rea/src/application/javascript/JavaScriptApplicationEvidence.ts

import {
  createEvidence,
  type Evidence,
  type EvidenceObservation,
} from "../../domain/evidence.js";
import type {
  AnalyzeJavaScriptApplicationInput,
  JavaScriptApplicationAnalysisResult,
} from "../../domain/javascript/javascriptApplicationAnalysis.js";
import { JAVASCRIPT_APPLICATION_PROVIDER } from "../InvestigationProviders.js";
import { freezeJsonSnapshot } from "../../domain/immutableJson.js";
import { rememberOwnedApplicationGraphEvidence } from "./JavaScriptApplicationEvidenceGraph.js";

/** Transfer an already validated, application-owned result into immutable analysis Evidence. */
export const createOwnedJavaScriptApplicationEvidence = (
  input: AnalyzeJavaScriptApplicationInput,
  result: JavaScriptApplicationAnalysisResult,
): Evidence =>
  rememberOwnedApplicationGraphEvidence(
    createJavaScriptApplicationEvidence(input, freezeJsonSnapshot(result)),
    result,
  );

/** Create Evidence for one deterministic local JavaScript application graph. */
export const createJavaScriptApplicationEvidence = (
  input: AnalyzeJavaScriptApplicationInput,
  result: JavaScriptApplicationAnalysisResult,
): Evidence =>
  createEvidence(
    {
      path: result.input_path,
      sha256: result.root_artifact_sha256,
      format: result.format,
    },
    JAVASCRIPT_APPLICATION_PROVIDER,
    {
      predicateType: "rea.javascript-application-analysis",
      operation: "analyze_javascript_application",
      parameters: parameters(input),
      result,
      rawResult: null,
      confidence: "derived",
      authority: "shipped-artifact",
      environment: null,
      limitations: result.limitations,
      locations: [{ kind: "artifact-path", path: "artifact-root" }],
    },
  );

const parameters = (
  input: AnalyzeJavaScriptApplicationInput,
): EvidenceObservation["parameters"] => ({
  format: input.format,
  integrity_policy: input.integrity_policy,
});