map: runtime parameter coordinates, spans and fingerprints (schema v2)

[patchstackdave]

Track 1 of the agreed two-track plan — finish trusted coordinates before building candidate generation, without blurring them.

Stacked on #123. This branch includes #123's commit (full-path matching + exact sink-call ownership); merge that first and this diff shrinks to its own commits.

The point

Give a server everything it needs to compile a map input into a rule-engine parameter — and refuse to emit a coordinate it cannot compile.

Every input now carries source and runtimeParameter:

{ "name": "shipping.email", "source": "server-fn-data", "runtimeParameter": "post.shipping.email" }

source	coordinate
json-body / form-body / multipart / body / server-fn-data	post.<dotted path>
query	get.<name>
cookie	cookie.<name>
file	files.<field>
header	server.HTTP_<UPPER_SNAKE>

Server-function args map to post.* because createServerFnGuard delivers them as the JSON body.

Two cases deliberately return null + a reason

Both verified against engine/request.js, not assumed — a coordinate the resolver can't resolve compiles into a rule that silently never matches, which is worse than emitting none:

• Route params have no coordinate. The resolver exposes get/post/request/cookie/server.*/files — not req.params. Emitting get.tenant would be a dead rule.
• Array paths have no dotted coordinate. #getNestedValue walks own properties, so tags[].label needs an array_key_value rule instead.

ruleGeneratable, separate from confidence

{ "confidence": "precise", "ruleGeneratable": false,
  "ruleGeneratableReasons": ["sink argument role is not modelled yet"] }

precise means the source reaches the sink — not authorization to block traffic. Every remaining obstacle is listed, so this doubles as the improvement queue. Nothing is generatable yet: sink argument roles are unmodelled, which is exactly the Track-2 gate.

Coordinates you can invalidate

Endpoints and sinks carry start/end (documented as UTF-16 offsets), and endpoints a content fingerprint, so a server can reject stale coordinates after a deploy. Schema version bumped to 2.

A recall bug the example outputs caught

Generating sample maps exposed that the highest-value flows never reached precise: req.body.webhookUrl produced read path body.webhookUrl while the input is namespace-relative (webhookUrl). Fixed — SSRF / traversal / command-injection now come out precise with correct coordinates, and are covered by tests. The residual risk direction is a false negative, not a false positive.

Also: PS_MAP_DEBUG surfaces extractor errors — the per-file fail-open is right for production but made a crash indistinguishable from an unparseable file, and it hid a self-recursion bug during this change.

798 tests green; typecheck clean.

[coderbuds]

Adds runtime parameter coordinates and spans to input map schema v2.

🎯 Quality: 91% Elite · 📦 Size: Extra Large — strongly consider breaking this down

🛡️ Standards: no pre-flight fit check ran for this change — wire assess-change-fit into your coding agents to catch size before opening.

📈 This month: Your 57th PR — above team average · Averaging Excellent

_{See how your team is trending →}

[patchstackdave]

/review