From f7c5062e4b341fd9a72628eec7aa21c4f44e44dd Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 13:57:16 +0000
Subject: [PATCH] webdetect: check service language level vs Node; advisory
 runtime APIs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two follow-ups after the merged web-app work.

Service language-version check (gating): a service's own .js is
tokenized for its ES syntax level and checked against each firmware's
bundled Node.js version (EsLevel::min_node_version). This is the
trustworthy, code-derived Node requirement that replaces the untrusted
engines.node — a service using optional chaining now correctly fails on
Node 12 and passes on Node 16.

Runtime-API detection (advisory, polyfill-aware): unambiguous namespaced
APIs (Object.assign, Object.entries/fromEntries, Array.from,
Promise.allSettled, globalThis, Reflect.*, ...) are detected from the
token stream and flagged when newer than the target engine/Node — a
"may need polyfills" note that never gates. Prototype methods are
excluded (ambiguous receiver). Crucially, testing real packages showed
bundles ship core-js/babel-runtime that merely *reference* every API, so
the advisory is suppressed when a polyfill library is detected; the
component is instead noted as self-polyfilling.

JS token analysis (ES features + APIs + polyfill sniffing) is factored
into a shared js module used by both web-app and service detection.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNiK747P4W8C2M9RRhRFS3
---
 common/verify/src/ipk/mod.rs           | 113 +++++--
 common/webdetect/src/eslevel.rs        |  25 ++
 common/webdetect/src/js.rs             | 446 +++++++++++++++++++++++++
 common/webdetect/src/lib.rs            |  24 ++
 common/webdetect/src/service.rs        |  18 +-
 common/webdetect/src/web.rs            | 258 +-------------
 packages/ipk-verify/src/main.rs        | 121 ++++++-
 packages/ipk-verify/src/output.rs      |  26 ++
 packages/ipk-verify/tests/detection.rs |  58 ++--
 9 files changed, 777 insertions(+), 312 deletions(-)
 create mode 100644 common/webdetect/src/js.rs

diff --git a/common/verify/src/ipk/mod.rs b/common/verify/src/ipk/mod.rs
index 0354982..83421bd 100644
--- a/common/verify/src/ipk/mod.rs
+++ b/common/verify/src/ipk/mod.rs
@@ -39,15 +39,23 @@ pub enum DetectionResult {
         detection: WebAppDetection,
         /// The firmware's web engine (for rendering the compat column).
         engine: Option<WebEngine>,
-        /// Whether the firmware's engine supports the app's ES level.
+        /// Whether the firmware's engine supports the app's ES **syntax** level
+        /// (gating — syntax can't be polyfilled).
         es: CompatVerdict,
+        /// Whether the firmware's engine natively provides the runtime APIs the
+        /// app uses (advisory — APIs can be polyfilled).
+        api: CompatVerdict,
     },
     Service {
         detection: ServiceRuntimeDetection,
-        /// The firmware's Node.js version — informational only. There is no
-        /// compat verdict for services: `engines.node` isn't trusted and webOS
-        /// services carry no other reliable runtime requirement.
+        /// The firmware's Node.js version.
         available_node: Option<Version>,
+        /// Whether the firmware's Node.js supports the service's ES **syntax**
+        /// level (gating — derived from the code, not `engines.node`).
+        node: CompatVerdict,
+        /// Whether the firmware's Node.js natively provides the runtime APIs the
+        /// service uses (advisory).
+        api: CompatVerdict,
     },
 }
 
@@ -60,19 +68,27 @@ pub enum CompatVerdict {
 }
 
 impl DetectionResult {
-    /// The compatibility verdict for this component on this firmware, if it has
-    /// one. Services are informational only (no verdict).
-    pub fn verdict(&self) -> Option<&CompatVerdict> {
+    /// The gating compatibility verdict for this component on this firmware
+    /// (web app: ES syntax vs engine; service: ES syntax vs Node.js).
+    pub fn verdict(&self) -> &CompatVerdict {
         match self {
-            DetectionResult::WebApp { es, .. } => Some(es),
-            DetectionResult::Service { .. } => None,
+            DetectionResult::WebApp { es, .. } => es,
+            DetectionResult::Service { node, .. } => node,
         }
     }
 
-    /// Whether this component is definitively incompatible (a `Fail` verdict);
-    /// `Unknown`/no-verdict is not treated as incompatible.
+    /// The advisory runtime-API verdict — never gates compatibility.
+    pub fn api_advisory(&self) -> &CompatVerdict {
+        match self {
+            DetectionResult::WebApp { api, .. } => api,
+            DetectionResult::Service { api, .. } => api,
+        }
+    }
+
+    /// Whether this component is definitively incompatible (a gating `Fail`);
+    /// `Unknown` and the advisory API verdict never count.
     pub fn is_incompatible(&self) -> bool {
-        matches!(self.verdict(), Some(CompatVerdict::Fail { .. }))
+        matches!(self.verdict(), CompatVerdict::Fail { .. })
     }
 }
 
@@ -134,11 +150,17 @@ impl VerifyForFirmware for Package {
 
 fn web_detection(app: &Component<AppInfo>, engine: Option<&WebEngine>) -> Option<DetectionResult> {
     let detection = app.info.web.clone()?;
-    let es = web_verdict(detection.es_level, engine);
+    let es = web_verdict(detection.es_level, engine, "app uses");
+    // Advisory: highest ES level implied by the runtime APIs used.
+    let api_level = detection.es_apis.iter().map(|a| a.level).max();
+    let api = web_verdict(api_level, engine, "app calls APIs from").demote_reason(
+        "may need polyfills",
+    );
     return Some(DetectionResult::WebApp {
         detection,
         engine: engine.cloned(),
         es,
+        api,
     });
 }
 
@@ -147,34 +169,81 @@ fn service_detection(
     node: Option<&Version>,
 ) -> Option<DetectionResult> {
     let detection = svc.info.runtime.clone()?;
+    let node_verdict = service_verdict(detection.es_level, node, "service uses");
+    let api_level = detection.es_apis.iter().map(|a| a.level).max();
+    let api = service_verdict(api_level, node, "service calls APIs from")
+        .demote_reason("may need polyfills");
     return Some(DetectionResult::Service {
         detection,
         available_node: node.cloned(),
+        node: node_verdict,
+        api,
     });
 }
 
-/// Does the firmware's web engine support the app's required ES level?
-fn web_verdict(es_level: Option<EsLevel>, engine: Option<&WebEngine>) -> CompatVerdict {
+/// Whether the firmware's web engine supports the given ES level.
+fn web_verdict(es_level: Option<EsLevel>, engine: Option<&WebEngine>, verb: &str) -> CompatVerdict {
     let Some(es_level) = es_level else {
         return CompatVerdict::Unknown;
     };
-    let fw_max = match engine {
-        Some(WebEngine::Chromium(v)) => EsLevel::from_chromium_major(v.major as u32),
-        // The LG WebKit port (537.x) predates reliable ES2015 support.
-        Some(WebEngine::WebKit(_)) => EsLevel::Es5,
-        None => return CompatVerdict::Unknown,
+    let Some(engine) = engine else {
+        return CompatVerdict::Unknown;
     };
+    let fw_max = engine_max_es(engine);
     if es_level <= fw_max {
         CompatVerdict::Ok
     } else {
         CompatVerdict::Fail {
             reason: format!(
-                "app uses {}, but {} supports up to {}",
+                "{verb} {}, but {} supports up to {}",
                 es_level.label(),
-                engine.map(|e| e.label()).unwrap_or_default(),
+                engine.label(),
                 fw_max.label()
             ),
         }
     }
 }
 
+/// Whether the firmware's Node.js supports the given ES level.
+fn service_verdict(es_level: Option<EsLevel>, node: Option<&Version>, verb: &str) -> CompatVerdict {
+    let Some(es_level) = es_level else {
+        return CompatVerdict::Unknown;
+    };
+    let Some(node) = node else {
+        return CompatVerdict::Unknown;
+    };
+    let (maj, min) = es_level.min_node_version();
+    if node.major > maj || (node.major == maj && node.minor >= min) {
+        CompatVerdict::Ok
+    } else {
+        CompatVerdict::Fail {
+            reason: format!(
+                "{verb} {}, which needs Node.js {maj}.{min}, but firmware ships {node}",
+                es_level.label(),
+            ),
+        }
+    }
+}
+
+/// The highest ES level a firmware's web engine supports.
+pub fn engine_max_es(engine: &WebEngine) -> EsLevel {
+    match engine {
+        WebEngine::Chromium(v) => EsLevel::from_chromium_major(v.major as u32),
+        // The LG WebKit port (537.x) predates reliable ES2015 support.
+        WebEngine::WebKit(_) => EsLevel::Es5,
+    }
+}
+
+impl CompatVerdict {
+    /// Rewrite a `Fail` reason's lead-in so the advisory reads as a polyfill
+    /// note rather than a hard failure. No-op for `Ok`/`Unknown`.
+    fn demote_reason(self, note: &str) -> CompatVerdict {
+        match self {
+            CompatVerdict::Fail { reason } => CompatVerdict::Fail {
+                reason: format!("{reason} ({note})"),
+            },
+            other => other,
+        }
+    }
+}
+
diff --git a/common/webdetect/src/eslevel.rs b/common/webdetect/src/eslevel.rs
index ab939d3..2f07d16 100644
--- a/common/webdetect/src/eslevel.rs
+++ b/common/webdetect/src/eslevel.rs
@@ -53,6 +53,23 @@ impl EsLevel {
         EsLevel::Es5
     }
 
+    /// Minimum Node.js major/minor that supports the syntax this level implies
+    /// (V8 landing points). Used to check a service's own code against the
+    /// firmware's bundled Node.js — a trustworthy, code-derived requirement
+    /// (unlike `engines.node`, which isn't read).
+    pub fn min_node_version(self) -> (u64, u64) {
+        match self {
+            EsLevel::Es5 => (0, 10),
+            EsLevel::Es2015 => (6, 0), // let/const/arrow/class/template/spread
+            EsLevel::Es2016 => (7, 0), // ** exponentiation
+            EsLevel::Es2017 => (7, 6), // async/await
+            EsLevel::Es2018 => (10, 0), // object spread, async iteration
+            EsLevel::Es2019 => (12, 0),
+            EsLevel::Es2020 => (14, 0), // optional chaining, nullish coalescing
+            EsLevel::Es2021Plus => (15, 0),
+        }
+    }
+
     pub fn label(self) -> &'static str {
         match self {
             EsLevel::Es5 => "ES5",
@@ -136,6 +153,14 @@ mod tests {
         assert_eq!(EsLevel::from_chromium_major(0), EsLevel::Es5);
     }
 
+    #[test]
+    fn min_node_versions_are_ordered() {
+        assert_eq!(EsLevel::Es5.min_node_version(), (0, 10));
+        assert_eq!(EsLevel::Es2017.min_node_version(), (7, 6));
+        assert_eq!(EsLevel::Es2020.min_node_version(), (14, 0));
+        assert!(EsLevel::Es2020.min_node_version() > EsLevel::Es2015.min_node_version());
+    }
+
     #[test]
     fn feature_levels_order() {
         assert!(EsFeature::OptionalChaining.level() > EsFeature::AsyncAwait.level());
diff --git a/common/webdetect/src/js.rs b/common/webdetect/src/js.rs
new file mode 100644
index 0000000..5a6b034
--- /dev/null
+++ b/common/webdetect/src/js.rs
@@ -0,0 +1,446 @@
+//! Shared JavaScript analysis: gather `.js` sources and, from a `ress` token
+//! stream, derive the ES syntax level and any notable runtime-API usage.
+//!
+//! Used by both web-app detection (checked against the firmware's web engine)
+//! and service detection (checked against the firmware's Node.js). Tokenizing
+//! means keywords/operators/identifiers inside strings, comments and regex
+//! literals are ignored.
+
+use std::collections::{BTreeMap, HashSet};
+use std::fs;
+use std::path::Path;
+
+use ress::prelude::*;
+
+use crate::eslevel::{EsFeature, EsLevel};
+use crate::ApiUse;
+
+/// Skip individual files larger than this.
+pub(crate) const MAX_FILE_BYTES: u64 = 8 * 1024 * 1024;
+/// Stop after scanning this many JS files.
+const MAX_JS_FILES: usize = 400;
+/// Recursion depth cap for the directory walk.
+const MAX_DEPTH: usize = 12;
+
+/// The result of analyzing a set of JS sources.
+pub(crate) struct JsAnalysis {
+    pub es_level: Option<EsLevel>,
+    pub es_features: Vec<EsFeature>,
+    pub es_apis: Vec<ApiUse>,
+}
+
+/// Recursively gather `*.js` file contents (skipping source maps), bounded by
+/// the depth/count/size caps above.
+pub(crate) fn collect_js(dir: &Path, depth: usize, out: &mut Vec<(String, String)>) {
+    if depth > MAX_DEPTH || out.len() >= MAX_JS_FILES {
+        return;
+    }
+    let Ok(entries) = fs::read_dir(dir) else {
+        return;
+    };
+    for entry in entries.flatten() {
+        if out.len() >= MAX_JS_FILES {
+            return;
+        }
+        let path = entry.path();
+        let Ok(ft) = entry.file_type() else { continue };
+        if ft.is_dir() {
+            collect_js(&path, depth + 1, out);
+            continue;
+        }
+        if !ft.is_file() {
+            continue;
+        }
+        let name = entry.file_name().to_string_lossy().to_string();
+        if !name.ends_with(".js") || name.ends_with(".map") {
+            continue;
+        }
+        if entry.metadata().map(|m| m.len()).unwrap_or(u64::MAX) > MAX_FILE_BYTES {
+            continue;
+        }
+        if let Ok(content) = fs::read(&path) {
+            out.push((name, String::from_utf8_lossy(&content).into_owned()));
+        }
+    }
+}
+
+/// Analyze JS sources for ES syntax level and static runtime-API usage.
+/// `html_module` marks a `<script type="module">` (web only) as an extra
+/// engine-level signal. Returns `es_level = None` only when there is nothing to
+/// analyze (no JS and no module tag).
+pub(crate) fn analyze_js(js: &[(String, String)], html_module: bool) -> JsAnalysis {
+    let mut features: HashSet<EsFeature> = HashSet::new();
+    let mut apis: BTreeMap<String, EsLevel> = BTreeMap::new();
+    for (_, content) in js {
+        scan_js_tokens(content, &mut features, &mut apis);
+    }
+    if html_module {
+        features.insert(EsFeature::EsModule);
+    }
+
+    let es_apis: Vec<ApiUse> = apis
+        .into_iter()
+        .map(|(name, level)| ApiUse { name, level })
+        .collect();
+
+    if js.is_empty() && !html_module {
+        return JsAnalysis {
+            es_level: None,
+            es_features: Vec::new(),
+            es_apis,
+        };
+    }
+
+    // Emit features in a stable, oldest-first order for readable output.
+    let order = [
+        EsFeature::LetConst,
+        EsFeature::Arrow,
+        EsFeature::TemplateLiteral,
+        EsFeature::Class,
+        EsFeature::Spread,
+        EsFeature::Exponent,
+        EsFeature::AsyncAwait,
+        EsFeature::EsModule,
+        EsFeature::OptionalChaining,
+        EsFeature::NullishCoalescing,
+    ];
+    let es_features: Vec<EsFeature> = order.into_iter().filter(|f| features.contains(f)).collect();
+    let es_level = Some(
+        es_features
+            .iter()
+            .map(|f| f.level())
+            .max()
+            .unwrap_or(EsLevel::Es5),
+    );
+    JsAnalysis {
+        es_level,
+        es_features,
+        es_apis,
+    }
+}
+
+/// Tokenize one JS source, recording ES syntax features and static API uses.
+///
+/// `?.`/`??` are reconstructed from an adjacent `?`+`.`/`?` pair (this lexer
+/// predates them). `async` is a contextual keyword (an identifier), counted
+/// only when followed by `function`/`(`/an identifier. Static APIs are matched
+/// as `Global . member` token sequences (`Object.assign`) or bare globals
+/// (`globalThis`), so only real code — not strings/comments — is considered.
+fn scan_js_tokens(
+    content: &str,
+    features: &mut HashSet<EsFeature>,
+    apis: &mut BTreeMap<String, EsLevel>,
+) {
+    let mut pending_question_end: Option<usize> = None;
+    let mut pending_async = false;
+    // For member-API detection: the identifier right before a `.`.
+    let mut ident_before_dot: Option<String> = None;
+    let mut expect_member = false;
+
+    for item in Scanner::new(content) {
+        let Ok(item) = item else {
+            break; // lex error → keep what we have (conservative)
+        };
+        let span = item.span;
+
+        if pending_async {
+            pending_async = false;
+            let is_async_fn = matches!(&item.token, Token::Keyword(Keyword::Function(_)))
+                || matches!(&item.token, Token::Ident(_))
+                || matches!(&item.token, Token::Punct(Punct::OpenParen));
+            if is_async_fn {
+                features.insert(EsFeature::AsyncAwait);
+            }
+        }
+
+        if let Some(q_end) = pending_question_end.take() {
+            if span.start == q_end {
+                match &item.token {
+                    Token::Punct(Punct::Period) => {
+                        features.insert(EsFeature::OptionalChaining);
+                    }
+                    Token::Punct(Punct::QuestionMark) => {
+                        features.insert(EsFeature::NullishCoalescing);
+                    }
+                    _ => {}
+                }
+            }
+        }
+
+        // `.` keeps the previous identifier as a potential API receiver;
+        // every other token clears it (handled per-arm below).
+        let is_period = matches!(&item.token, Token::Punct(Punct::Period));
+
+        match &item.token {
+            Token::Keyword(Keyword::Let(_)) | Token::Keyword(Keyword::Const(_)) => {
+                features.insert(EsFeature::LetConst);
+            }
+            Token::Keyword(Keyword::Class(_)) => {
+                features.insert(EsFeature::Class);
+            }
+            Token::Keyword(Keyword::Await(_)) => {
+                features.insert(EsFeature::AsyncAwait);
+            }
+            Token::Template(_) => {
+                features.insert(EsFeature::TemplateLiteral);
+            }
+            Token::Ident(id) => {
+                let s = id.as_ref();
+                // `Global.member` API (receiver captured before the dot).
+                if expect_member {
+                    if let Some(recv) = &ident_before_dot {
+                        if let Some(level) = static_api_level(recv, s) {
+                            apis.insert(format!("{recv}.{s}"), level);
+                        }
+                    }
+                }
+                // Bare global API (e.g. `globalThis`).
+                if let Some(level) = bare_api_level(s) {
+                    apis.insert(s.to_string(), level);
+                }
+                if s == "async" {
+                    pending_async = true;
+                }
+            }
+            Token::Punct(p) => match p {
+                Punct::EqualGreaterThan => {
+                    features.insert(EsFeature::Arrow);
+                }
+                Punct::Ellipsis => {
+                    features.insert(EsFeature::Spread);
+                }
+                Punct::DoubleAsterisk | Punct::DoubleAsteriskEqual => {
+                    features.insert(EsFeature::Exponent);
+                }
+                Punct::QuestionMark => {
+                    pending_question_end = Some(span.end);
+                }
+                _ => {}
+            },
+            _ => {}
+        }
+
+        // Maintain the receiver/member state machine.
+        match &item.token {
+            Token::Ident(id) => {
+                ident_before_dot = Some(id.as_ref().to_string());
+                expect_member = false;
+            }
+            Token::Punct(Punct::Period) => {
+                expect_member = ident_before_dot.is_some();
+            }
+            _ if !is_period => {
+                ident_before_dot = None;
+                expect_member = false;
+            }
+            _ => {}
+        }
+    }
+}
+
+/// Level for a `Global.member` static API, or `None` if unremarkable.
+/// Only unambiguous namespaced APIs are listed (prototype methods like
+/// `.includes`/`.flat` are excluded — their receiver type is unknowable).
+fn static_api_level(recv: &str, method: &str) -> Option<EsLevel> {
+    use EsLevel::*;
+    Some(match (recv, method) {
+        ("Object", "assign" | "getOwnPropertySymbols" | "setPrototypeOf") => Es2015,
+        ("Object", "values" | "entries" | "getOwnPropertyDescriptors") => Es2017,
+        ("Object", "fromEntries") => Es2019,
+        ("Array", "from" | "of") => Es2015,
+        ("Promise", "allSettled") => Es2020,
+        ("Promise", "any") => Es2021Plus,
+        (
+            "Number",
+            "isInteger" | "isNaN" | "isFinite" | "isSafeInteger" | "parseFloat" | "parseInt",
+        ) => Es2015,
+        (
+            "Math",
+            "trunc" | "sign" | "cbrt" | "hypot" | "clz32" | "log2" | "log10" | "fround" | "expm1",
+        ) => Es2015,
+        ("String", "raw" | "fromCodePoint") => Es2015,
+        ("Reflect", _) => Es2015, // any Reflect.* is ES2015
+        _ => return None,
+    })
+}
+
+/// Level for a bare global identifier, or `None`.
+fn bare_api_level(name: &str) -> Option<EsLevel> {
+    use EsLevel::*;
+    Some(match name {
+        "globalThis" | "BigInt" => Es2020,
+        "WeakRef" | "FinalizationRegistry" => Es2021Plus,
+        _ => return None,
+    })
+}
+
+/// Detect bundled polyfill/shim libraries. When present, the app supplies the
+/// runtime APIs itself, so the API advisory is meaningless (the bundle
+/// *references* every API to feature-detect/define it) and must be suppressed.
+/// Returns canonical library names.
+pub(crate) fn detect_polyfills(js: &[(String, String)]) -> Vec<String> {
+    let mut found: BTreeMap<&str, ()> = BTreeMap::new();
+    for (_, c) in js {
+        if c.contains("core-js") || c.contains("__core-js_shared__") {
+            found.insert("core-js", ());
+        }
+        if c.contains("@babel/runtime")
+            || c.contains("_interopRequireDefault")
+            || c.contains("babelHelpers")
+        {
+            found.insert("@babel/runtime", ());
+        }
+        if c.contains("regeneratorRuntime") {
+            found.insert("regenerator", ());
+        }
+        if c.contains("es5-shim") || c.contains("es6-shim") {
+            found.insert("es-shims", ());
+        }
+    }
+    found.into_keys().map(String::from).collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn js(content: &str) -> Vec<(String, String)> {
+        vec![("bundle.js".to_string(), content.to_string())]
+    }
+
+    fn apis(src: &str) -> Vec<String> {
+        analyze_js(&js(src), false)
+            .es_apis
+            .into_iter()
+            .map(|a| a.name)
+            .collect()
+    }
+
+    #[test]
+    fn detects_static_namespaced_apis() {
+        let a = apis("Object.assign({}, x); Object.entries(y); Array.from(z); Promise.allSettled(p);");
+        assert!(a.contains(&"Object.assign".to_string()));
+        assert!(a.contains(&"Object.entries".to_string()));
+        assert!(a.contains(&"Array.from".to_string()));
+        assert!(a.contains(&"Promise.allSettled".to_string()));
+    }
+
+    #[test]
+    fn api_levels_are_correct() {
+        let found = analyze_js(&js("Object.fromEntries(x); Object.assign(y);"), false).es_apis;
+        let lvl = |n: &str| found.iter().find(|a| a.name == n).map(|a| a.level);
+        assert_eq!(lvl("Object.fromEntries"), Some(EsLevel::Es2019));
+        assert_eq!(lvl("Object.assign"), Some(EsLevel::Es2015));
+    }
+
+    #[test]
+    fn detects_bare_globals() {
+        assert!(apis("var g = globalThis; var n = BigInt(1);").contains(&"globalThis".to_string()));
+    }
+
+    #[test]
+    fn prototype_methods_are_not_reported() {
+        // `.includes`/`.flat` on an unknown receiver must NOT be flagged.
+        let a = apis("myArr.includes(3); list.flat(); s.padStart(2);");
+        assert!(a.is_empty());
+    }
+
+    #[test]
+    fn apis_in_strings_are_ignored() {
+        let a = apis(r#"var s = "Object.assign is nice"; // Object.entries(x)"#);
+        assert!(a.is_empty());
+    }
+
+    #[test]
+    fn detects_bundled_polyfills() {
+        assert_eq!(
+            detect_polyfills(&js("require('core-js/modules/es.object.assign');")),
+            vec!["core-js".to_string()]
+        );
+        assert!(detect_polyfills(&js("function _interopRequireDefault(o){}")).contains(&"@babel/runtime".to_string()));
+        assert!(detect_polyfills(&js("var x = regeneratorRuntime.mark(f);")).contains(&"regenerator".to_string()));
+        assert!(detect_polyfills(&js("var plain = 1;")).is_empty());
+    }
+
+    #[test]
+    fn shadowed_object_still_flags_but_syntax_is_clean() {
+        // Tokenizer can't do type inference; `Object.assign` is still flagged.
+        // This is acceptable for an advisory (never a hard verdict).
+        assert!(apis("Object.assign(a, b);").contains(&"Object.assign".to_string()));
+    }
+
+    // --- ES syntax level ---
+
+    fn es(src: &str, module: bool) -> (Option<EsLevel>, Vec<EsFeature>) {
+        let a = analyze_js(&js(src), module);
+        (a.es_level, a.es_features)
+    }
+
+    #[test]
+    fn es_level_is_max_feature() {
+        let (level, feats) = es("const x = a?.b; let y = async () => await z;", false);
+        assert_eq!(level, Some(EsLevel::Es2020)); // optional chaining
+        assert!(feats.contains(&EsFeature::OptionalChaining));
+        assert!(feats.contains(&EsFeature::AsyncAwait));
+        assert!(feats.contains(&EsFeature::Arrow));
+        assert!(feats.contains(&EsFeature::LetConst));
+    }
+
+    #[test]
+    fn detects_nullish_coalescing() {
+        let (level, feats) = es("var x = a ?? b;", false);
+        assert_eq!(level, Some(EsLevel::Es2020));
+        assert!(feats.contains(&EsFeature::NullishCoalescing));
+    }
+
+    #[test]
+    fn es5_bundle_reads_as_es5() {
+        let (level, feats) = es("var x = 1; function f() { return x; }", false);
+        assert_eq!(level, Some(EsLevel::Es5));
+        assert!(feats.is_empty());
+    }
+
+    #[test]
+    fn features_inside_strings_and_comments_are_ignored() {
+        let src = r#"
+            // const x = () => {}; a ** b; a?.b; a ?? b; async function q(){}
+            var s = "const y = async () => await z ** 2 ?? w ?.p";
+            var t = `template-looking ${'but a string'}`;
+            var u = 1;
+        "#;
+        let (level, feats) = es(src, false);
+        assert!(!feats.contains(&EsFeature::AsyncAwait));
+        assert!(!feats.contains(&EsFeature::Arrow));
+        assert!(!feats.contains(&EsFeature::Exponent));
+        assert!(!feats.contains(&EsFeature::OptionalChaining));
+        assert!(!feats.contains(&EsFeature::NullishCoalescing));
+        assert_eq!(level, Some(EsLevel::Es2015)); // only the real template literal
+        assert!(feats.contains(&EsFeature::TemplateLiteral));
+    }
+
+    #[test]
+    fn jsdoc_banner_is_not_an_exponent() {
+        let (level, feats) = es("/** @license v1 */ var x = 1;", false);
+        assert_eq!(level, Some(EsLevel::Es5));
+        assert!(!feats.contains(&EsFeature::Exponent));
+    }
+
+    #[test]
+    fn real_exponent_is_detected() {
+        let (_level, feats) = es("var y = a ** 2;", false);
+        assert!(feats.contains(&EsFeature::Exponent));
+    }
+
+    #[test]
+    fn async_identifier_variable_is_not_async_function() {
+        let (_level, feats) = es("var async = 1; var b = async + 2;", false);
+        assert!(!feats.contains(&EsFeature::AsyncAwait));
+    }
+
+    #[test]
+    fn script_module_raises_es_level_over_es5_bundle() {
+        let (level, feats) = es("var x = 1;", true);
+        assert_eq!(level, Some(EsLevel::Es2018));
+        assert!(feats.contains(&EsFeature::EsModule));
+    }
+}
diff --git a/common/webdetect/src/lib.rs b/common/webdetect/src/lib.rs
index 68157aa..443a907 100644
--- a/common/webdetect/src/lib.rs
+++ b/common/webdetect/src/lib.rs
@@ -9,6 +9,7 @@
 use semver::Version;
 
 mod eslevel;
+mod js;
 mod service;
 mod web;
 
@@ -16,6 +17,15 @@ pub use eslevel::{EsFeature, EsLevel};
 pub use service::detect_service_runtime;
 pub use web::detect_web_app;
 
+/// A notable static runtime API used by the code (e.g. `Object.assign`), with
+/// the ES level that introduced it. Advisory only — such APIs can be
+/// polyfilled, so their use never gates compatibility.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ApiUse {
+    pub name: String,
+    pub level: EsLevel,
+}
+
 /// What was detected about a web/frontend app.
 #[derive(Debug, Clone)]
 pub struct WebAppDetection {
@@ -30,6 +40,11 @@ pub struct WebAppDetection {
     pub es_level: Option<EsLevel>,
     /// The syntax features that evidence `es_level`.
     pub es_features: Vec<EsFeature>,
+    /// Notable static runtime APIs used (advisory — may be polyfilled).
+    pub es_apis: Vec<ApiUse>,
+    /// Bundled polyfill libraries detected (core-js, @babel/runtime, ...). When
+    /// non-empty the app self-polyfills, so the API advisory is suppressed.
+    pub polyfills: Vec<String>,
     /// Distinct remote resource URLs (`http(s)://` or `//host/...`) referenced
     /// by `index.html`. Informational — does not affect the compat verdict.
     pub remote_resources: Vec<String>,
@@ -86,4 +101,13 @@ pub struct ServiceRuntimeDetection {
     pub dependencies: Vec<(String, String)>,
     /// The `main` entry point, if declared.
     pub main: Option<String>,
+    /// Minimum ES level the service's own code requires — a code-derived,
+    /// trustworthy requirement checked against the firmware's Node.js version.
+    pub es_level: Option<EsLevel>,
+    /// The syntax features that evidence `es_level`.
+    pub es_features: Vec<EsFeature>,
+    /// Notable static runtime APIs used (advisory — may be polyfilled).
+    pub es_apis: Vec<ApiUse>,
+    /// Bundled polyfill libraries detected — suppresses the API advisory.
+    pub polyfills: Vec<String>,
 }
diff --git a/common/webdetect/src/service.rs b/common/webdetect/src/service.rs
index 30928de..c305504 100644
--- a/common/webdetect/src/service.rs
+++ b/common/webdetect/src/service.rs
@@ -6,6 +6,7 @@ use std::path::Path;
 
 use serde::Deserialize;
 
+use crate::js;
 use crate::ServiceRuntimeDetection;
 
 #[derive(Debug, Default, Deserialize)]
@@ -16,19 +17,28 @@ struct PackageJson {
     dependencies: BTreeMap<String, String>,
 }
 
-/// Read `<dir>/package.json` and extract the service's dependencies and entry
-/// point. Returns an empty detection when there is no parseable `package.json`
-/// (e.g. a QML or non-JS service).
+/// Inspect a service directory: read `package.json` for dependencies/entry
+/// point, and analyze the service's own `.js` code for its ES language level
+/// (checked against the firmware's Node.js) and runtime-API usage.
 ///
 /// Note: `engines.node` is deliberately NOT read — webOS services don't set it
-/// reliably, so it cannot be trusted as a runtime requirement.
+/// reliably. The ES level, by contrast, is derived from the actual code and so
+/// is trustworthy.
 pub fn detect_service_runtime(dir: &Path) -> ServiceRuntimeDetection {
     let text = fs::read_to_string(dir.join("package.json")).unwrap_or_default();
     let pkg: PackageJson = serde_json::from_str(&text).unwrap_or_default();
 
+    let mut sources: Vec<(String, String)> = Vec::new();
+    js::collect_js(dir, 0, &mut sources);
+    let analysis = js::analyze_js(&sources, false);
+
     ServiceRuntimeDetection {
         dependencies: pkg.dependencies.into_iter().collect(),
         main: pkg.main,
+        es_level: analysis.es_level,
+        es_features: analysis.es_features,
+        es_apis: analysis.es_apis,
+        polyfills: js::detect_polyfills(&sources),
     }
 }
 
diff --git a/common/webdetect/src/web.rs b/common/webdetect/src/web.rs
index 733987e..bf75d15 100644
--- a/common/webdetect/src/web.rs
+++ b/common/webdetect/src/web.rs
@@ -19,47 +19,42 @@ use std::path::Path;
 use std::sync::LazyLock;
 
 use regex::Regex;
-use ress::prelude::*;
 use semver::Version;
 
-use crate::eslevel::{EsFeature, EsLevel};
+use crate::js::{self, MAX_FILE_BYTES};
 use crate::{FrameworkInfo, FrameworkKind, WebAppDetection};
 
-/// Skip individual files larger than this (minified vendor blobs aside, real
-/// app code is far smaller); keeps a pathological package from blowing memory.
-const MAX_FILE_BYTES: u64 = 8 * 1024 * 1024;
-/// Stop after scanning this many JS files.
-const MAX_JS_FILES: usize = 400;
-/// Recursion depth cap for the directory walk.
-const MAX_DEPTH: usize = 12;
 /// Cap on distinct remote resource URLs reported.
 const MAX_REMOTE: usize = 20;
 
-/// Detect the framework, webOSTV.js SDK, ES syntax level and remote resources
-/// of the web app rooted at `dir`, whose HTML entry point is `index_html`.
+/// Detect the framework, webOSTV.js SDK, ES syntax level, runtime APIs and
+/// remote resources of the web app rooted at `dir`, whose HTML entry point is
+/// `index_html`.
 pub fn detect_web_app(dir: &Path, index_html: &Path) -> WebAppDetection {
     let html = read_capped(index_html);
 
-    let mut js: Vec<(String, String)> = Vec::new();
-    collect_js(dir, 0, &mut js);
+    let mut sources: Vec<(String, String)> = Vec::new();
+    js::collect_js(dir, 0, &mut sources);
 
     let signals = detect_html_signals(&html);
     // Many webOS apps (Enyo/Enact single-file builds) inline all JS into
     // index.html rather than shipping separate .js files; include those inline
     // scripts so ES-level detection sees them too.
     if !signals.inline_js.is_empty() {
-        js.push(("index.html".to_string(), signals.inline_js.clone()));
+        sources.push(("index.html".to_string(), signals.inline_js.clone()));
     }
     let (framework, also_present, webostvjs) =
-        detect_frameworks(&html, &js, signals.ng_version.as_deref());
-    let (es_level, es_features) = detect_es(&js, signals.has_module);
+        detect_frameworks(&html, &sources, signals.ng_version.as_deref());
+    let analysis = js::analyze_js(&sources, signals.has_module);
 
     WebAppDetection {
         framework,
         also_present,
         webostvjs,
-        es_level,
-        es_features,
+        es_level: analysis.es_level,
+        es_features: analysis.es_features,
+        es_apis: analysis.es_apis,
+        polyfills: js::detect_polyfills(&sources),
         remote_resources: signals.remote_resources,
     }
 }
@@ -73,41 +68,6 @@ fn read_capped(path: &Path) -> String {
     fs::read_to_string(path).unwrap_or_default()
 }
 
-/// Recursively gather `*.js` file contents (skipping source maps), bounded by
-/// the depth/count/size caps above.
-fn collect_js(dir: &Path, depth: usize, out: &mut Vec<(String, String)>) {
-    if depth > MAX_DEPTH || out.len() >= MAX_JS_FILES {
-        return;
-    }
-    let Ok(entries) = fs::read_dir(dir) else {
-        return;
-    };
-    for entry in entries.flatten() {
-        if out.len() >= MAX_JS_FILES {
-            return;
-        }
-        let path = entry.path();
-        let Ok(ft) = entry.file_type() else { continue };
-        if ft.is_dir() {
-            collect_js(&path, depth + 1, out);
-            continue;
-        }
-        if !ft.is_file() {
-            continue;
-        }
-        let name = entry.file_name().to_string_lossy().to_string();
-        if !name.ends_with(".js") || name.ends_with(".map") {
-            continue;
-        }
-        if entry.metadata().map(|m| m.len()).unwrap_or(u64::MAX) > MAX_FILE_BYTES {
-            continue;
-        }
-        if let Ok(content) = fs::read(&path) {
-            out.push((name, String::from_utf8_lossy(&content).into_owned()));
-        }
-    }
-}
-
 // ---------------------------------------------------------------------------
 // HTML signals (parsed DOM, not regex)
 // ---------------------------------------------------------------------------
@@ -342,124 +302,6 @@ fn detect_frameworks(
     (primary, found, webostvjs)
 }
 
-// ---------------------------------------------------------------------------
-// ES feature detection (token stream, not regex)
-// ---------------------------------------------------------------------------
-
-/// Scan the bundle for JS syntax features (plus the HTML `type="module"` flag)
-/// and derive the minimum ES level. Features are read from a `ress` token
-/// stream, so occurrences inside strings/comments/regex literals are ignored.
-fn detect_es(js: &[(String, String)], html_module: bool) -> (Option<EsLevel>, Vec<EsFeature>) {
-    let mut found: HashSet<EsFeature> = HashSet::new();
-    for (_, content) in js {
-        scan_js_features(content, &mut found);
-    }
-    if html_module {
-        found.insert(EsFeature::EsModule);
-    }
-    // Nothing to go on: no JS files and no module tag → level unknown.
-    if js.is_empty() && !html_module {
-        return (None, Vec::new());
-    }
-    // Emit in a stable, oldest-first order for readable output.
-    let order = [
-        EsFeature::LetConst,
-        EsFeature::Arrow,
-        EsFeature::TemplateLiteral,
-        EsFeature::Class,
-        EsFeature::Spread,
-        EsFeature::Exponent,
-        EsFeature::AsyncAwait,
-        EsFeature::EsModule,
-        EsFeature::OptionalChaining,
-        EsFeature::NullishCoalescing,
-    ];
-    let features: Vec<EsFeature> = order.into_iter().filter(|f| found.contains(f)).collect();
-    let level = features
-        .iter()
-        .map(|f| f.level())
-        .max()
-        .unwrap_or(EsLevel::Es5);
-    (Some(level), features)
-}
-
-/// Tokenize one JS source and record the ES features it uses.
-///
-/// `?.` and `??` are not single tokens in this lexer, so they are reconstructed
-/// from an adjacent `?` + `.`/`?` pair (adjacency rules out `a ? .5 : b`).
-/// `async` is a contextual keyword (an identifier here), so it only counts when
-/// immediately followed by `function`, `(`, or an identifier.
-fn scan_js_features(content: &str, found: &mut HashSet<EsFeature>) {
-    let mut pending_question_end: Option<usize> = None;
-    let mut pending_async = false;
-
-    for item in Scanner::new(content) {
-        let Ok(item) = item else {
-            break; // lex error → keep what we have (conservative)
-        };
-        let span = item.span;
-
-        if pending_async {
-            pending_async = false;
-            let is_async_fn = matches!(&item.token, Token::Keyword(Keyword::Function(_)))
-                || matches!(&item.token, Token::Ident(_))
-                || matches!(&item.token, Token::Punct(Punct::OpenParen));
-            if is_async_fn {
-                found.insert(EsFeature::AsyncAwait);
-            }
-        }
-
-        if let Some(q_end) = pending_question_end.take() {
-            if span.start == q_end {
-                match &item.token {
-                    Token::Punct(Punct::Period) => {
-                        found.insert(EsFeature::OptionalChaining);
-                    }
-                    Token::Punct(Punct::QuestionMark) => {
-                        found.insert(EsFeature::NullishCoalescing);
-                    }
-                    _ => {}
-                }
-            }
-        }
-
-        match &item.token {
-            Token::Keyword(Keyword::Let(_)) | Token::Keyword(Keyword::Const(_)) => {
-                found.insert(EsFeature::LetConst);
-            }
-            Token::Keyword(Keyword::Class(_)) => {
-                found.insert(EsFeature::Class);
-            }
-            Token::Keyword(Keyword::Await(_)) => {
-                found.insert(EsFeature::AsyncAwait);
-            }
-            Token::Template(_) => {
-                found.insert(EsFeature::TemplateLiteral);
-            }
-            // `async` is an identifier in this lexer; confirm it's a function.
-            Token::Ident(id) if id.as_ref() == "async" => {
-                pending_async = true;
-            }
-            Token::Punct(p) => match p {
-                Punct::EqualGreaterThan => {
-                    found.insert(EsFeature::Arrow);
-                }
-                Punct::Ellipsis => {
-                    found.insert(EsFeature::Spread);
-                }
-                Punct::DoubleAsterisk | Punct::DoubleAsteriskEqual => {
-                    found.insert(EsFeature::Exponent);
-                }
-                Punct::QuestionMark => {
-                    pending_question_end = Some(span.end);
-                }
-                _ => {}
-            },
-            _ => {}
-        }
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -585,78 +427,4 @@ mod tests {
         assert!(sig.inline_js.contains("async"));
         assert!(!sig.inline_js.contains("not")); // JSON script body excluded
     }
-
-    // --- ES features (ress token stream) ---
-
-    #[test]
-    fn es_level_is_max_feature() {
-        let (level, feats) = detect_es(&js("const x = a?.b; let y = async () => await z;"), false);
-        assert_eq!(level, Some(EsLevel::Es2020)); // optional chaining
-        assert!(feats.contains(&EsFeature::OptionalChaining));
-        assert!(feats.contains(&EsFeature::AsyncAwait));
-        assert!(feats.contains(&EsFeature::Arrow));
-        assert!(feats.contains(&EsFeature::LetConst));
-    }
-
-    #[test]
-    fn detects_nullish_coalescing() {
-        let (level, feats) = detect_es(&js("var x = a ?? b;"), false);
-        assert_eq!(level, Some(EsLevel::Es2020));
-        assert!(feats.contains(&EsFeature::NullishCoalescing));
-    }
-
-    #[test]
-    fn es5_bundle_reads_as_es5() {
-        let (level, feats) = detect_es(&js("var x = 1; function f() { return x; }"), false);
-        assert_eq!(level, Some(EsLevel::Es5));
-        assert!(feats.is_empty());
-    }
-
-    #[test]
-    fn features_inside_strings_and_comments_are_ignored() {
-        // The whole point of tokenizing: none of these are real syntax.
-        let src = r#"
-            // const x = () => {}; a ** b; a?.b; a ?? b; async function q(){}
-            var s = "const y = async () => await z ** 2 ?? w ?.p";
-            var t = `template-looking ${'but a string'}`;
-            var u = 1;
-        "#;
-        let (level, feats) = detect_es(&js(src), false);
-        // The backtick template IS real code here, so ES2015; but NO async,
-        // arrow, exponent, optional-chaining or nullish from the string/comment.
-        assert!(!feats.contains(&EsFeature::AsyncAwait));
-        assert!(!feats.contains(&EsFeature::Arrow));
-        assert!(!feats.contains(&EsFeature::Exponent));
-        assert!(!feats.contains(&EsFeature::OptionalChaining));
-        assert!(!feats.contains(&EsFeature::NullishCoalescing));
-        assert_eq!(level, Some(EsLevel::Es2015)); // only the real template literal
-        assert!(feats.contains(&EsFeature::TemplateLiteral));
-    }
-
-    #[test]
-    fn jsdoc_banner_is_not_an_exponent() {
-        let (level, feats) = detect_es(&js("/** @license v1 */ var x = 1;"), false);
-        assert_eq!(level, Some(EsLevel::Es5));
-        assert!(!feats.contains(&EsFeature::Exponent));
-    }
-
-    #[test]
-    fn real_exponent_is_detected() {
-        let (_level, feats) = detect_es(&js("var y = a ** 2;"), false);
-        assert!(feats.contains(&EsFeature::Exponent));
-    }
-
-    #[test]
-    fn async_identifier_variable_is_not_async_function() {
-        // `var async = 1;` must not be read as async/await usage.
-        let (_level, feats) = detect_es(&js("var async = 1; var b = async + 2;"), false);
-        assert!(!feats.contains(&EsFeature::AsyncAwait));
-    }
-
-    #[test]
-    fn script_module_raises_es_level_over_es5_bundle() {
-        let (level, feats) = detect_es(&js("var x = 1;"), true);
-        assert_eq!(level, Some(EsLevel::Es2018));
-        assert!(feats.contains(&EsFeature::EsModule));
-    }
 }
diff --git a/packages/ipk-verify/src/main.rs b/packages/ipk-verify/src/main.rs
index 8f6368b..a8d226f 100644
--- a/packages/ipk-verify/src/main.rs
+++ b/packages/ipk-verify/src/main.rs
@@ -303,11 +303,8 @@ fn print_detection_summary(
                     .chain(results.iter().map(|(_, r)| Cell::new(&web_engine_label(r))))
                     .collect(),
             ));
-            // Whether that engine supports the app's ES level.
-            let title = match web.es_level {
-                Some(level) => format!("{} support", level.label()),
-                None => "ES support".to_string(),
-            };
+            // Whether that engine supports the app's ES syntax level (gating).
+            let title = es_support_title(web.es_level);
             table.add_row(Row::new(
                 iter::once(Cell::new(&title))
                     .chain(
@@ -317,22 +314,58 @@ fn print_detection_summary(
                     )
                     .collect(),
             ));
+            // Advisory: runtime APIs the app uses (may need polyfills). Suppressed
+            // when the app bundles its own polyfills (the row would be moot).
+            if !web.es_apis.is_empty() && web.polyfills.is_empty() {
+                table.add_row(Row::new(
+                    iter::once(Cell::new("Runtime APIs"))
+                        .chain(results.iter().map(|(_, r)| out.advisory_cell(api_advisory(r), out_fmt)))
+                        .collect(),
+                ));
+            }
         }
         DetectionResult::Service { detection: svc, .. } => {
             out.write_fmt(format_args!("JS service — {}\n\n", describe_service(svc)))?;
-            // Each firmware's Node.js version — informational only; there is no
-            // reliable requirement to check a webOS service against.
+            // Each firmware's Node.js version.
             table.add_row(Row::new(
                 iter::once(Cell::new("Node.js (firmware)"))
                     .chain(results.iter().map(|(_, r)| Cell::new(&node_label(r))))
                     .collect(),
             ));
+            // Whether that Node.js supports the service's ES syntax level
+            // (gating; derived from code, not engines.node).
+            if svc.es_level.is_some() {
+                let title = es_support_title(svc.es_level);
+                table.add_row(Row::new(
+                    iter::once(Cell::new(&title))
+                        .chain(
+                            results
+                                .iter()
+                                .map(|(_, r)| out.verdict_cell(component_verdict(r), out_fmt)),
+                        )
+                        .collect(),
+                ));
+            }
+            if !svc.es_apis.is_empty() && svc.polyfills.is_empty() {
+                table.add_row(Row::new(
+                    iter::once(Cell::new("Runtime APIs"))
+                        .chain(results.iter().map(|(_, r)| out.advisory_cell(api_advisory(r), out_fmt)))
+                        .collect(),
+                ));
+            }
         }
     }
     out.print_table(&table)?;
     return Ok(());
 }
 
+fn es_support_title(level: Option<webdetect_lib::EsLevel>) -> String {
+    match level {
+        Some(level) => format!("{} support", level.label()),
+        None => "ES support".to_string(),
+    }
+}
+
 /// Render `--details` for a non-native component: syntax-feature / dependency
 /// evidence, then any firmware on which it is incompatible and why.
 fn print_detection_details(
@@ -354,22 +387,28 @@ fn print_detection_details(
                 let feats: Vec<&str> = web.es_features.iter().map(|f| f.label()).collect();
                 out.write_fmt(format_args!("* Language features used: {}\n", feats.join(", ")))?;
             }
+            print_api_details(&web.es_apis, &web.polyfills, out)?;
             for url in &web.remote_resources {
                 out.write_fmt(format_args!("* Remote resource: {url}\n"))?;
             }
         }
         DetectionResult::Service { detection: svc, .. } => {
             out.h4("JS service")?;
+            if !svc.es_features.is_empty() {
+                let feats: Vec<&str> = svc.es_features.iter().map(|f| f.label()).collect();
+                out.write_fmt(format_args!("* Language features used: {}\n", feats.join(", ")))?;
+            }
+            print_api_details(&svc.es_apis, &svc.polyfills, out)?;
             for (name, ver) in &svc.dependencies {
                 out.write_fmt(format_args!("* Dependency: {name} {ver}\n"))?;
             }
         }
     }
-    // Report incompatible firmwares with their reason.
+    // Report incompatible firmwares with their reason (gating verdicts only).
     let mut any_fail = false;
     for (fw, r) in results {
         if let Some(detection) = &r.detection {
-            if let Some(CompatVerdict::Fail { reason }) = detection.verdict() {
+            if let CompatVerdict::Fail { reason } = detection.verdict() {
                 if !any_fail {
                     out.h5("Incompatible on")?;
                     any_fail = true;
@@ -382,6 +421,34 @@ fn print_detection_details(
     return Ok(());
 }
 
+/// List the detected runtime APIs (advisory). When the component bundles its
+/// own polyfills, note that instead — the API list would be moot.
+fn print_api_details(
+    apis: &[webdetect_lib::ApiUse],
+    polyfills: &[String],
+    out: &mut Box<dyn ReportOutput>,
+) -> Result<(), Error> {
+    if !polyfills.is_empty() {
+        out.write_fmt(format_args!(
+            "* Bundles polyfills ({}) — runtime APIs are self-provided\n",
+            polyfills.join(", ")
+        ))?;
+        return Ok(());
+    }
+    if apis.is_empty() {
+        return Ok(());
+    }
+    let names: Vec<&str> = apis.iter().map(|a| a.name.as_str()).collect();
+    if let Some(level) = apis.iter().map(|a| a.level).max() {
+        out.write_fmt(format_args!(
+            "* Runtime APIs (up to {}, may need polyfills): {}\n",
+            level.label(),
+            names.join(", ")
+        ))?;
+    }
+    return Ok(());
+}
+
 fn framework_label(fw: &webdetect_lib::FrameworkInfo) -> String {
     match &fw.version {
         Some(v) => format!("{} {}", fw.kind.label(), v),
@@ -407,6 +474,9 @@ fn describe_web(web: &WebAppDetection) -> String {
     if let Some(level) = web.es_level {
         parts.push(format!("requires {}", level.label()));
     }
+    if !web.polyfills.is_empty() {
+        parts.push(format!("bundles polyfills ({})", web.polyfills.join(", ")));
+    }
     match web.remote_resources.len() {
         0 => {}
         1 => parts.push("loads 1 remote resource".to_string()),
@@ -419,23 +489,40 @@ fn describe_web(web: &WebAppDetection) -> String {
     }
 }
 
-/// One-line description of the detected JS service (dependencies only — its
-/// Node.js requirement is not inferable, see ServiceRuntimeDetection).
+/// One-line description of the detected JS service: its ES language level
+/// (checked against Node.js) and dependency count.
 fn describe_service(svc: &ServiceRuntimeDetection) -> String {
+    let mut parts: Vec<String> = vec!["Node.js service".to_string()];
+    if let Some(level) = svc.es_level {
+        parts.push(format!("requires {}", level.label()));
+    }
+    if !svc.polyfills.is_empty() {
+        parts.push(format!("bundles polyfills ({})", svc.polyfills.join(", ")));
+    }
     match svc.dependencies.len() {
-        0 => "Node.js service".to_string(),
-        1 => "Node.js service; 1 dependency".to_string(),
-        n => format!("Node.js service; {n} dependencies"),
+        0 => {}
+        1 => parts.push("1 dependency".to_string()),
+        n => parts.push(format!("{n} dependencies")),
     }
+    parts.join("; ")
 }
 
-/// The web app's ES compatibility verdict for a component result (Unknown if
-/// absent). Only web apps carry a verdict; services are informational.
+/// The gating ES compatibility verdict for a component result (Unknown if
+/// there is no detection).
 fn component_verdict(result: &ComponentVerifyResult) -> &CompatVerdict {
     result
         .detection
         .as_ref()
-        .and_then(|d| d.verdict())
+        .map(|d| d.verdict())
+        .unwrap_or(&CompatVerdict::Unknown)
+}
+
+/// The advisory runtime-API verdict for a component result.
+fn api_advisory(result: &ComponentVerifyResult) -> &CompatVerdict {
+    result
+        .detection
+        .as_ref()
+        .map(|d| d.api_advisory())
         .unwrap_or(&CompatVerdict::Unknown)
 }
 
diff --git a/packages/ipk-verify/src/output.rs b/packages/ipk-verify/src/output.rs
index e426a0d..832ee69 100644
--- a/packages/ipk-verify/src/output.rs
+++ b/packages/ipk-verify/src/output.rs
@@ -63,6 +63,32 @@ pub trait PrintTable {
         };
     }
 
+    /// Cell for an advisory (non-gating) runtime-API verdict: native support vs
+    /// "may need a polyfill". Rendered in a softer style than a hard FAIL.
+    fn advisory_cell(&self, verdict: &CompatVerdict, out_fmt: &OutputFormat) -> Cell {
+        return match verdict {
+            CompatVerdict::Ok => {
+                let mut cell = Cell::new(if *out_fmt == OutputFormat::Markdown {
+                    ":ok:"
+                } else {
+                    "native"
+                });
+                cell.style(Attr::ForegroundColor(color::BRIGHT_GREEN));
+                cell
+            }
+            CompatVerdict::Fail { .. } => {
+                let mut cell = Cell::new(if *out_fmt == OutputFormat::Markdown {
+                    ":warning:"
+                } else {
+                    "polyfill?"
+                });
+                cell.style(Attr::ForegroundColor(color::YELLOW));
+                cell
+            }
+            CompatVerdict::Unknown => Cell::new("—"),
+        };
+    }
+
     fn table_format(&self, out_fmt: &OutputFormat) -> TableFormat {
         match out_fmt {
             OutputFormat::Markdown => FormatBuilder::new()
diff --git a/packages/ipk-verify/tests/detection.rs b/packages/ipk-verify/tests/detection.rs
index a9be04d..6a64f12 100644
--- a/packages/ipk-verify/tests/detection.rs
+++ b/packages/ipk-verify/tests/detection.rs
@@ -33,6 +33,8 @@ fn web_app(es: EsLevel) -> Component<AppInfo> {
                 webostvjs: None,
                 es_level: Some(es),
                 es_features: vec![],
+                es_apis: vec![],
+                polyfills: vec![],
                 remote_resources: vec![],
             }),
         },
@@ -41,7 +43,7 @@ fn web_app(es: EsLevel) -> Component<AppInfo> {
     }
 }
 
-fn node_service(id: &str) -> Component<ServiceInfo> {
+fn node_service(id: &str, es: EsLevel) -> Component<ServiceInfo> {
     Component {
         id: id.to_string(),
         info: ServiceInfo {
@@ -51,6 +53,10 @@ fn node_service(id: &str) -> Component<ServiceInfo> {
             runtime: Some(ServiceRuntimeDetection {
                 dependencies: vec![("express".to_string(), "^4.18.0".to_string())],
                 main: None,
+                es_level: Some(es),
+                es_features: vec![],
+                es_apis: vec![],
+                polyfills: vec![],
             }),
         },
         exe: None,
@@ -77,14 +83,14 @@ fn web_app_es_level_checked_against_engine() {
 
     // Chromium 120 supports ES2017 → OK, component is good.
     let r = pkg.verify_for_firmware(&no_libs, None, Some(&WebEngine::Chromium(Version::new(120, 0, 0))));
-    assert_eq!(r.app.detection.as_ref().unwrap().verdict(), Some(&CompatVerdict::Ok));
+    assert_eq!(r.app.detection.as_ref().unwrap().verdict(), &CompatVerdict::Ok);
     assert!(r.app.is_good());
 
     // Chromium 53 (webOS 4) predates async/await → FAIL, component not good.
     let r = pkg.verify_for_firmware(&no_libs, None, Some(&WebEngine::Chromium(Version::new(53, 0, 2785))));
     assert!(matches!(
         r.app.detection.as_ref().unwrap().verdict(),
-        Some(CompatVerdict::Fail { .. })
+        CompatVerdict::Fail { .. }
     ));
     assert!(!r.app.is_good());
 
@@ -92,41 +98,45 @@ fn web_app_es_level_checked_against_engine() {
     let r = pkg.verify_for_firmware(&no_libs, None, Some(&WebEngine::WebKit(Version::new(537, 41, 0))));
     assert!(matches!(
         r.app.detection.as_ref().unwrap().verdict(),
-        Some(CompatVerdict::Fail { .. })
+        CompatVerdict::Fail { .. }
     ));
 
     // Firmware with no known web engine → Unknown, which must NOT fail the build.
     let r = pkg.verify_for_firmware(&no_libs, None, None);
-    assert_eq!(r.app.detection.as_ref().unwrap().verdict(), Some(&CompatVerdict::Unknown));
+    assert_eq!(r.app.detection.as_ref().unwrap().verdict(), &CompatVerdict::Unknown);
     assert!(r.app.is_good());
 }
 
 #[test]
-fn services_are_detected_but_never_fail_on_node() {
-    // engines.node is not trusted, so a JS service carries no compat verdict and
-    // must never fail the build regardless of the firmware's Node.js version.
+fn service_es_level_checked_against_node() {
+    // Service language level is code-derived (not engines.node) and gates:
+    // an ES2020 service (optional chaining → Node 14+) fails on Node 12,
+    // passes on Node 16; an ES5 service passes anywhere.
     let pkg = package(
         web_app(EsLevel::Es5),
         vec![
-            node_service("com.example.app.svc1"),
-            node_service("com.example.app.svc2"),
+            node_service("com.example.app.modern", EsLevel::Es2020),
+            node_service("com.example.app.legacy", EsLevel::Es5),
         ],
     );
 
-    let r = pkg.verify_for_firmware(
-        &no_libs,
-        Some(&Version::new(16, 20, 2)),
-        Some(&WebEngine::Chromium(Version::new(120, 0, 0))),
-    );
-    assert_eq!(r.services.len(), 2);
-    for svc in &r.services {
-        let detection = svc.detection.as_ref().unwrap();
-        assert!(detection.verdict().is_none()); // informational only
-        assert!(!detection.is_incompatible());
-        assert!(svc.is_good());
-    }
+    // webOS 7.4 ships Node 12.21 — too old for ES2020.
+    let r = pkg.verify_for_firmware(&no_libs, Some(&Version::new(12, 21, 0)), None);
+    assert!(matches!(
+        r.services[0].detection.as_ref().unwrap().verdict(),
+        CompatVerdict::Fail { .. }
+    ));
+    assert!(!r.services[0].is_good());
+    assert_eq!(r.services[1].detection.as_ref().unwrap().verdict(), &CompatVerdict::Ok);
+    assert!(r.services[1].is_good());
+
+    // webOS 10.2 ships Node 16.20 — supports ES2020.
+    let r = pkg.verify_for_firmware(&no_libs, Some(&Version::new(16, 20, 2)), None);
+    assert_eq!(r.services[0].detection.as_ref().unwrap().verdict(), &CompatVerdict::Ok);
+    assert!(r.services[0].is_good());
 
-    // Even with no Node package on the firmware, services stay good.
+    // Unknown firmware Node → Unknown, never a fail.
     let r = pkg.verify_for_firmware(&no_libs, None, None);
-    assert!(r.services.iter().all(|s| s.is_good()));
+    assert_eq!(r.services[0].detection.as_ref().unwrap().verdict(), &CompatVerdict::Unknown);
+    assert!(r.services[0].is_good());
 }