [
+                        "Only explicitly present webPreferences are reported; omitted properties are not interpreted as Electron defaults.",
+                    ],
+                }),
+            },
+        ],
+    });
+    addElectronAstEdge(context, {
+        source: input.source,
+        target: window,
+        file,
+        range: value.location,
+        coverage,
+        relation: "contains",
+        operation: "locate-browser-window-construction",
+        properties: { source_path: file.path },
+    });
+    addWindowPreload(input, window);
+};
+const addWindowPreload = (input, window) => {
+    if (input.value.preload_path === null)
+        return;
+    const { preload_path: declared, preload_resolution_context: resolutionContext, } = input.value;
+    const resolution = resolveArtifactPathByContext({
+        declaredPath: declared,
+        sourcePath: input.file.path,
+        context: resolutionContext,
+        files: input.context.filesByPath,
+    });
+    const role = createElectronRoleNode(input.context, {
+        kind: "electron-preload",
+        anchor: input.file,
+        resolution,
+        mechanism: "BrowserWindow:webPreferences.preload",
+        range: input.value.location,
+        coverage: input.coverage,
+    });
+    addElectronInferenceEdge(input.context, {
+        source: window,
+        target: role,
+        file: input.file,
+        range: input.value.location,
+        coverage: input.coverage,
+        relation: "loads",
+        operation: "associate-browser-window-preload",
+        properties: {
+            declared_path: declared,
+            resolution_context: resolution.resolution_context,
+            resolved_path: resolution.resolved_path,
+            resolution_status: resolution.resolution_status,
+            limitations: resolution.limitations,
+        },
+    });
+    linkElectronRoleToAsset(input.context, {
+        role,
+        anchor: input.file,
+        resolution,
+        range: input.value.location,
+        coverage: input.coverage,
+    });
+};
+const addContextBridge = (input) => {
+    const { context, file, value, coverage } = input;
+    const bridge = context.accumulator.addNode({
+        kind: "context-bridge-api",
+        identity: artifactLocalIdentity(file.sha256, "electron-context-bridge", `${value.world}:${value.api_key ?? value.api_key_expression ?? "[missing]"}:${electronRangeKey(value.location)}`),
+        observations: [
+            {
+                label: value.api_key,
+                properties: {
+                    world: value.world,
+                    world_id: value.world_id,
+                    api_key: value.api_key,
+                    api_key_expression: value.api_key_expression,
+                    api_status: value.api_status,
+                    members: value.members,
+                    unknown_members: value.unknown_members,
+                    resolution_basis: value.resolution_basis ?? "direct-syntax",
+                },
+                evidence: (value.resolution_basis === "wrapper-substitution"
+                    ? staticInferenceEvidence
+                    : astObservationEvidence)({
+                    sha256: file.sha256,
+                    path: file.path,
+                    range: value.location,
+                    operation: "observe-context-bridge-api",
+                    coverage,
+                }),
+            },
+        ],
+    });
+    addElectronInferenceEdge(context, {
+        source: input.source,
+        target: bridge,
+        file,
+        range: value.location,
+        coverage,
+        relation: "exposes",
+        operation: "map-context-bridge-exposure",
+        properties: {
+            world: value.world,
+            api_key: value.api_key,
+            resolution: value.api_key === null ? "dynamic" : "literal",
+        },
+    });
+};
+const addUtilityProcess = (input) => {
+    const { context, file, value, coverage } = input;
+    const utility = context.accumulator.addNode({
+        kind: "electron-utility",
+        identity: artifactLocalIdentity(file.sha256, "electron-utility-process", `${value.module_path ?? value.module_expression}:${electronRangeKey(value.location)}`),
+        observations: [
+            {
+                label: value.service_name ?? value.module_path,
+                properties: {
+                    module_path: value.module_path,
+                    module_resolution_context: value.module_resolution_context,
+                    module_expression: value.module_expression,
+                    service_name: value.service_name,
+                },
+                evidence: astObservationEvidence({
+                    sha256: file.sha256,
+                    path: file.path,
+                    range: value.location,
+                    operation: "observe-utility-process-fork",
+                    coverage,
+                }),
+            },
+        ],
+    });
+    addElectronInferenceEdge(context, {
+        source: input.source,
+        target: utility,
+        file,
+        range: value.location,
+        coverage,
+        relation: "loads",
+        operation: "map-utility-process-launch",
+        properties: {
+            declared_path: value.module_path,
+            expression: value.module_expression,
+        },
+    });
+    if (value.module_path === null)
+        return;
+    const resolution = resolveArtifactPathByContext({
+        declaredPath: value.module_path,
+        sourcePath: file.path,
+        context: value.module_resolution_context,
+        files: context.filesByPath,
+    });
+    const resolved = resolution.resolved_path;
+    const target = resolved === null
+        ? undefined
+        : (context.assetNodes.get(resolved) ?? context.fileNodes.get(resolved));
+    if (target === undefined)
+        return;
+    addElectronInferenceEdge(context, {
+        source: utility,
+        target,
+        file,
+        range: value.location,
+        coverage,
+        relation: "maps_to",
+        operation: "resolve-utility-process-entrypoint",
+        properties: {
+            declared_path: value.module_path,
+            resolution_context: resolution.resolution_context,
+            resolved_path: resolved,
+            resolution_status: resolution.resolution_status,
+        },
+    });
+};

package/dist/application/javascript/ElectronEvidence.js

@@ -0,0 +1,37 @@
+import { createEvidence, } from "../../domain/evidence.js";
+import { jsonValueSchema } from "../../domain/jsonValue.js";
+/** Create Evidence for one Electron observation. */
+export const createElectronEvidence = (operation, input, result, provider) => createEvidence(undefined, provider, {
+    predicateType: operation === "list_electron_targets"
+        ? "rea.electron-target-list"
+        : "rea.electron-page-inspection",
+    operation,
+    parameters: parameters(input),
+    result: jsonValueSchema.parse(result),
+    confidence: "observed",
+    authority: "external-service",
+    environment: "target" in result
+        ? {
+            id: `${result.browser.product}@${result.browser.revision}`,
+            platform: "unknown",
+            architecture: "unknown",
+            isolation: "none",
+        }
+        : null,
+    limitations: [
+        ...result.limitations,
+        ...("target" in result
+            ? ["Browser host platform and architecture were not observed."]
+            : []),
+    ],
+});
+const parameters = (input) => ({
+    cdp_endpoint: input.cdp_endpoint,
+    ...("target_id" in input
+        ? {
+            target_id: input.target_id,
+            observation_ms: input.observation_ms,
+            include_script_sources: input.include_script_sources,
+        }
+        : {}),
+});

package/dist/application/javascript/ElectronObservationPort.js

@@ -0,0 +1 @@
+export {};

package/dist/application/javascript/ElectronObservationService.js

@@ -0,0 +1,26 @@
+import { AnalysisCapabilityUnavailableError } from "../../domain/analysisErrorCore.js";
+import { err, ok } from "../../domain/result.js";
+import { createElectronEvidence } from "./ElectronEvidence.js";
+/** List local file pages exposed by the explicitly selected endpoint. */
+export const listElectronTargets = async (provider, input, options = {}) => {
+    const ready = requireProvider(provider, "list_electron_targets");
+    if (!ready.ok)
+        return ready;
+    const result = await ready.value.listTargets(input, options);
+    return result.ok
+        ? ok(createElectronEvidence("list_electron_targets", input, result.value, ready.value.identity()))
+        : result;
+};
+/** Inspect one local file page from the explicitly selected endpoint. */
+export const inspectElectronPage = async (provider, input, options = {}) => {
+    const ready = requireProvider(provider, "inspect_electron_page");
+    if (!ready.ok)
+        return ready;
+    const result = await ready.value.inspectPage(input, options);
+    return result.ok
+        ? ok(createElectronEvidence("inspect_electron_page", input, result.value, ready.value.identity()))
+        : result;
+};
+const requireProvider = (provider, operation) => provider === undefined
+    ? err(new AnalysisCapabilityUnavailableError("rea-cdp-electron", operation, "Electron observation provider is not configured"))
+    : ok(provider);

package/dist/application/javascript/JavaScriptAnalysisControl.js

@@ -0,0 +1,34 @@
+import { setImmediate } from "node:timers/promises";
+import { ArtifactReaderFailure } from "../../artifacts/ArtifactReader.js";
+/** Reject cancelled application work before computing or publishing more results. */
+export const assertJavaScriptAnalysisActive = (signal) => {
+    if (signal?.aborted === true)
+        throw new ArtifactReaderFailure("cancelled", "JavaScript application analysis cancelled");
+};
+/** Let request control messages run, then recheck the current analysis intent. */
+export const checkpointJavaScriptAnalysis = async (signal) => {
+    assertJavaScriptAnalysisActive(signal);
+    await setImmediate();
+    assertJavaScriptAnalysisActive(signal);
+};
+/** Drive bounded owned-domain steps while permitting cancellation and control I/O. */
+export const completeJavaScriptAnalysisSteps = async (steps, signal) => {
+    let deadline = performance.now() + 8;
+    try {
+        for (;;) {
+            assertJavaScriptAnalysisActive(signal);
+            const step = steps.next();
+            if (step.done) {
+                assertJavaScriptAnalysisActive(signal);
+                return step.value;
+            }
+            if (performance.now() >= deadline) {
+                await checkpointJavaScriptAnalysis(signal);
+                deadline = performance.now() + 8;
+            }
+        }
+    }
+    finally {
+        steps.return?.();
+    }
+};

package/dist/application/javascript/JavaScriptApplicationEvidence.js

@@ -0,0 +1,49 @@
+import { createImmutableEvidenceSteps, } from "../../domain/evidence.js";
+import { JAVASCRIPT_APPLICATION_PROVIDER } from "../InvestigationProviders.js";
+import { freezeOwnedJsonSnapshotSteps } from "../../domain/immutableJson.js";
+import { rememberOwnedApplicationGraphEvidence } from "./JavaScriptApplicationEvidenceGraph.js";
+import { completeJavaScriptAnalysisSteps } from "./JavaScriptAnalysisControl.js";
+import { jsonValueValidationSteps } from "../../domain/jsonValue.js";
+/** Create owned analysis Evidence while allowing request cancellation during sealing and hashing. */
+export const createOwnedJavaScriptApplicationEvidenceCooperatively = async (input, result, signal, progress) => {
+    await reportEvidencePhase(progress, "seal_javascript_application_result", "Sealing the complete application analysis result");
+    const snapshot = await completeJavaScriptAnalysisSteps(freezeOwnedJsonSnapshotSteps(result), signal);
+    await reportEvidencePhase(progress, "validate_javascript_application_evidence", "Validating the immutable application Evidence JSON");
+    // The Evidence envelope consumes the completed immutable validation cache.
+    await completeJavaScriptAnalysisSteps(jsonValueValidationSteps(snapshot), signal);
+    await reportEvidencePhase(progress, "hash_javascript_application_evidence", "Hashing the complete application analysis Evidence");
+    const evidence = await completeJavaScriptAnalysisSteps(createImmutableEvidenceSteps(applicationSubject(snapshot), JAVASCRIPT_APPLICATION_PROVIDER, applicationObservation(input, snapshot)), signal);
+    return rememberOwnedApplicationGraphEvidence(evidence, snapshot);
+};
+const reportEvidencePhase = (progress, phase, message) => progress?.report({ phase, completed: 0, total: 1, message }) ??
+    Promise.resolve();
+const applicationSubject = (result) => ({
+    path: result.input_path,
+    sha256: result.root_artifact_sha256,
+    format: result.format,
+});
+const applicationObservation = (input, result) => ({
+    predicateType: "rea.javascript-application-analysis",
+    operation: "analyze_javascript_application",
+    parameters: parameters(input),
+    result,
+    rawResult: null,
+    confidence: "derived",
+    authority: "shipped-artifact",
+    environment: null,
+    limitations: result.limitations,
+    locations: [{ kind: "artifact-path", path: "artifact-root" }],
+});
+const parameters = (input) => ({
+    format: input.format,
+    integrity_policy: input.integrity_policy,
+    ...(input.max_semantic_nodes === undefined
+        ? {}
+        : { max_semantic_nodes: input.max_semantic_nodes }),
+    ...(input.max_semantic_nodes_per_file === undefined
+        ? {}
+        : { max_semantic_nodes_per_file: input.max_semantic_nodes_per_file }),
+    ...(input.source_paths === undefined
+        ? {}
+        : { source_paths: input.source_paths }),
+});

package/dist/application/javascript/JavaScriptApplicationEvidenceGraph.js

@@ -0,0 +1,173 @@
+import { JAVASCRIPT_APPLICATION_PROVIDER, JAVASCRIPT_RUNTIME_RECONCILIATION_PROVIDER, MANAGED_WORKFLOW_PROVIDER, } from "../InvestigationProviders.js";
+import { isImmutableEvidence, parseEvidence, } from "../../domain/evidence.js";
+import { AnalysisInputError, } from "../../domain/analysisErrorCore.js";
+import { projectInputIssues } from "../../domain/inputIssueProjection.js";
+import { err, ok } from "../../domain/result.js";
+import { z } from "zod";
+import { analyzeJavaScriptApplicationInputSchema, javascriptApplicationAnalysisResultSchema, } from "../../domain/javascript/javascriptApplicationAnalysis.js";
+import { javascriptRuntimeReconciliationResultSchema } from "../../domain/javascript/javascriptRuntimeReconciliationSchemas.js";
+import { managedApplicationGraphResultSchema } from "../../domain/managed/managedApplicationGraph.js";
+/** Convert typed parser issues into this workflow's caller-facing input error. */
+export const applicationGraphEvidenceInputError = (operation, failure) => new AnalysisInputError(operation, undefined, failure.issues);
+class InvalidApplicationGraphEvidence extends Error {
+    issues;
+    constructor(issues) {
+        super("Application graph Evidence failed input validation");
+        this.issues = issues;
+    }
+}
+const ownedApplicationSources = new WeakMap();
+/** Retain the producer-validated meaning of its exact immutable result snapshot. */
+export const rememberOwnedApplicationGraphEvidence = (evidence, result) => {
+    if (!isImmutableEvidence(evidence) ||
+        evidence.normalized_result !== result ||
+        evidence.operation !== "analyze_javascript_application" ||
+        !providerMatches(evidence, JAVASCRIPT_APPLICATION_PROVIDER))
+        throw new TypeError("Owned application Evidence must bind its exact validated immutable result");
+    ownedApplicationSources.set(evidence, Object.freeze(staticApplicationSourceForResult(evidence, result, [])));
+    return evidence;
+};
+/** Parse and authenticate one REA-produced JavaScript Application Graph Evidence. */
+export const parseApplicationGraphEvidence = (input, path = []) => captureInputValidation(() => {
+    const evidence = parseEvidenceInput(input, path);
+    const owned = ownedApplicationSources.get(evidence);
+    if (owned !== undefined)
+        return owned;
+    if (evidence.operation === "analyze_javascript_application") {
+        requirePredicate(evidence, "rea.javascript-application-analysis", path);
+        requireProvider(evidence, JAVASCRIPT_APPLICATION_PROVIDER, path);
+        return staticApplicationSource(evidence, path);
+    }
+    if (evidence.operation === "reconcile_javascript_runtime") {
+        requirePredicate(evidence, "rea.javascript-runtime-reconciliation", path);
+        requireProvider(evidence, JAVASCRIPT_RUNTIME_RECONCILIATION_PROVIDER, path);
+        return staticRuntimeSource(evidence, path);
+    }
+    if (evidence.operation === "project_managed_application_graph") {
+        requirePredicate(evidence, "rea.managed-application-graph", path);
+        requireProvider(evidence, MANAGED_WORKFLOW_PROVIDER, path);
+        return managedApplicationSource(evidence, path);
+    }
+    throw invalidEvidence(path, "operation", "Expected authenticated JavaScript analysis, runtime reconciliation, or managed application graph Evidence.");
+});
+const staticApplicationSource = (evidence, path) => {
+    const result = parseCallerValue((input) => javascriptApplicationAnalysisResultSchema.parse(input), evidence.normalized_result, [...path, "normalized_result"]);
+    return staticApplicationSourceForResult(evidence, result, path);
+};
+const staticApplicationSourceForResult = (evidence, result, path) => {
+    if (evidence.authority !== "shipped-artifact" ||
+        evidence.confidence !== "derived")
+        throw invalidEvidence(path, "authority", "JavaScript application Evidence must use shipped-artifact authority and derived confidence.");
+    if (evidence.predicate_type !== "rea.javascript-application-analysis")
+        throw invalidEvidence(path, "predicate_type", "JavaScript application Evidence predicate does not match its result shape.");
+    parseCallerValue((input) => analyzeJavaScriptApplicationInputSchema.parse(input), { input_path: result.input_path, ...evidence.parameters }, [...path, "parameters"]);
+    assertApplicationSubject(evidence, result, path);
+    return {
+        evidence,
+        graph: result.graph,
+        kind: "static-application",
+        rootArtifactSha256: result.root_artifact_sha256,
+        semanticGraph: result.semantic_graph,
+    };
+};
+const staticRuntimeSource = (evidence, path) => {
+    if (evidence.authority !== "analyst-inference" ||
+        evidence.confidence !== "inferred")
+        throw invalidEvidence(path, "authority", "Runtime reconciliation Evidence must use analyst-inference authority and inferred confidence.");
+    const result = parseCallerValue((input) => javascriptRuntimeReconciliationResultSchema.parse(input), evidence.normalized_result, [...path, "normalized_result"]);
+    const unmatchedLink = result.evidence_links.find((evidenceId) => !evidence.evidence_links.includes(evidenceId));
+    if (unmatchedLink !== undefined)
+        throw invalidEvidence([...path, "normalized_result"], "evidence_links", `Runtime reconciliation result references Evidence ${unmatchedLink} outside its envelope.`);
+    const applicationLayer = result.static_layers.find(({ role }) => role === "application");
+    if (applicationLayer === undefined)
+        throw invalidEvidence([...path, "normalized_result"], "static_layers", "Runtime reconciliation Evidence must include its application layer.");
+    return {
+        evidence,
+        graph: result.graph,
+        kind: "static-runtime-reconciliation",
+        rootArtifactSha256: applicationLayer.root_artifact_sha256,
+        semanticGraph: null,
+    };
+};
+const managedApplicationSource = (evidence, path) => {
+    if (evidence.authority !== "analyst-inference" ||
+        evidence.confidence !== "inferred")
+        throw invalidEvidence(path, "authority", "Managed application graph Evidence must use analyst-inference authority and inferred confidence.");
+    const result = parseCallerValue((input) => managedApplicationGraphResultSchema.parse(input), evidence.normalized_result, [...path, "normalized_result"]);
+    const unmatchedLink = result.evidence_links.find((evidenceId) => !evidence.evidence_links.includes(evidenceId));
+    if (unmatchedLink !== undefined)
+        throw invalidEvidence([...path, "normalized_result"], "evidence_links", `Managed application graph result references Evidence ${unmatchedLink} outside its envelope.`);
+    return {
+        evidence,
+        graph: result.graph,
+        kind: "managed-application",
+        rootArtifactSha256: result.root_artifact_sha256,
+        semanticGraph: null,
+    };
+};
+const assertApplicationSubject = (evidence, result, path) => {
+    if (evidence.subject === null ||
+        evidence.subject.digest.sha256 !== result.root_artifact_sha256 ||
+        evidence.subject.format !== result.format ||
+        evidence.subject.local_path !== result.input_path)
+        throw invalidEvidence(path, "subject", "JavaScript application Evidence subject must match the analyzed artifact identity and input path.");
+};
+const providerMatches = (evidence, provider) => evidence.provider.id === provider.id &&
+    evidence.provider.name === provider.name &&
+    evidence.provider.version === provider.version;
+const requirePredicate = (evidence, expected, path) => {
+    if (evidence.predicate_type !== expected)
+        throw invalidEvidence(path, "predicate_type", `Expected predicate ${expected} for operation ${evidence.operation}.`);
+};
+const requireProvider = (evidence, expected, path) => {
+    if (!providerMatches(evidence, expected))
+        throw invalidEvidence(path, "provider", `Expected provider ${expected.id} v${expected.version} for operation ${evidence.operation}.`);
+};
+/** Parse unique, artifact-bound Evidence that may extend a native handoff. */
+export const parseNativeApplicationEvidence = (inputs, path = []) => captureInputValidation(() => {
+    const parsed = inputs.map((input, index) => parseEvidenceInput(input, [...path, index]));
+    const withoutSubject = parsed.findIndex(({ subject }) => subject === null);
+    if (withoutSubject !== -1)
+        throw invalidEvidence([...path, withoutSubject], "subject", "Native handoff Evidence requires an artifact subject.");
+    const ids = parsed.map(({ evidence_id: id }) => id);
+    if (new Set(ids).size !== ids.length)
+        throw invalidEvidence(path, "evidence_id", "Native handoff Evidence must be unique.");
+    return parsed;
+});
+const captureInputValidation = (operation) => {
+    try {
+        return ok(operation());
+    }
+    catch (cause) {
+        if (cause instanceof InvalidApplicationGraphEvidence)
+            return err({ issues: cause.issues });
+        throw cause;
+    }
+};
+const parseEvidenceInput = (input, path) => {
+    try {
+        return parseEvidence(input);
+    }
+    catch (cause) {
+        if (cause instanceof z.ZodError)
+            throw zodInputFailure(cause, input, path);
+        throw cause;
+    }
+};
+const parseCallerValue = (parse, input, path) => {
+    try {
+        return parse(input);
+    }
+    catch (cause) {
+        if (cause instanceof z.ZodError)
+            throw zodInputFailure(cause, input, path);
+        throw cause;
+    }
+};
+const zodInputFailure = (cause, input, path) => new InvalidApplicationGraphEvidence(projectInputIssues(cause.issues, input).map((issue) => ({
+    ...issue,
+    path: [...path, ...issue.path],
+})));
+const invalidEvidence = (path, field, message) => new InvalidApplicationGraphEvidence([
+    { path: [...path, field], reason: "invalid_value", message },
+]);