rea/docs/javascript-application-graph.md

JavaScript Application Graph

JavaScript Application Graph is REA's provider-neutral domain model for connecting shipped application bytes, JavaScript structure, Electron process boundaries, passive browser observations, and native add-ons. It is a durable, canonical data contract; it is not an extractor or a new CLI/MCP tool.

The implementation is pure and side-effect free. It validates caller-supplied facts, derives semantic identifiers, enforces graph integrity, and serializes verified graphs as RFC 8785 canonical JSON. It performs no filesystem or CDP I/O, does not evaluate JavaScript, and has no application-specific node kinds.

Layer boundary

The graph complements existing REA models instead of replacing them:

Existing model	Responsibility	Application Graph use
Artifact graph	Content-addressed containers, byte occurrences, and extraction boundaries	Supplies artifact identities and exact paths
Web bundle analysis	Bounded AST, chunk, route, endpoint, and source-map observations	Supplies static nodes and relationships
Browser/Electron observation	Authorized passive CDP metadata and runtime captures	Supplies runtime instances and observed_as relationships
Native analysis	Provider-qualified binary functions, symbols, and references	Supplies native add-on/export observations
JavaScript Application Graph	Cross-layer entity identity, evidence-bearing relationships, and canonical commitments	Preserves the combined application model

The shipped JavaScript artifact reconstruction service projects bounded directory/ASAR, package, bundle, source-map, BrowserWindow, preload, contextBridge, IPC, utility-process, and JavaScript-side native binding facts into this graph. The separate static/runtime reconciliation service adds capture-scoped targets, frames, scripts, workers, and inferred observed_as edges from already-produced Evidence. Native binary export verification remains a separate later layer. The domain graph itself never reaches outward to obtain any of those facts.

Stored record

A stored graph has this top-level shape:

schema: "JavaScriptApplicationGraph"
graph_id: jag_<sha256 of normalized graph semantics>
root_node_ids: jag_node_<sha256>[]
nodes: application entities with one or more observations
edges: directed evidence-bearing relationships
coverage: complete, partial, unknown, or unavailable
limitations: explicit graph-wide constraints

Parsing rejects unknown fields, non-canonical ordering, duplicate IDs, stale semantic commitments, missing roots, dangling endpoints, self-edges, and changed_from edges between unlike node kinds. Constructors normalize set-like arrays before deriving their IDs.

Entities and relationships

The node vocabulary covers:

• package, installer, and artifact;
• ASAR entry;
• Electron main, preload, renderer, and utility process code;
• JavaScript asset, chunk, and module;
• source map and original source module;
• BrowserWindow, frame, and target;
• contextBridge API, IPC channel, and IPC handler;
• worker and service worker;
• endpoint and storage;
• native add-on and native export;
• runtime script instance;
• an explicit unknown kind when classification is not justified.

Static network endpoints can have resolution: "partial" when the analyzer recognizes a request call but cannot resolve its target to one exact value. The observation's <