@bloodhound-rs/core 0.1.2 → 0.2.0

package/dist/types.d.ts

@@ -1,7 +1,10 @@
-export type ResourceKind = 'js' | 'html' | 'css' | 'asset';
-export type ScriptMode = 'classic' | 'module' | 'unknown';
-export type Environment = 'window' | 'worker' | 'unknown';
-export type ScanStatus = 'completed' | 'partial' | 'failed';
+/**
+ * Public types of `@bloodhound-rs/core`.
+ *
+ * These mirror the Rust data model in `native/src/model.rs`. The Rust side is
+ * the source of truth; keep field names and enum values in sync.
+ */
+/** Where a resource's bytes come from. */
 export type Source = {
     type: 'file';
     path: string;
@@ -11,234 +14,209 @@ export type Source = {
 } | {
     type: 'content';
     content: string;
-    resourceUrl: string;
+    /** Logical URL used to resolve relative dependencies and to label the resource. */
+    resourceUrl?: string;
 };
-export interface ImportMap {
-    imports?: Record<string, string | null>;
-    scopes?: Record<string, Record<string, string | null>>;
-}
-export interface Context {
-    scriptMode: ScriptMode;
-    executionEnvironment: Environment;
-    baseUrl?: string;
-    importMap?: ImportMap;
-    importMapBaseUrl?: string;
-    scopeKey: string;
-    publicPath?: string;
-    versions: Record<string, string>;
+export type ResourceKind = 'js' | 'html' | 'css';
+/**
+ * How a JavaScript resource executes. Top-level `var`/`function` in a classic
+ * script become `window` properties; in a module they stay module-local.
+ */
+export type ScriptMode = 'classic' | 'module';
+export type DependencyMode = 'single' | 'recursive';
+export interface ScanEntry {
+    kind: ResourceKind;
+    source: Source;
+    /** Overrides the logical URL of the source. */
+    resourceUrl?: string;
+    /** Script mode for JS entries. Defaults to `ScanOptions.scriptMode`. */
+    scriptMode?: ScriptMode;
 }
 export interface Budgets {
+    /** Maximum in-flight load-and-analysis jobs. Default 8, at most 256. */
     concurrency: number;
+    /** Worker count, capped by concurrency. Default: CPU count, at most 256. */
     analysisConcurrency: number;
+    /** Wall clock limit for the whole scan. Default 120 000. */
     timeoutMs: number;
+    /** Per-request network timeout. Default 30 000. */
     resourceTimeoutMs: number;
+    /** Maximum resources loaded. Default 500. */
     maxResources: number;
-    maxBytes: number;
+    /** Maximum size of one resource. Default 16 MiB. */
     maxResourceBytes: number;
-    maxBufferedBytes: number;
-    maxRecords: number;
+    /** Maximum total bytes loaded. Default 256 MiB. */
+    maxBytes: number;
+    /** Maximum dependency depth from an entry. Default 16. */
     maxDepth: number;
+    /** Maximum AST nodes visited per JavaScript resource. Default 2 000 000. */
     maxSteps: number;
+    /** Maximum string candidates tracked per value. Default 32. */
     maxCandidates: number;
-    maxSummaryPasses: number;
+    /** HTTP redirects followed per request. Default 5. */
     maxRedirects: number;
+    /** HTTP retries on transport failure. Default 1. */
     retries: number;
 }
+export interface Access {
+    /** Allowed URL schemes with trailing colon, e.g. `['https:']`. Default: file, http, https. */
+    protocols?: string[];
+    /** Allowed `host[:port]` values for network requests. */
+    hosts?: string[];
+    /** Directories that `file:` URLs must live inside. */
+    fileRoots?: string[];
+}
+export interface ImportMap {
+    imports?: Record<string, string | null>;
+    scopes?: Record<string, Record<string, string | null>>;
+}
+export interface ScanOptions {
+    /** Script mode for JS entries and for scripts whose mode is unknown. Default `classic`. */
+    scriptMode?: ScriptMode;
+    /** `single` analyzes only the entries; `recursive` follows dependencies. Default `recursive`. */
+    dependencyMode?: DependencyMode;
+    /** Logical URL for a string or content input (used by `scanHtml`/`scanJs`). */
+    resourceUrl?: string;
+    /** Document base when a resource has no usable URL of its own. */
+    baseUrl?: string;
+    /** Import map applied to standalone JS entries. HTML entries read their own. */
+    importMap?: ImportMap;
+    budgets?: Partial<Budgets>;
+    access?: Access;
+    /**
+     * Regex source strings (Rust regex syntax: no lookaround or backreferences) matched against
+     * the resolved logical URL of recursively discovered dependencies, e.g. `'/vendor/'` or
+     * `'\\.min\\.js($|\\?)'`. Matching dependencies are not loaded or analyzed and appear in
+     * `dependencies` as `not-followed` with `reason: 'excluded'`. Inline scripts are not matched.
+     * A matching entry, or an invalid pattern, rejects the scan (throws).
+     */
+    excludeUrls?: string[];
+    /** Substitute sources for resolved URLs (offline scanning of bundler output). */
+    resourceMappings?: Record<string, Source>;
+    /** Extra request headers keyed by `host[:port]`. */
+    requestHeaders?: Record<string, Record<string, string>>;
+    proxy?: string;
+    /** Decode `sourceMappingURL` comments and attach original locations. */
+    sourceMaps?: boolean;
+    /** Cancels a running scan. The result is a manifest with `status: 'cancelled'`. */
+    signal?: AbortSignal;
+}
+/**
+ * Pollution categories reported by the scanner.
+ *
+ * | rule                   | meaning                                                             |
+ * |------------------------|---------------------------------------------------------------------|
+ * | `global-write`         | `window.x = …`, top-level `var`/`function` in classic scripts       |
+ * | `document-write`       | `document.body.className = …`, `document.body.setAttribute(…)`      |
+ * | `builtin-mutation`     | `Array.prototype.x = …`, `Promise.allSettled = …`                   |
+ * | `host-api-override`    | `window.fetch = …`, `XMLHttpRequest.prototype.open = …`             |
+ * | `dom-insertion`        | `document.body.appendChild(…)`, `document.write(…)`                 |
+ * | `style-injection`      | `<style>`/`<link>` inserted by script without removal               |
+ * | `document-style-write` | `document.body.style.x = …`, `documentElement.style.setProperty(…)` |
+ * | `global-listener`      | `window.addEventListener(…)` without `removeEventListener`          |
+ * | `html-global-style`    | `style=` attribute on `<html>`/`<body>`                             |
+ */
+export type Rule = 'global-write' | 'document-write' | 'builtin-mutation' | 'host-api-override' | 'dom-insertion' | 'style-injection' | 'document-style-write' | 'global-listener' | 'html-global-style';
+export type Severity = 'info' | 'warning' | 'error';
+/**
+ * `high`: the receiver is provably the global object, `document`, or a builtin.
+ * `medium`: the receiver was tracked through a reassignable alias or a branch.
+ */
+export type Confidence = 'high' | 'medium';
+export type ScanStatus = 'completed' | 'partial' | 'failed' | 'cancelled';
+export type SourceStatus = 'completed' | 'partial' | 'failed';
+export type DependencyStatus = 'resolved' | 'not-followed' | 'unresolved';
+export type DependencyKind = 'script' | 'inline-script' | 'style' | 'module-preload' | 'iframe' | 'import' | 'dynamic-import' | 'worker' | 'dynamic-script' | 'dynamic-style';
+/** Lines are 1-based; columns are 0-based UTF-16 code units. */
 export interface Location {
-    start: number;
-    end: number;
     line: number;
     column: number;
     endLine: number;
     endColumn: number;
-    offsetEncoding: 'utf16';
+    /** Original position from a source map when `sourceMaps` was enabled. */
     original?: {
         source: string;
         line: number;
         column: number;
         name?: string;
     };
-    container?: {
-        resourceUrl: string;
-        offset: number;
-        line: number;
-        column: number;
-        approximate?: boolean;
-    };
 }
-export interface Resource {
-    resourceId: string;
-    requestedUrl: string;
-    finalUrl: string;
-    contentHash: string;
+export interface ManifestSource {
+    /** Manifest-local id such as `s1`. */
+    id: string;
     kind: ResourceKind;
-    bytes: number;
-    scmId?: string;
+    /** Logical URL. Absent for anonymous inline content. */
+    url?: string;
+    /** Present for inline scripts extracted from an HTML parent. */
     inline?: {
-        parentUrl: string;
-        offset: number;
-        approximate?: boolean;
+        parent: string;
+        line: number;
+        column: number;
     };
-}
-export interface AnalysisInstance {
-    analysisId: string;
-    resourceId: string;
-    contextHash: string;
-    context: Context;
-    scanStatus: ScanStatus;
-    exports: Record<string, unknown>;
-    sourceMapStatus: 'absent' | 'mapped' | 'unavailable';
-}
-export interface Reference {
-    referenceId: string;
-    fromAnalysisId: string;
-    toAnalysisIds: string[];
-    kind: string;
-    specifier?: string;
-    resolvedUrl?: string;
-    resolution: 'resolved' | 'candidate' | 'unresolved' | 'not-followed';
-    location: Location;
-    condition?: string;
-    attributes?: Record<string, string>;
-    reason?: string;
-}
-export interface Target {
-    targetId: string;
-    scopeKey: string;
-    namespace: string;
-    pathSegments: string[];
-    keyKind: string;
-}
-export interface GlobalAccess {
-    accessId: string;
-    analysisId: string;
-    targetRefs: string[];
+    scriptMode?: ScriptMode;
+    status: SourceStatus;
+    bytes: number;
+    contentHash: string;
+    /** Ids of the sources that referenced this one. Empty for entries. */
+    referrers: string[];
+    /** Shortest chain of source ids from an entry to this source, inclusive. */
+    chain: string[];
+}
+export interface ManifestFinding {
+    /** Source id containing the pollution. */
+    source: string;
+    rule: Rule;
+    severity: Severity;
+    /** Dotted path of the polluted target, e.g. `window.sharedConfig`. */
+    target: string;
+    /** `write` | `update` | `define` | `delete` | `declare` | `insert` | `listen` | `style`. */
     operation: string;
-    valueType: string;
+    confidence: Confidence;
     location: Location;
-    evidence: string[];
-    fingerprint: string;
+    /** Trimmed excerpt of the offending expression. */
+    snippet: string;
+    detail?: string;
 }
-export interface Finding {
-    findingId: string;
-    ruleId: string;
-    kind: 'global' | 'dom' | 'css';
-    analysisId: string;
-    accessRefs: string[];
+export interface ManifestDependency {
+    from: string;
+    /** Set when the dependency was resolved and analyzed. */
+    to?: string;
+    kind: DependencyKind;
+    specifier?: string;
+    url?: string;
+    status: DependencyStatus;
+    reason?: string;
     location: Location;
-    details: Record<string, unknown>;
-    fingerprint: string;
 }
-export interface Unresolved {
-    analysisId?: string;
-    referenceId?: string;
-    location?: Location;
+export interface ManifestGap {
+    source?: string;
     reason: string;
-    affectedCapabilities: string[];
+    count: number;
     detail?: string;
+    location?: Location;
 }
-export interface PendingResource {
-    kind: ResourceKind;
-    source: Source;
-    resourceUrl: string;
-    context: Context;
-    depth: number;
-    incoming: string[];
-    inline?: {
-        parentUrl: string;
-        offset: number;
-        parentContent: string;
-    };
-}
-export interface Checkpoint {
-    checkpointVersion: 1;
-    configHash: string;
-    entries: ScanEntry[];
-    pending: PendingResource[];
-    report: Report;
-    options?: Pick<ScanOptions, 'access' | 'resourceMappings' | 'sourceMaps'>;
-}
-export interface ScanEntry {
-    kind: ResourceKind;
-    source: Source;
-    resourceUrl?: string;
+export interface Summary {
+    sources: number;
+    findings: number;
+    errors: number;
+    warnings: number;
+    dependencies: number;
+    unresolved: number;
+    gaps: number;
+    bytes: number;
+    elapsedMs: number;
 }
-export interface Report {
-    schemaVersion: 1;
-    indexSchemaVersion: 1;
+/** The scan result. */
+export interface Manifest {
+    schemaVersion: 2;
     scannerVersion: string;
-    scanId: string;
-    scopeKey: string;
-    scanStatus: ScanStatus;
-    runStatus: 'finished' | 'cancelled';
-    startedAt: string;
-    finishedAt: string;
-    configuration: {
-        context: Context;
-        budgets: Budgets;
-        dependencyMode: 'single' | 'recursive';
-    };
-    entryAnalysisIds: string[];
-    resources: Resource[];
-    analysisInstances: AnalysisInstance[];
-    references: Reference[];
-    globalTargets: Target[];
-    globalAccesses: GlobalAccess[];
-    findings: Finding[];
-    unresolved: Unresolved[];
-    coverage: {
-        analyzed: number;
-        failed: number;
-        unresolved: number;
-        bytes: number;
-        dependencyMode: 'single' | 'recursive';
-        sourceMapped: number;
-        elapsedMs: number;
-    };
-}
-export interface ScanOptions {
-    scriptMode?: ScriptMode;
-    executionEnvironment?: Environment;
-    /** 离线资源的逻辑地址；直接扫描 URL 时无需重复设置。 */
-    resourceUrl?: string;
-    /** 补充文档基准；HTML 中的有效 base 标签会被自动读取。 */
-    baseUrl?: string;
-    /** 补充页面上下文，供单独扫描 JS 等场景使用；HTML 内的 Import Map 自动读取。 */
-    importMap?: ImportMap;
-    /** 外部传入 importMap 中相对地址的解析基准。 */
-    importMapBaseUrl?: string;
-    publicPath?: string;
-    scopeKey?: string;
-    scope?: Record<string, unknown>;
-    versions?: Record<string, string>;
-    dependencyMode?: 'single' | 'recursive';
-    budgets?: Partial<Budgets>;
-    signal?: AbortSignal;
-    access?: {
-        protocols?: string[];
-        hosts?: string[];
-        fileRoots?: string[];
-    };
-    /** 用本地文件或源码替代已解析的资源 URL；不是 HTML Import Map，普通页面扫描无需设置。 */
-    resourceMappings?: Record<string, Source>;
-    requestHeaders?: Record<string, Record<string, string>>;
-    proxy?: string;
-    jsonlPath?: string;
-    reportPath?: string;
-    checkpointPath?: string;
-    resumePath?: string;
-    sourceMaps?: boolean;
-    resume?: Checkpoint;
+    status: ScanStatus;
+    dependencyMode: DependencyMode;
+    summary: Summary;
+    /** Source ids of the entries, in request order. */
+    entries: string[];
+    sources: ManifestSource[];
+    findings: ManifestFinding[];
+    dependencies: ManifestDependency[];
+    gaps: ManifestGap[];
 }
-export type StreamRecord = {
-    type: 'resetAnalysis';
-    value: {
-        analysisId: string;
-    };
-} | {
-    type: keyof Pick<Report, 'resources' | 'analysisInstances' | 'references' | 'globalTargets' | 'globalAccesses' | 'findings' | 'unresolved'>;
-    value: unknown;
-} | {
-    type: 'summary';
-    value: Omit<Report, 'resources' | 'analysisInstances' | 'references' | 'globalTargets' | 'globalAccesses' | 'findings' | 'unresolved'>;
-};

package/dist/types.js

@@ -0,0 +1,8 @@
+/**
+ * Public types of `@bloodhound-rs/core`.
+ *
+ * These mirror the Rust data model in `native/src/model.rs`. The Rust side is
+ * the source of truth; keep field names and enum values in sync.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@bloodhound-rs/core",
-  "version": "0.1.2",
-  "description": "Rust static resource scanner with a thin Node.js SDK",
+  "version": "0.2.0",
+  "description": "Rust static scanner that finds global-environment pollution in JavaScript and HTML",
   "type": "module",
   "license": "MIT",
   "engines": {
@@ -13,16 +13,12 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
-    },
-    "./schema": "./schemas/report.schema.json",
-    "./index-schema": "./schemas/index.schema.json"
+    }
   },
   "files": [
     "dist/*.js",
     "dist/*.d.ts",
-    "schemas",
     "README.md",
-    "docs/support.md",
     "CHANGELOG.md"
   ],
   "devDependencies": {
@@ -30,7 +26,10 @@
     "@napi-rs/cli": "3.10.8",
     "@types/node": "^22.19.0",
     "prettier": "3.6.2",
-    "typescript": "^5.9.3"
+    "rolldown": "1.2.14",
+    "rollup": "^4.64.12",
+    "typescript": "^5.9.3",
+    "@bloodhound-rs/rollup-plugin": "0.2.0"
   },
   "napi": {
     "binaryName": "bloodhound",
@@ -52,25 +51,36 @@
     "url": "git+https://github.com/Justinidlerz/bloodhound.git"
   },
   "optionalDependencies": {
-    "@bloodhound-rs/core-linux-x64-gnu": "0.1.2",
-    "@bloodhound-rs/core-darwin-arm64": "0.1.2",
-    "@bloodhound-rs/core-win32-x64-msvc": "0.1.2",
-    "@bloodhound-rs/core-linux-arm64-gnu": "0.1.2",
-    "@bloodhound-rs/core-darwin-x64": "0.1.2"
+    "@bloodhound-rs/core-darwin-arm64": "0.2.0",
+    "@bloodhound-rs/core-linux-arm64-gnu": "0.2.0",
+    "@bloodhound-rs/core-linux-x64-gnu": "0.2.0",
+    "@bloodhound-rs/core-win32-x64-msvc": "0.2.0",
+    "@bloodhound-rs/core-darwin-x64": "0.2.0"
   },
   "scripts": {
     "build:native": "node scripts/build-native.mjs",
-    "build:ts": "tsc --emitDeclarationOnly",
-    "build": "node scripts/clean-dist.mjs && pnpm build:native && pnpm build:ts",
-    "typecheck": "tsc --noEmit --skipLibCheck false",
+    "build:ts": "tsc -p tsconfig.json",
+    "build:plugin": "pnpm --filter @bloodhound-rs/rollup-plugin build",
+    "build": "node scripts/clean-dist.mjs && pnpm build:native && pnpm build:ts && pnpm build:plugin",
+    "typecheck": "tsc --noEmit -p tsconfig.json && tsc --noEmit --strict --skipLibCheck --module NodeNext --target ES2023 tests/types.test.ts && pnpm --filter @bloodhound-rs/rollup-plugin typecheck && pnpm typecheck:playground",
     "example": "node examples/scan.mjs",
     "example:html": "node examples/scan-html.mjs",
-    "format": "prettier --write src scripts examples schemas README.md docs/support.md docs/verification.md .github .changeset docs/releasing.md package.json tsconfig.json npm pnpm-workspace.yaml",
-    "format:check": "prettier --check src scripts examples schemas README.md docs/support.md docs/verification.md .github .changeset docs/releasing.md package.json tsconfig.json npm pnpm-workspace.yaml",
+    "example:rollup": "rollup -c examples/rollup/rollup.config.mjs",
+    "example:rolldown": "rolldown -c examples/rollup/rolldown.config.mjs",
+    "playground": "node playground/scripts/dev.mjs",
+    "build:playground": "node playground/scripts/build.mjs",
+    "typecheck:playground": "tsc --noEmit -p playground/tsconfig.json",
+    "format": "prettier --write src scripts tests examples packages playground README.md docs .github .changeset package.json tsconfig.json npm pnpm-workspace.yaml",
+    "format:check": "prettier --check src scripts tests examples packages playground README.md docs .github .changeset package.json tsconfig.json npm pnpm-workspace.yaml",
     "changeset": "changeset",
     "changeset:status": "changeset status",
     "version:packages": "changeset version && node scripts/sync-native-version.mjs && node scripts/sync-platform-packages.mjs",
     "platforms:sync": "node scripts/sync-platform-packages.mjs",
-    "pack:release": "node scripts/pack-ci.mjs"
+    "pack:release": "node scripts/pack-ci.mjs",
+    "test": "pnpm test:rust && pnpm test:scripts && pnpm build && pnpm typecheck && pnpm test:sdk && pnpm test:plugin",
+    "test:rust": "cargo test --locked --lib",
+    "test:scripts": "node --test tests/scripts.test.mjs tests/release.test.mjs",
+    "test:sdk": "node --test tests/sdk.test.mjs",
+    "test:plugin": "pnpm --filter @bloodhound-rs/rollup-plugin test"
   }
 }

package/docs/support.md

@@ -1,57 +0,0 @@
-# Supported capabilities
-
-Use this reference to identify supported syntax, analysis limits, and report semantics.
-
-| Area                 | Implementation                                                                                                            | Coverage gaps                                                                                     |
-| -------------------- | ------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |
-| JavaScript input     | Files, URLs, source text, and classic / module / unknown modes                                                            | Syntax errors and missing script mode or environment                                              |
-| Bindings and targets | Oxc scopes, local shadowing, separate global lexical bindings and object properties, and unbound references               | Dynamic scopes introduced by `with`                                                               |
-| Global operations    | Declarations, reads, assignments, compound assignments, updates, delete, Object / Reflect APIs, and prototypes            | Unknown property keys remain separate accesses without a shared placeholder target                |
-| Aliases              | Sequential assignments, invalidation, bounded branch merging, direct IIFEs, and wrapper parameters with known bindings    | Complex destructuring, exception and switch value propagation, and general function side effects  |
-| Bounded evaluation   | Literals, concatenation, templates, bounded conditions, constant array and object keys, and restricted return expressions | Getters, proxies, general calls, and expansion beyond budgets                                     |
-| ESM                  | Imports, exports, dynamic import candidates, cross-module primitive summaries, and bounded iteration                      | Unbounded dynamic dependencies and unknown bare-specifier mappings                                |
-| webpack              | Runtime object properties, pure chunk mapping functions, script `src` expressions, and bounded ID tables                  | Automatic publicPath, complex runtime functions, and unknown addresses                            |
-| Vite                 | Dynamic imports, preload wrappers with link creation and callback invocation, and bounded dependency arrays               | General caching mapDeps wrappers and unbounded arrays                                             |
-| DOM                  | Candidate operations on document / body / head and aliases, and recoverable node resource addresses                       | Unknown node identity, runtime insertion, and teardown residue                                    |
-| Workers / iframes    | Separate scopes for resolvable entry points, with reference edges preserved                                               | Unknown document bases and dynamic child-environment addresses                                    |
-| HTML                 | HTML5 tokenization, raw text, base URLs, import map snapshots, scripts, styles, iframes, and inline offsets               | Foreign-content tree contexts, noscript environments, token recovery, and event-handler scopes    |
-| CSS                  | CSS Syntax parsing, @import, url, global selectors, resets, custom properties, and animations                             | Parser recovery and unknown resource values. Candidates do not prove actual matching or pollution |
-| Source maps          | Rust sourcemap support for external maps and data URLs                                                                    | Missing or unavailable maps affect only optional original-source locations                        |
-
-HTML processing uses tokenization with source locations, without constructing a complete browser DOM tree. Template contents remain inert, and special tree contexts explicitly reduce coverage. For entity-decoded content such as `srcdoc`, the host location identifies the tag containing the attribute. Child-resource locations remain independent.
-
-The webpack adapter matches syntax structures and Oxc bindings rather than fixed minified variable names. Chunk mappings produce bounded candidates without proving that every chunk loads. ESM analysis handles ordinary Vite dynamic imports, while preload analysis adds resource edges.
-
-# Status
-
-| Status    | Meaning                                                                  |
-| --------- | ------------------------------------------------------------------------ |
-| completed | No required coverage gaps were recorded within the declared scope        |
-| partial   | Results exist, with gaps in dependencies, context, semantics, or budgets |
-| failed    | No valid analysis result was established                                 |
-| cancelled | A `runStatus` value, independent of the scan statuses                    |
-
-`single` excludes the dependency closure and marks reference edges as `not-followed`. `completed` does not mean that the program has no dynamic behavior or that candidate issues occurred at runtime.
-
-# Indexes and locations
-
-- Target IDs use scope, namespace, path segments, and key type. Local Symbols also include the analysis instance and do not merge across resources.
-- Identical contents with different URLs or contexts retain separate instances. Cycles prevent repeated analysis while preserving reference edges.
-- Unbound bare references retain candidate relationships. They are not automatically classified as implicit global properties.
-- Artifact locations use UTF-16 offsets, one-based lines, and zero-based columns. Rust converts its internal UTF-8 offsets when emitting results.
-- Multiple writes, prototype changes, and DOM/CSS operations remain `static-candidate` findings.
-- Version diffs match resources, scopes, modes, environments, targets, and operation features. Ambiguous matches become additions and removals. Changes between arbitrary values of the same type are not guaranteed to be detected.
-
-# Runtime budgets
-
-Limits apply to resource counts, total bytes, bytes per resource, download buffers, concurrency, depth, time, AST visits, bounded evaluation, candidate counts, summary rounds, and record counts. ASTs are released after each resource analysis, and caches have byte limits.
-
-These limits bound input, work, and result sizes. They are not operating-system RSS limits. A host process can impose additional memory limits for large or untrusted inputs. Request timeouts bound network waits, while parsing does not guarantee immediate preemption.
-
-JSONL supports consumer backpressure through the filesystem. Standard reports and in-memory indexes use memory proportional to their record counts. Recovery rebuilds the graph from saved entries and reads resources again, including remote content validation.
-
-Checkpoints preserve access restrictions, resource mappings, and source map settings. Supply authentication headers and proxy settings again when resuming.
-
-# Delivery scope
-
-The SDK excludes platform databases, release gates, browser probes, and production deployment. No unit test suite was added. Scans of real artifacts and build evidence do not replace precision and recall evaluation against a fully labeled application dataset.