@bloodhound-rs/core 0.1.1 → 0.2.0

package/dist/types.d.ts

@@ -1,7 +1,10 @@
-export type ResourceKind = 'js' | 'html' | 'css' | 'asset';
-export type ScriptMode = 'classic' | 'module' | 'unknown';
-export type Environment = 'window' | 'worker' | 'unknown';
-export type ScanStatus = 'completed' | 'partial' | 'failed';
+/**
+ * Public types of `@bloodhound-rs/core`.
+ *
+ * These mirror the Rust data model in `native/src/model.rs`. The Rust side is
+ * the source of truth; keep field names and enum values in sync.
+ */
+/** Where a resource's bytes come from. */
 export type Source = {
     type: 'file';
     path: string;
@@ -11,234 +14,209 @@ export type Source = {
 } | {
     type: 'content';
     content: string;
-    resourceUrl: string;
+    /** Logical URL used to resolve relative dependencies and to label the resource. */
+    resourceUrl?: string;
 };
-export interface ImportMap {
-    imports?: Record<string, string | null>;
-    scopes?: Record<string, Record<string, string | null>>;
-}
-export interface Context {
-    scriptMode: ScriptMode;
-    executionEnvironment: Environment;
-    baseUrl?: string;
-    importMap?: ImportMap;
-    importMapBaseUrl?: string;
-    scopeKey: string;
-    publicPath?: string;
-    versions: Record<string, string>;
+export type ResourceKind = 'js' | 'html' | 'css';
+/**
+ * How a JavaScript resource executes. Top-level `var`/`function` in a classic
+ * script become `window` properties; in a module they stay module-local.
+ */
+export type ScriptMode = 'classic' | 'module';
+export type DependencyMode = 'single' | 'recursive';
+export interface ScanEntry {
+    kind: ResourceKind;
+    source: Source;
+    /** Overrides the logical URL of the source. */
+    resourceUrl?: string;
+    /** Script mode for JS entries. Defaults to `ScanOptions.scriptMode`. */
+    scriptMode?: ScriptMode;
 }
 export interface Budgets {
+    /** Maximum in-flight load-and-analysis jobs. Default 8, at most 256. */
     concurrency: number;
+    /** Worker count, capped by concurrency. Default: CPU count, at most 256. */
     analysisConcurrency: number;
+    /** Wall clock limit for the whole scan. Default 120 000. */
     timeoutMs: number;
+    /** Per-request network timeout. Default 30 000. */
     resourceTimeoutMs: number;
+    /** Maximum resources loaded. Default 500. */
     maxResources: number;
-    maxBytes: number;
+    /** Maximum size of one resource. Default 16 MiB. */
     maxResourceBytes: number;
-    maxBufferedBytes: number;
-    maxRecords: number;
+    /** Maximum total bytes loaded. Default 256 MiB. */
+    maxBytes: number;
+    /** Maximum dependency depth from an entry. Default 16. */
     maxDepth: number;
+    /** Maximum AST nodes visited per JavaScript resource. Default 2 000 000. */
     maxSteps: number;
+    /** Maximum string candidates tracked per value. Default 32. */
     maxCandidates: number;
-    maxSummaryPasses: number;
+    /** HTTP redirects followed per request. Default 5. */
     maxRedirects: number;
+    /** HTTP retries on transport failure. Default 1. */
     retries: number;
 }
+export interface Access {
+    /** Allowed URL schemes with trailing colon, e.g. `['https:']`. Default: file, http, https. */
+    protocols?: string[];
+    /** Allowed `host[:port]` values for network requests. */
+    hosts?: string[];
+    /** Directories that `file:` URLs must live inside. */
+    fileRoots?: string[];
+}
+export interface ImportMap {
+    imports?: Record<string, string | null>;
+    scopes?: Record<string, Record<string, string | null>>;
+}
+export interface ScanOptions {
+    /** Script mode for JS entries and for scripts whose mode is unknown. Default `classic`. */
+    scriptMode?: ScriptMode;
+    /** `single` analyzes only the entries; `recursive` follows dependencies. Default `recursive`. */
+    dependencyMode?: DependencyMode;
+    /** Logical URL for a string or content input (used by `scanHtml`/`scanJs`). */
+    resourceUrl?: string;
+    /** Document base when a resource has no usable URL of its own. */
+    baseUrl?: string;
+    /** Import map applied to standalone JS entries. HTML entries read their own. */
+    importMap?: ImportMap;
+    budgets?: Partial<Budgets>;
+    access?: Access;
+    /**
+     * Regex source strings (Rust regex syntax: no lookaround or backreferences) matched against
+     * the resolved logical URL of recursively discovered dependencies, e.g. `'/vendor/'` or
+     * `'\\.min\\.js($|\\?)'`. Matching dependencies are not loaded or analyzed and appear in
+     * `dependencies` as `not-followed` with `reason: 'excluded'`. Inline scripts are not matched.
+     * A matching entry, or an invalid pattern, rejects the scan (throws).
+     */
+    excludeUrls?: string[];
+    /** Substitute sources for resolved URLs (offline scanning of bundler output). */
+    resourceMappings?: Record<string, Source>;
+    /** Extra request headers keyed by `host[:port]`. */
+    requestHeaders?: Record<string, Record<string, string>>;
+    proxy?: string;
+    /** Decode `sourceMappingURL` comments and attach original locations. */
+    sourceMaps?: boolean;
+    /** Cancels a running scan. The result is a manifest with `status: 'cancelled'`. */
+    signal?: AbortSignal;
+}
+/**
+ * Pollution categories reported by the scanner.
+ *
+ * | rule                   | meaning                                                             |
+ * |------------------------|---------------------------------------------------------------------|
+ * | `global-write`         | `window.x = …`, top-level `var`/`function` in classic scripts       |
+ * | `document-write`       | `document.body.className = …`, `document.body.setAttribute(…)`      |
+ * | `builtin-mutation`     | `Array.prototype.x = …`, `Promise.allSettled = …`                   |
+ * | `host-api-override`    | `window.fetch = …`, `XMLHttpRequest.prototype.open = …`             |
+ * | `dom-insertion`        | `document.body.appendChild(…)`, `document.write(…)`                 |
+ * | `style-injection`      | `<style>`/`<link>` inserted by script without removal               |
+ * | `document-style-write` | `document.body.style.x = …`, `documentElement.style.setProperty(…)` |
+ * | `global-listener`      | `window.addEventListener(…)` without `removeEventListener`          |
+ * | `html-global-style`    | `style=` attribute on `<html>`/`<body>`                             |
+ */
+export type Rule = 'global-write' | 'document-write' | 'builtin-mutation' | 'host-api-override' | 'dom-insertion' | 'style-injection' | 'document-style-write' | 'global-listener' | 'html-global-style';
+export type Severity = 'info' | 'warning' | 'error';
+/**
+ * `high`: the receiver is provably the global object, `document`, or a builtin.
+ * `medium`: the receiver was tracked through a reassignable alias or a branch.
+ */
+export type Confidence = 'high' | 'medium';
+export type ScanStatus = 'completed' | 'partial' | 'failed' | 'cancelled';
+export type SourceStatus = 'completed' | 'partial' | 'failed';
+export type DependencyStatus = 'resolved' | 'not-followed' | 'unresolved';
+export type DependencyKind = 'script' | 'inline-script' | 'style' | 'module-preload' | 'iframe' | 'import' | 'dynamic-import' | 'worker' | 'dynamic-script' | 'dynamic-style';
+/** Lines are 1-based; columns are 0-based UTF-16 code units. */
 export interface Location {
-    start: number;
-    end: number;
     line: number;
     column: number;
     endLine: number;
     endColumn: number;
-    offsetEncoding: 'utf16';
+    /** Original position from a source map when `sourceMaps` was enabled. */
     original?: {
         source: string;
         line: number;
         column: number;
         name?: string;
     };
-    container?: {
-        resourceUrl: string;
-        offset: number;
-        line: number;
-        column: number;
-        approximate?: boolean;
-    };
 }
-export interface Resource {
-    resourceId: string;
-    requestedUrl: string;
-    finalUrl: string;
-    contentHash: string;
+export interface ManifestSource {
+    /** Manifest-local id such as `s1`. */
+    id: string;
     kind: ResourceKind;
-    bytes: number;
-    scmId?: string;
+    /** Logical URL. Absent for anonymous inline content. */
+    url?: string;
+    /** Present for inline scripts extracted from an HTML parent. */
     inline?: {
-        parentUrl: string;
-        offset: number;
-        approximate?: boolean;
+        parent: string;
+        line: number;
+        column: number;
     };
-}
-export interface AnalysisInstance {
-    analysisId: string;
-    resourceId: string;
-    contextHash: string;
-    context: Context;
-    scanStatus: ScanStatus;
-    exports: Record<string, unknown>;
-    sourceMapStatus: 'absent' | 'mapped' | 'unavailable';
-}
-export interface Reference {
-    referenceId: string;
-    fromAnalysisId: string;
-    toAnalysisIds: string[];
-    kind: string;
-    specifier?: string;
-    resolvedUrl?: string;
-    resolution: 'resolved' | 'candidate' | 'unresolved' | 'not-followed';
-    location: Location;
-    condition?: string;
-    attributes?: Record<string, string>;
-    reason?: string;
-}
-export interface Target {
-    targetId: string;
-    scopeKey: string;
-    namespace: string;
-    pathSegments: string[];
-    keyKind: string;
-}
-export interface GlobalAccess {
-    accessId: string;
-    analysisId: string;
-    targetRefs: string[];
+    scriptMode?: ScriptMode;
+    status: SourceStatus;
+    bytes: number;
+    contentHash: string;
+    /** Ids of the sources that referenced this one. Empty for entries. */
+    referrers: string[];
+    /** Shortest chain of source ids from an entry to this source, inclusive. */
+    chain: string[];
+}
+export interface ManifestFinding {
+    /** Source id containing the pollution. */
+    source: string;
+    rule: Rule;
+    severity: Severity;
+    /** Dotted path of the polluted target, e.g. `window.sharedConfig`. */
+    target: string;
+    /** `write` | `update` | `define` | `delete` | `declare` | `insert` | `listen` | `style`. */
     operation: string;
-    valueType: string;
+    confidence: Confidence;
     location: Location;
-    evidence: string[];
-    fingerprint: string;
+    /** Trimmed excerpt of the offending expression. */
+    snippet: string;
+    detail?: string;
 }
-export interface Finding {
-    findingId: string;
-    ruleId: string;
-    kind: 'global' | 'dom' | 'css';
-    analysisId: string;
-    accessRefs: string[];
+export interface ManifestDependency {
+    from: string;
+    /** Set when the dependency was resolved and analyzed. */
+    to?: string;
+    kind: DependencyKind;
+    specifier?: string;
+    url?: string;
+    status: DependencyStatus;
+    reason?: string;
     location: Location;
-    details: Record<string, unknown>;
-    fingerprint: string;
 }
-export interface Unresolved {
-    analysisId?: string;
-    referenceId?: string;
-    location?: Location;
+export interface ManifestGap {
+    source?: string;
     reason: string;
-    affectedCapabilities: string[];
+    count: number;
     detail?: string;
+    location?: Location;
 }
-export interface PendingResource {
-    kind: ResourceKind;
-    source: Source;
-    resourceUrl: string;
-    context: Context;
-    depth: number;
-    incoming: string[];
-    inline?: {
-        parentUrl: string;
-        offset: number;
-        parentContent: string;
-    };
-}
-export interface Checkpoint {
-    checkpointVersion: 1;
-    configHash: string;
-    entries: ScanEntry[];
-    pending: PendingResource[];
-    report: Report;
-    options?: Pick<ScanOptions, 'access' | 'resourceMappings' | 'sourceMaps'>;
-}
-export interface ScanEntry {
-    kind: ResourceKind;
-    source: Source;
-    resourceUrl?: string;
+export interface Summary {
+    sources: number;
+    findings: number;
+    errors: number;
+    warnings: number;
+    dependencies: number;
+    unresolved: number;
+    gaps: number;
+    bytes: number;
+    elapsedMs: number;
 }
-export interface Report {
-    schemaVersion: 1;
-    indexSchemaVersion: 1;
+/** The scan result. */
+export interface Manifest {
+    schemaVersion: 2;
     scannerVersion: string;
-    scanId: string;
-    scopeKey: string;
-    scanStatus: ScanStatus;
-    runStatus: 'finished' | 'cancelled';
-    startedAt: string;
-    finishedAt: string;
-    configuration: {
-        context: Context;
-        budgets: Budgets;
-        dependencyMode: 'single' | 'recursive';
-    };
-    entryAnalysisIds: string[];
-    resources: Resource[];
-    analysisInstances: AnalysisInstance[];
-    references: Reference[];
-    globalTargets: Target[];
-    globalAccesses: GlobalAccess[];
-    findings: Finding[];
-    unresolved: Unresolved[];
-    coverage: {
-        analyzed: number;
-        failed: number;
-        unresolved: number;
-        bytes: number;
-        dependencyMode: 'single' | 'recursive';
-        sourceMapped: number;
-        elapsedMs: number;
-    };
-}
-export interface ScanOptions {
-    scriptMode?: ScriptMode;
-    executionEnvironment?: Environment;
-    /** 离线资源的逻辑地址；直接扫描 URL 时无需重复设置。 */
-    resourceUrl?: string;
-    /** 补充文档基准；HTML 中的有效 base 标签会被自动读取。 */
-    baseUrl?: string;
-    /** 补充页面上下文，供单独扫描 JS 等场景使用；HTML 内的 Import Map 自动读取。 */
-    importMap?: ImportMap;
-    /** 外部传入 importMap 中相对地址的解析基准。 */
-    importMapBaseUrl?: string;
-    publicPath?: string;
-    scopeKey?: string;
-    scope?: Record<string, unknown>;
-    versions?: Record<string, string>;
-    dependencyMode?: 'single' | 'recursive';
-    budgets?: Partial<Budgets>;
-    signal?: AbortSignal;
-    access?: {
-        protocols?: string[];
-        hosts?: string[];
-        fileRoots?: string[];
-    };
-    /** 用本地文件或源码替代已解析的资源 URL；不是 HTML Import Map，普通页面扫描无需设置。 */
-    resourceMappings?: Record<string, Source>;
-    requestHeaders?: Record<string, Record<string, string>>;
-    proxy?: string;
-    jsonlPath?: string;
-    reportPath?: string;
-    checkpointPath?: string;
-    resumePath?: string;
-    sourceMaps?: boolean;
-    resume?: Checkpoint;
+    status: ScanStatus;
+    dependencyMode: DependencyMode;
+    summary: Summary;
+    /** Source ids of the entries, in request order. */
+    entries: string[];
+    sources: ManifestSource[];
+    findings: ManifestFinding[];
+    dependencies: ManifestDependency[];
+    gaps: ManifestGap[];
 }
-export type StreamRecord = {
-    type: 'resetAnalysis';
-    value: {
-        analysisId: string;
-    };
-} | {
-    type: keyof Pick<Report, 'resources' | 'analysisInstances' | 'references' | 'globalTargets' | 'globalAccesses' | 'findings' | 'unresolved'>;
-    value: unknown;
-} | {
-    type: 'summary';
-    value: Omit<Report, 'resources' | 'analysisInstances' | 'references' | 'globalTargets' | 'globalAccesses' | 'findings' | 'unresolved'>;
-};

package/dist/types.js

@@ -0,0 +1,8 @@
+/**
+ * Public types of `@bloodhound-rs/core`.
+ *
+ * These mirror the Rust data model in `native/src/model.rs`. The Rust side is
+ * the source of truth; keep field names and enum values in sync.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/package.json

@@ -1,53 +1,45 @@
 {
   "name": "@bloodhound-rs/core",
-  "version": "0.1.1",
-  "description": "Rust static resource scanner with a thin Node.js SDK",
+  "version": "0.2.0",
+  "description": "Rust static scanner that finds global-environment pollution in JavaScript and HTML",
   "type": "module",
   "license": "MIT",
   "engines": {
     "node": ">=22"
   },
-  "packageManager": "pnpm@10.20.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
-    },
-    "./schema": "./schemas/report.schema.json",
-    "./index-schema": "./schemas/index.schema.json"
+    }
   },
   "files": [
-    "dist",
-    "schemas",
+    "dist/*.js",
+    "dist/*.d.ts",
     "README.md",
-    "docs/support.md",
     "CHANGELOG.md"
   ],
-  "scripts": {
-    "build:native": "node scripts/build-native.mjs",
-    "build:ts": "tsc --emitDeclarationOnly",
-    "build": "node scripts/clean-dist.mjs && pnpm build:native && pnpm build:ts",
-    "typecheck": "tsc --noEmit --skipLibCheck false",
-    "prepack": "pnpm build",
-    "example": "node examples/scan.mjs",
-    "example:html": "node examples/scan-html.mjs",
-    "format": "prettier --write src scripts examples schemas README.md docs/support.md docs/verification.md .github .changeset docs/releasing.md package.json tsconfig.json",
-    "format:check": "prettier --check src scripts examples schemas README.md docs/support.md docs/verification.md .github .changeset docs/releasing.md package.json tsconfig.json",
-    "changeset": "changeset",
-    "changeset:status": "changeset status",
-    "version:packages": "changeset version && node scripts/sync-native-version.mjs"
-  },
   "devDependencies": {
     "@changesets/cli": "3.0.3",
     "@napi-rs/cli": "3.10.8",
     "@types/node": "^22.19.0",
     "prettier": "3.6.2",
-    "typescript": "^5.9.3"
+    "rolldown": "1.2.14",
+    "rollup": "^4.64.12",
+    "typescript": "^5.9.3",
+    "@bloodhound-rs/rollup-plugin": "0.2.0"
   },
   "napi": {
-    "binaryName": "bloodhound"
+    "binaryName": "bloodhound",
+    "targets": [
+      "x86_64-unknown-linux-gnu",
+      "aarch64-unknown-linux-gnu",
+      "aarch64-apple-darwin",
+      "x86_64-apple-darwin",
+      "x86_64-pc-windows-msvc"
+    ]
   },
   "publishConfig": {
     "access": "public",
@@ -57,5 +49,38 @@
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Justinidlerz/bloodhound.git"
+  },
+  "optionalDependencies": {
+    "@bloodhound-rs/core-darwin-arm64": "0.2.0",
+    "@bloodhound-rs/core-linux-arm64-gnu": "0.2.0",
+    "@bloodhound-rs/core-linux-x64-gnu": "0.2.0",
+    "@bloodhound-rs/core-win32-x64-msvc": "0.2.0",
+    "@bloodhound-rs/core-darwin-x64": "0.2.0"
+  },
+  "scripts": {
+    "build:native": "node scripts/build-native.mjs",
+    "build:ts": "tsc -p tsconfig.json",
+    "build:plugin": "pnpm --filter @bloodhound-rs/rollup-plugin build",
+    "build": "node scripts/clean-dist.mjs && pnpm build:native && pnpm build:ts && pnpm build:plugin",
+    "typecheck": "tsc --noEmit -p tsconfig.json && tsc --noEmit --strict --skipLibCheck --module NodeNext --target ES2023 tests/types.test.ts && pnpm --filter @bloodhound-rs/rollup-plugin typecheck && pnpm typecheck:playground",
+    "example": "node examples/scan.mjs",
+    "example:html": "node examples/scan-html.mjs",
+    "example:rollup": "rollup -c examples/rollup/rollup.config.mjs",
+    "example:rolldown": "rolldown -c examples/rollup/rolldown.config.mjs",
+    "playground": "node playground/scripts/dev.mjs",
+    "build:playground": "node playground/scripts/build.mjs",
+    "typecheck:playground": "tsc --noEmit -p playground/tsconfig.json",
+    "format": "prettier --write src scripts tests examples packages playground README.md docs .github .changeset package.json tsconfig.json npm pnpm-workspace.yaml",
+    "format:check": "prettier --check src scripts tests examples packages playground README.md docs .github .changeset package.json tsconfig.json npm pnpm-workspace.yaml",
+    "changeset": "changeset",
+    "changeset:status": "changeset status",
+    "version:packages": "changeset version && node scripts/sync-native-version.mjs && node scripts/sync-platform-packages.mjs",
+    "platforms:sync": "node scripts/sync-platform-packages.mjs",
+    "pack:release": "node scripts/pack-ci.mjs",
+    "test": "pnpm test:rust && pnpm test:scripts && pnpm build && pnpm typecheck && pnpm test:sdk && pnpm test:plugin",
+    "test:rust": "cargo test --locked --lib",
+    "test:scripts": "node --test tests/scripts.test.mjs tests/release.test.mjs",
+    "test:sdk": "node --test tests/sdk.test.mjs",
+    "test:plugin": "pnpm --filter @bloodhound-rs/rollup-plugin test"
   }
-}
+}

package/docs/support.md

@@ -1,55 +0,0 @@
-# 支持范围
-
-| 范围            | 实现                                                                      | 未完成项                                                                  |
-| --------------- | ------------------------------------------------------------------------- | ------------------------------------------------------------------------- |
-| JS 输入         | 文件、URL、内容，classic / module / unknown                               | 语法错误、模式或环境缺失                                                  |
-| 绑定与目标      | Oxc 作用域、局部遮蔽、全局词法与对象属性分离、未绑定引用                  | `with` 动态作用域                                                         |
-| 全局操作        | 声明、读、赋值、复合赋值、更新、delete、Object / Reflect、原型            | 未知属性键保留独立访问，不创建共享空目标                                  |
-| 别名            | 顺序赋值、失效、有限分支合并、直接 IIFE 与可绑定包装函数参数              | 复杂解构赋值、异常及 switch 的值传播、一般函数副作用                      |
-| 有限求值        | 字面量、拼接、模板、有限条件、数组与对象常量键、受限返回表达式            | getter、Proxy、一般调用、扩张超预算                                       |
-| ESM             | import / export、动态 import 候选、跨模块原始值摘要、有界迭代             | 非有限动态依赖、未知裸模块映射                                            |
-| webpack         | 运行时对象属性、纯 chunk 映射函数、脚本 src 表达式、有限 ID 表            | 自动 publicPath、复杂运行时函数及未知地址                                 |
-| Vite            | 动态 import；具有链接创建与回调调用结构的 preload 包装函数及有限依赖数组  | 一般缓存型 mapDeps 包装及非有限数组                                       |
-| DOM             | document / body / head 及别名的操作候选、可还原节点资源地址               | 未知节点身份、运行时插入、退出残留                                        |
-| Worker / iframe | 入口可解析时建立独立 scope，保留引用边                                    | 文档基准未知、动态子环境地址                                              |
-| HTML            | HTML5 分词、raw-text、base、Import Map 快照、脚本、样式、iframe、内联偏移 | foreign-content 树上下文、noscript 环境、token 恢复、事件处理器特殊作用域 |
-| CSS             | CSS Syntax 解析、@import、url、全局选择器、reset、自定义属性、动画        | 解析恢复、未知资源值；候选不代表实际匹配或污染                            |
-| source map      | Rust sourcemap，外链和 data URL                                           | 缺失或不可用只影响可选源码位置                                            |
-
-HTML 使用有位置的 HTML5 分词，不模拟完整浏览器 DOM 树构造。模板内容保持惰性，特殊树上下文明确降低覆盖。`srcdoc` 等实体解码内容的宿主定位只保留属性所属标签范围，子资源内部位置独立记录。
-
-webpack 适配按语法结构和 Oxc 绑定关联，不匹配固定的压缩变量名。chunk 映射给出有限候选，并不证明每个 chunk 都会加载。Vite 的普通动态 import 始终由 ESM 分析处理，preload 只是补充资源边。
-
-# 状态
-
-| 状态      | 含义                                             |
-| --------- | ------------------------------------------------ |
-| completed | 声明范围内没有已记录的必检缺口                   |
-| partial   | 有结果，同时存在未知依赖、上下文、语义或预算缺口 |
-| failed    | 没有建立有效分析结果                             |
-| cancelled | runStatus，独立于以上扫描状态                    |
-
-`single` 明确排除依赖闭包，引用边标记 `not-followed`。`completed` 不表示程序没有动态行为，也不表示候选问题实际发生。
-
-# 索引与位置
-
-- targetId 使用 scope、namespace、分段路径和键类型生成。局部 Symbol 额外绑定分析实例，不与其他资源合并。
-- 同内容不同 URL 或上下文保留独立实例，循环只阻止重复分析，保留引用边。
-- 未绑定裸引用保留候选关系，不能直接认定为隐式全局属性。
-- 产物位置采用 UTF-16 偏移、从 1 开始的行、从 0 开始的列，Rust 内部 UTF-8 偏移在输出时转换。
-- 多写入、原型变更、DOM/CSS 操作均为 static-candidate。
-- 版本差异匹配资源、scope、模式、环境、目标和操作特征。匹配不唯一时返回新增和移除。相同类型的任意值变化不保证识别。
-
-# 运行预算
-
-资源数、总字节、单资源字节、下载缓冲字节、并发、深度、时间、AST 访问、有限求值、候选数、摘要轮次和记录数都有上限。AST 在单资源分析后释放，缓存受字节预算限制。
-
-这些上限控制输入、任务和结果规模，不是操作系统 RSS 硬限额。大型或不可信输入可由宿主进程附加内存限制。网络阻塞受请求超时限制，解析阶段不承诺即时抢占。
-
-JSONL 支持消费端背压到文件系统。返回标准报告与内存索引会占用与记录规模相关的内存。恢复从保存的入口重建图并重新读取资源，当前不跳过远程内容校验。
-
-断点保留访问范围、资源映射和 source map 开关。认证请求头与代理参数不保存，恢复时重新传入。
-
-# 交付边界
-
-不包含平台数据库、发布 Guard、浏览器探针或线上发布。没有新增单元测试套件。真实产物扫描与构建证据不能替代完整的业务标注集精确率和召回率验收。