rea-agents 1.5.0 → 1.7.0

package/dist/application/JavaScriptArtifactAnalysis.js

@@ -0,0 +1,299 @@
+import { createHash } from "node:crypto";
+import { analyzeJavaScriptStaticSource } from "../domain/javascriptStaticAnalysis.js";
+/** Analyze selected text files under one shared AST, finding, module, and time budget. */
+export const analyzeJavaScriptArtifactFiles = (fileSet, input, now) => {
+    const state = emptyArtifactAnalysis();
+    const context = {
+        state,
+        input,
+        deadline: now() + input.limits.max_parse_milliseconds,
+        now,
+    };
+    for (const file of fileSet.files)
+        analyzeArtifactFile(file, context);
+    return finalizeArtifactAnalysis(state, input);
+};
+const finalizeArtifactAnalysis = (state, input) => {
+    const omittedHtmlFindings = Math.max(0, state.htmlScripts.length + state.findings - input.limits.max_findings);
+    const findings = Math.min(input.limits.max_findings, state.findings + state.htmlScripts.length);
+    const sourceMapTruncations = state.sourceMaps.filter(({ status }) => status === "truncated").length;
+    const truncatedScopes = state.truncatedScopes +
+        sourceMapTruncations +
+        (omittedHtmlFindings > 0 ? 1 : 0);
+    return {
+        files: state.files,
+        packages: state.packages,
+        html_scripts: state.htmlScripts.slice(0, input.limits.max_findings),
+        source_maps: state.sourceMaps,
+        visited_ast_nodes: state.visitedNodes,
+        findings,
+        modules: state.modules,
+        parse_failures: state.parseFailures,
+        truncated_scopes: truncatedScopes,
+        limitations: [
+            "JavaScript and HTML were parsed as inert text; bundle bootstrap code was never executed.",
+            "Static paths and relationships may remain unresolved when expressions are dynamic or obfuscated.",
+            ...(input.source_map_read_approved
+                ? []
+                : [
+                    "Source maps were inventoried but their contents were not read without separate approval.",
+                ]),
+            ...(truncatedScopes === 0
+                ? []
+                : ["One or more static-analysis scopes reached an approved bound."]),
+        ],
+    };
+};
+const analyzeArtifactFile = (file, context) => {
+    const { state, input } = context;
+    if (file.kind === "package-json")
+        state.packages.push(parsePackage(file));
+    if (file.kind === "html" && file.text.included)
+        state.htmlScripts.push(...parseHtmlScripts(file.path, file.text.value, Math.max(0, input.limits.max_findings - state.findings)));
+    if (file.kind === "source-map")
+        addSourceMap(file, context);
+    if (file.kind !== "javascript" || !file.text.included) {
+        state.files.push({ file, javascript: null });
+        return;
+    }
+    const remainingNodes = input.limits.max_ast_nodes - state.visitedNodes;
+    const remainingFindings = input.limits.max_findings - state.findings;
+    const remainingModules = input.limits.max_modules - state.modules;
+    if (remainingNodes <= 0 ||
+        remainingFindings <= 0 ||
+        remainingModules <= 0 ||
+        context.now() > context.deadline) {
+        state.files.push({ file, javascript: null });
+        state.truncatedScopes += 1;
+        return;
+    }
+    const analysis = analyzeJavaScriptStaticSource(file.text.value, {
+        maxAstNodes: remainingNodes,
+        maxFindings: remainingFindings,
+        maxModules: remainingModules,
+        deadline: context.deadline,
+        now: context.now,
+    });
+    state.files.push({ file, javascript: analysis });
+    state.visitedNodes += analysis.visited_ast_nodes;
+    state.findings += findingCount(analysis);
+    state.modules += analysis.bundler_registrations.reduce((count, registration) => count + registration.modules.length, 0);
+    if (analysis.parse_status === "failed")
+        state.parseFailures += 1;
+    if (analysis.parse_status === "truncated")
+        state.truncatedScopes += 1;
+};
+const addSourceMap = (file, context) => {
+    const sourceMap = parseSourceMap(file, {
+        deadline: context.deadline,
+        now: context.now,
+        maximumSources: Math.max(0, context.input.limits.max_source_map_sources -
+            context.state.sourceMapSources),
+    });
+    context.state.sourceMaps.push(sourceMap);
+    context.state.sourceMapSources += sourceMap.sources.length;
+};
+const emptyArtifactAnalysis = () => ({
+    files: [],
+    packages: [],
+    htmlScripts: [],
+    sourceMaps: [],
+    visitedNodes: 0,
+    findings: 0,
+    modules: 0,
+    parseFailures: 0,
+    truncatedScopes: 0,
+    sourceMapSources: 0,
+});
+const parsePackage = (file) => {
+    if (!file.text.included)
+        return unavailablePackage(file, "Package metadata text was unavailable.");
+    let value;
+    try {
+        value = JSON.parse(file.text.value);
+    }
+    catch {
+        return invalidPackage(file, "package.json is not valid JSON.");
+    }
+    if (!isRecord(value))
+        return invalidPackage(file, "package.json root is not an object.");
+    return {
+        path: file.path,
+        sha256: file.sha256,
+        status: "included",
+        name: boundedString(value.name),
+        version: boundedString(value.version),
+        main: boundedString(value.main),
+        renderer: boundedString(value.renderer) ??
+            boundedString(value.browser) ??
+            boundedString(value.module),
+        limitation: null,
+    };
+};
+const invalidPackage = (file, limitation) => ({
+    ...unavailablePackage(file, limitation),
+    status: "invalid",
+});
+const unavailablePackage = (file, limitation) => ({
+    path: file.path,
+    sha256: file.sha256,
+    status: "unavailable",
+    name: null,
+    version: null,
+    main: null,
+    renderer: null,
+    limitation,
+});
+const parseHtmlScripts = (path, text, maximum) => {
+    const scripts = [];
+    const pattern = /<script\b[^>]*\bsrc\s*=\s*(["'])([^"']+)\1[^>]*>/giu;
+    for (const match of text.matchAll(pattern)) {
+        const script = match[2]?.slice(0, 4_096);
+        if (script === undefined || scripts.length >= maximum)
+            break;
+        const start = match.index;
+        scripts.push({
+            html_path: path,
+            script_path: script,
+            location: rangeForOffsets(text, start, start + match[0].length),
+        });
+    }
+    return scripts;
+};
+const parseSourceMap = (file, context) => {
+    if (!file.text.included)
+        return unavailableSourceMap(file);
+    if (context.now() > context.deadline)
+        return truncatedSourceMap(file, null, "Parse deadline reached before source-map decoding.");
+    let value;
+    try {
+        value = JSON.parse(file.text.value);
+    }
+    catch {
+        return invalidSourceMap(file, "Source map is not valid JSON.");
+    }
+    if (context.now() > context.deadline)
+        return truncatedSourceMap(file, null, "Parse deadline elapsed during source-map decoding.");
+    const maps = flattenSourceMaps(value, 10_000);
+    if (maps === undefined)
+        return invalidSourceMap(file, "Source map is not a bounded version 3 map.");
+    return collectSourceMapOriginals(file, maps, context);
+};
+const collectSourceMapOriginals = (file, maps, context) => {
+    const sources = [];
+    let total = 0;
+    for (const map of maps) {
+        const names = map.sources;
+        if (!Array.isArray(names))
+            return invalidSourceMap(file, "Source map has no sources array.");
+        const contents = Array.isArray(map.sourcesContent)
+            ? map.sourcesContent
+            : [];
+        const root = typeof map.sourceRoot === "string" ? map.sourceRoot : "";
+        for (const [index, raw] of names.entries()) {
+            if (total % 1_024 === 0 && context.now() > context.deadline)
+                return {
+                    path: file.path,
+                    sha256: file.sha256,
+                    status: "truncated",
+                    sources,
+                    omitted_sources: null,
+                    limitation: "Parse deadline elapsed during source-map traversal.",
+                };
+            if (typeof raw !== "string")
+                return invalidSourceMap(file, "Source map contains a non-string source name.");
+            total += 1;
+            if (sources.length >= context.maximumSources)
+                continue;
+            const content = typeof contents[index] === "string" ? contents[index] : null;
+            sources.push({
+                source: resolveSourceName(root, raw),
+                content,
+                content_sha256: content === null ? null : sha256(content),
+            });
+        }
+    }
+    const omitted = total - sources.length;
+    return {
+        path: file.path,
+        sha256: file.sha256,
+        status: omitted === 0 ? "included" : "truncated",
+        sources,
+        omitted_sources: omitted,
+        limitation: omitted === 0
+            ? null
+            : "Original-source inventory reached the approved source-map limit.",
+    };
+};
+const unavailableSourceMap = (file) => {
+    if (file.text.included)
+        throw new TypeError("Expected unavailable source-map text");
+    const notApproved = file.text.reason === "not-approved";
+    return {
+        path: file.path,
+        sha256: file.sha256,
+        status: notApproved ? "not-approved" : "invalid",
+        sources: [],
+        omitted_sources: 0,
+        limitation: notApproved
+            ? "Source-map content requires separate approval."
+            : "Source-map text was unavailable within approved limits.",
+    };
+};
+const flattenSourceMaps = (root, maximum) => {
+    if (!isRecord(root) || root.version !== 3)
+        return undefined;
+    const maps = [];
+    const pending = [root];
+    while (pending.length > 0) {
+        const map = pending.pop();
+        if (map === undefined || map.version !== 3)
+            return undefined;
+        if (Array.isArray(map.sections)) {
+            if (pending.length + maps.length + map.sections.length > maximum)
+                return undefined;
+            for (const section of map.sections) {
+                if (!isRecord(section) || !isRecord(section.map))
+                    return undefined;
+                pending.push(section.map);
+            }
+        }
+        else
+            maps.push(map);
+    }
+    return maps;
+};
+const truncatedSourceMap = (file, omitted, limitation) => ({
+    path: file.path,
+    sha256: file.sha256,
+    status: "truncated",
+    sources: [],
+    omitted_sources: omitted,
+    limitation,
+});
+const invalidSourceMap = (file, limitation) => ({
+    path: file.path,
+    sha256: file.sha256,
+    status: "invalid",
+    sources: [],
+    omitted_sources: 0,
+    limitation,
+});
+const findingCount = (analysis) => analysis.references.length +
+    analysis.endpoints.length +
+    analysis.storage.length +
+    analysis.role_paths.length +
+    analysis.source_map_urls.length +
+    analysis.bundler_registrations.length;
+const rangeForOffsets = (text, start, end) => ({
+    start: pointForOffset(text, start),
+    end: pointForOffset(text, end),
+});
+const pointForOffset = (text, offset) => {
+    const lines = text.slice(0, offset).split("\n");
+    return { line: lines.length, column: lines.at(-1)?.length ?? 0 };
+};
+const resolveSourceName = (root, source) => `${root}${root !== "" && !root.endsWith("/") ? "/" : ""}${source}`.slice(0, 4_096);
+const boundedString = (value) => typeof value === "string" && value.length > 0 ? value.slice(0, 4_096) : null;
+const sha256 = (value) => createHash("sha256").update(value).digest("hex");
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);

package/dist/application/JavaScriptArtifactAnalysisTypes.js

@@ -0,0 +1 @@
+export {};

package/dist/application/JavaScriptArtifactFiles.js

@@ -0,0 +1,231 @@
+import { createHash } from "node:crypto";
+import { isAbsolute } from "node:path";
+import { AsarArtifactReader } from "../artifacts/AsarArtifactReader.js";
+import { ArtifactPathRegistry, normalizeArtifactPath, } from "../artifacts/ArtifactPaths.js";
+import { ArtifactReaderFailure, } from "../artifacts/ArtifactReader.js";
+import { streamChunkToBuffer } from "../artifacts/StreamBytes.js";
+/** Read only selected textual entries through an already-inventoried reader. */
+export const readJavaScriptArtifactFiles = async (reader, snapshot, input, signal) => {
+    const inventory = expectedInventory(snapshot);
+    const expected = inventory.files;
+    const selections = selectTextFiles(expected, input);
+    const context = {
+        input,
+        expected,
+        expectedContainers: inventory.containers,
+        selections,
+        registry: new ArtifactPathRegistry(),
+        files: [],
+        containers: [],
+        signal,
+        textBytes: 0,
+        invalidUtf8: 0,
+    };
+    await visitReader(reader, "", snapshot.manifest.root_sha256, context);
+    const files = context.files.sort((left, right) => compareCodePoints(left.path, right.path));
+    assertExpectedFilesWereVisited(expected, files);
+    const selected = [...selections.values()].filter(({ selected: isSelected }) => isSelected).length;
+    return {
+        files,
+        containers: context.containers.sort((left, right) => compareCodePoints(left.path, right.path)),
+        text_files_selected: selected,
+        text_bytes_read: context.textBytes,
+        omitted_text_files: [...selections.values()].filter(({ selected: isSelected }) => !isSelected).length,
+        limit_omitted_text_files: [...selections.values()].filter(({ reason }) => reason === "file-limit" || reason === "byte-limit").length,
+        policy_filtered_text_files: [...selections.values()].filter(({ reason }) => reason === "not-approved").length,
+        invalid_utf8_files: context.invalidUtf8,
+    };
+};
+const visitReader = async (reader, prefix, containerSha256, context) => {
+    for await (const entry of reader.entries(context.signal)) {
+        abortIfNeeded(context.signal);
+        const path = normalizeArtifactPath(prefix === "" ? entry.path : `${prefix}/${entry.path}`, {
+            maxDepth: context.input.limits.max_depth,
+            maxPathBytes: context.input.limits.max_path_bytes,
+        });
+        const nestedAsar = isFilesystemAsar(entry, path);
+        context.registry.add(path, nestedAsar ? "directory" : entry.kind);
+        if (nestedAsar) {
+            await visitNestedAsar(entry, path, context);
+            continue;
+        }
+        const expected = context.expected.get(path);
+        if (expected === undefined)
+            continue;
+        const selection = context.selections.get(path);
+        const text = await readTextIfSelected(context, {
+            reader,
+            entry,
+            expected,
+            selection,
+        });
+        context.files.push({
+            path,
+            container_sha256: containerSha256,
+            sha256: expected.sha256,
+            bytes: expected.bytes,
+            inventory_artifact_id: expected.inventoryArtifactId,
+            kind: expected.kind,
+            unpacked: entry.unpacked,
+            text,
+        });
+    }
+};
+const visitNestedAsar = async (entry, path, context) => {
+    const inventory = expectedContainer(path, context);
+    context.containers.push(inventory);
+    const nested = new AsarArtifactReader(entry.adapterKey);
+    try {
+        await visitReader(nested, path, inventory.sha256, context);
+    }
+    finally {
+        await nested.close();
+    }
+};
+const expectedContainer = (path, context) => {
+    const container = context.expectedContainers.get(path);
+    if (container === undefined)
+        throw new ArtifactReaderFailure("integrity", `Nested ASAR disappeared from inventory: ${path}`);
+    return container;
+};
+const readTextIfSelected = async (context, input) => {
+    if (input.expected.kind === "native-addon")
+        return { included: false, reason: "not-applicable" };
+    if (input.selection?.selected !== true)
+        return {
+            included: false,
+            reason: input.selection?.reason ?? "file-limit",
+        };
+    const bytes = await readBounded(await input.reader.open(input.entry, context.signal), context.input.limits.max_text_file_bytes, context.signal);
+    const digest = createHash("sha256").update(bytes).digest("hex");
+    if (digest !== input.expected.sha256 || bytes.length !== input.expected.bytes)
+        throw new ArtifactReaderFailure("integrity", `Artifact entry changed after inventory: ${input.expected.path}`);
+    context.textBytes += bytes.length;
+    try {
+        return {
+            included: true,
+            value: new TextDecoder("utf-8", { fatal: true }).decode(bytes),
+        };
+    }
+    catch {
+        context.invalidUtf8 += 1;
+        return { included: false, reason: "invalid-utf8" };
+    }
+};
+const expectedInventory = (snapshot) => {
+    const nodes = new Map(snapshot.nodes.map((node) => [node.artifact_id, node]));
+    const files = new Map();
+    const containers = new Map();
+    for (const occurrence of snapshot.occurrences) {
+        if (occurrence.artifact_id === null || occurrence.logical_path === ".")
+            continue;
+        const node = nodes.get(occurrence.artifact_id);
+        if (node === undefined)
+            throw new ArtifactReaderFailure("integrity", `Artifact inventory node is missing: ${occurrence.logical_path}`);
+        if (occurrence.logical_path.toLowerCase().endsWith(".asar"))
+            containers.set(occurrence.logical_path, {
+                path: occurrence.logical_path,
+                sha256: node.sha256,
+                bytes: node.size,
+                inventory_artifact_id: node.artifact_id,
+            });
+        const kind = relevantKind(occurrence.logical_path);
+        if (kind === undefined)
+            continue;
+        files.set(occurrence.logical_path, {
+            path: occurrence.logical_path,
+            sha256: node.sha256,
+            bytes: node.size,
+            inventoryArtifactId: node.artifact_id,
+            kind,
+        });
+    }
+    return { files, containers };
+};
+const selectTextFiles = (files, input) => {
+    const selected = new Map();
+    let fileCount = 0;
+    let bytes = 0;
+    const ordered = [...files.values()].sort((left, right) => {
+        const priority = filePriority(left.kind) - filePriority(right.kind);
+        return priority === 0 ? compareCodePoints(left.path, right.path) : priority;
+    });
+    for (const file of ordered) {
+        if (file.kind === "native-addon")
+            continue;
+        if (file.kind === "source-map" && !input.source_map_read_approved) {
+            selected.set(file.path, { selected: false, reason: "not-approved" });
+            continue;
+        }
+        if (fileCount >= input.limits.max_text_files ||
+            file.bytes > input.limits.max_text_file_bytes) {
+            selected.set(file.path, { selected: false, reason: "file-limit" });
+            continue;
+        }
+        if (bytes + file.bytes > input.limits.max_total_text_bytes) {
+            selected.set(file.path, { selected: false, reason: "byte-limit" });
+            continue;
+        }
+        selected.set(file.path, { selected: true, reason: null });
+        fileCount += 1;
+        bytes += file.bytes;
+    }
+    return selected;
+};
+const readBounded = async (stream, maximum, signal) => {
+    const chunks = [];
+    let bytes = 0;
+    for await (const raw of stream) {
+        abortIfNeeded(signal);
+        const chunk = streamChunkToBuffer(raw);
+        bytes += chunk.length;
+        if (bytes > maximum) {
+            stream.destroy();
+            throw new ArtifactReaderFailure("limit", "Selected JavaScript artifact text exceeded its byte limit");
+        }
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks, bytes);
+};
+const assertExpectedFilesWereVisited = (expected, actual) => {
+    const observed = new Set(actual.map(({ path }) => path));
+    for (const path of expected.keys())
+        if (!observed.has(path))
+            throw new ArtifactReaderFailure("integrity", `Relevant artifact entry disappeared after inventory: ${path}`);
+};
+const relevantKind = (path) => {
+    const lower = path.toLowerCase();
+    if (lower === "package.json" || lower.endsWith("/package.json"))
+        return "package-json";
+    if (/\.(?:cjs|mjs|js|jsx|ts|tsx)$/u.test(lower))
+        return "javascript";
+    if (/\.html?$/u.test(lower))
+        return "html";
+    if (lower.endsWith(".map"))
+        return "source-map";
+    if (lower.endsWith(".node"))
+        return "native-addon";
+    return undefined;
+};
+const filePriority = (kind) => {
+    switch (kind) {
+        case "package-json":
+            return 0;
+        case "html":
+            return 1;
+        case "javascript":
+            return 2;
+        case "source-map":
+            return 3;
+        case "native-addon":
+            return 4;
+    }
+};
+const isFilesystemAsar = (entry, path) => entry.kind === "file" &&
+    path.toLowerCase().endsWith(".asar") &&
+    isAbsolute(entry.adapterKey);
+const abortIfNeeded = (signal) => {
+    if (signal?.aborted === true)
+        throw new ArtifactReaderFailure("cancelled", "JavaScript artifact reconstruction cancelled");
+};
+const compareCodePoints = (left, right) => left < right ? -1 : left > right ? 1 : 0;

package/dist/application/JavaScriptArtifactGraphAccumulator.js

@@ -0,0 +1,54 @@
+import { createJavaScriptApplicationEdge, createJavaScriptApplicationNode, } from "../domain/javascriptApplicationGraph.js";
+/** Deduplicate graph entities while retaining distinct evidence observations. */
+export class JavaScriptArtifactGraphAccumulator {
+    #nodes = new Map();
+    #edges = new Map();
+    #omittedObservations = 0;
+    /** Create or merge one canonical node. */
+    addNode(input) {
+        const created = createJavaScriptApplicationNode(input);
+        const existing = this.#nodes.get(created.node_id);
+        if (existing === undefined) {
+            this.#nodes.set(created.node_id, created);
+            return created;
+        }
+        const bySemanticId = new Map([...existing.observations, ...created.observations].map((observation) => [
+            observation.observation_id,
+            observationInput(observation),
+        ]));
+        const observations = [...bySemanticId.entries()]
+            .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+            .slice(0, 64)
+            .map(([, observation]) => observation);
+        this.#omittedObservations += Math.max(0, bySemanticId.size - 64);
+        const merged = createJavaScriptApplicationNode({
+            kind: existing.kind,
+            identity: existing.identity,
+            observations,
+        });
+        this.#nodes.set(merged.node_id, merged);
+        return merged;
+    }
+    /** Create or replace one canonical edge by semantic identifier. */
+    addEdge(input) {
+        const edge = createJavaScriptApplicationEdge(input);
+        this.#edges.set(edge.edge_id, edge);
+        return edge;
+    }
+    /** Return all accumulated canonical nodes. */
+    nodes() {
+        return [...this.#nodes.values()];
+    }
+    /** Return all accumulated canonical edges. */
+    edges() {
+        return [...this.#edges.values()];
+    }
+    /** Count distinct node observations omitted by the graph contract bound. */
+    omittedObservations() {
+        return this.#omittedObservations;
+    }
+}
+const observationInput = (observation) => {
+    const { observation_id: _observationId, identifier_strategy: _strategy, ...input } = observation;
+    return input;
+};

package/dist/application/JavaScriptArtifactGraphBuilder.js

@@ -0,0 +1,101 @@
+import { createJavaScriptApplicationGraph, } from "../domain/javascriptApplicationGraph.js";
+import { JavaScriptArtifactGraphAccumulator } from "./JavaScriptArtifactGraphAccumulator.js";
+import { javaScriptAnalysisLimits, } from "./JavaScriptArtifactGraphContext.js";
+import { addJavaScriptHtmlRoles, addJavaScriptSourceMapOriginals, } from "./JavaScriptArtifactGraphDocuments.js";
+import { addJavaScriptStaticFindings } from "./JavaScriptArtifactGraphFindings.js";
+import { completeReconstructionCoverage, partialReconstructionCoverage, } from "./JavaScriptArtifactGraphEvidence.js";
+import { addJavaScriptArtifactContainers, addJavaScriptArtifactFiles, addJavaScriptBundlerNodes, addJavaScriptPackageNodes, createJavaScriptArtifactRootNode, } from "./JavaScriptArtifactGraphStructure.js";
+/** Project bounded artifact and AST facts into JavaScript Application Graph v1. */
+export const buildJavaScriptArtifactGraph = (snapshot, fileSet, analysis, input) => {
+    const accumulator = new JavaScriptArtifactGraphAccumulator();
+    const root = createJavaScriptArtifactRootNode(accumulator, snapshot);
+    const context = {
+        accumulator,
+        snapshot,
+        fileSet,
+        analysis,
+        input,
+        root,
+        filesByPath: new Map(fileSet.files.map((file) => [file.path, file])),
+        fileNodes: new Map(),
+        assetNodes: new Map(),
+        moduleNodes: new Map(),
+        containerNodes: new Map([[snapshot.manifest.root_sha256, root]]),
+    };
+    addJavaScriptArtifactContainers(context);
+    addJavaScriptArtifactFiles(context);
+    const packageRoots = addJavaScriptPackageNodes(context);
+    addJavaScriptBundlerNodes(context);
+    addJavaScriptStaticFindings(context);
+    addJavaScriptHtmlRoles(context);
+    addJavaScriptSourceMapOriginals(context);
+    const coverage = graphCoverage(context);
+    return createJavaScriptApplicationGraph({
+        schema: "JavaScriptApplicationGraph",
+        schema_version: 1,
+        root_node_ids: packageRoots.length === 0
+            ? [root.node_id]
+            : packageRoots.map(({ node_id: id }) => id),
+        nodes: accumulator.nodes(),
+        edges: accumulator.edges(),
+        coverage,
+        limitations: graphLimitations(context, coverage.status),
+    });
+};
+const graphCoverage = (context) => {
+    const exactLimitOmissions = context.fileSet.limit_omitted_text_files +
+        context.accumulator.omittedObservations();
+    const sourceMapPolicyGap = context.analysis.source_maps.some(({ status }) => status === "not-approved");
+    const malformedStructuredData = context.analysis.packages.some(({ status }) => status !== "included") ||
+        context.analysis.source_maps.some(({ status }) => status === "invalid");
+    const unknownGap = context.analysis.parse_failures > 0 ||
+        context.fileSet.invalid_utf8_files > 0 ||
+        sourceMapPolicyGap ||
+        malformedStructuredData;
+    if (context.analysis.truncated_scopes > 0)
+        return partialReconstructionCoverage(reconstructionLimits(context.input), null, true);
+    if (exactLimitOmissions > 0)
+        return partialReconstructionCoverage(reconstructionLimits(context.input), exactLimitOmissions, true);
+    if (unknownGap)
+        return partialReconstructionCoverage(reconstructionLimits(context.input), null, false);
+    return completeReconstructionCoverage(reconstructionLimits(context.input));
+};
+const graphLimitations = (context, coverage) => [
+    ...context.analysis.limitations,
+    "Webpack/Rspack factories were recovered from AST literals; REA did not invoke push handlers or bundle bootstrap code.",
+    "Static imports, entrypoints, workers, endpoints, and storage relationships do not prove runtime execution.",
+    ...(context.accumulator.omittedObservations() === 0
+        ? []
+        : [
+            "Repeated content identities exceeded the per-node observation bound; containment edges still preserve inventoried paths.",
+        ]),
+    ...(coverage === "complete"
+        ? []
+        : [
+            "Graph coverage is incomplete; unavailable facts remain explicit and must not be read as absence.",
+        ]),
+];
+const reconstructionLimits = (input) => [
+    {
+        name: "max-entries",
+        value: input.limits.max_entries,
+        unit: "items",
+    },
+    {
+        name: "max-total-artifact-bytes",
+        value: input.limits.max_total_artifact_bytes,
+        unit: "bytes",
+    },
+    {
+        name: "max-text-files",
+        value: input.limits.max_text_files,
+        unit: "items",
+    },
+    {
+        name: "max-total-text-bytes",
+        value: input.limits.max_total_text_bytes,
+        unit: "bytes",
+    },
+    ...javaScriptAnalysisLimits(input),
+    { name: "max-observations-per-node", value: 64, unit: "items" },
+];