rea-agents 1.6.0 → 2.0.0

package/dist/application/JavaScriptArtifactFiles.js

@@ -0,0 +1,231 @@
+import { createHash } from "node:crypto";
+import { isAbsolute } from "node:path";
+import { AsarArtifactReader } from "../artifacts/AsarArtifactReader.js";
+import { ArtifactPathRegistry, normalizeArtifactPath, } from "../artifacts/ArtifactPaths.js";
+import { ArtifactReaderFailure, } from "../artifacts/ArtifactReader.js";
+import { streamChunkToBuffer } from "../artifacts/StreamBytes.js";
+/** Read only selected textual entries through an already-inventoried reader. */
+export const readJavaScriptArtifactFiles = async (reader, snapshot, input, signal) => {
+    const inventory = expectedInventory(snapshot);
+    const expected = inventory.files;
+    const selections = selectTextFiles(expected, input);
+    const context = {
+        input,
+        expected,
+        expectedContainers: inventory.containers,
+        selections,
+        registry: new ArtifactPathRegistry(),
+        files: [],
+        containers: [],
+        signal,
+        textBytes: 0,
+        invalidUtf8: 0,
+    };
+    await visitReader(reader, "", snapshot.manifest.root_sha256, context);
+    const files = context.files.sort((left, right) => compareCodePoints(left.path, right.path));
+    assertExpectedFilesWereVisited(expected, files);
+    const selected = [...selections.values()].filter(({ selected: isSelected }) => isSelected).length;
+    return {
+        files,
+        containers: context.containers.sort((left, right) => compareCodePoints(left.path, right.path)),
+        text_files_selected: selected,
+        text_bytes_read: context.textBytes,
+        omitted_text_files: [...selections.values()].filter(({ selected: isSelected }) => !isSelected).length,
+        limit_omitted_text_files: [...selections.values()].filter(({ reason }) => reason === "file-limit" || reason === "byte-limit").length,
+        policy_filtered_text_files: [...selections.values()].filter(({ reason }) => reason === "not-approved").length,
+        invalid_utf8_files: context.invalidUtf8,
+    };
+};
+const visitReader = async (reader, prefix, containerSha256, context) => {
+    for await (const entry of reader.entries(context.signal)) {
+        abortIfNeeded(context.signal);
+        const path = normalizeArtifactPath(prefix === "" ? entry.path : `${prefix}/${entry.path}`, {
+            maxDepth: context.input.limits.max_depth,
+            maxPathBytes: context.input.limits.max_path_bytes,
+        });
+        const nestedAsar = isFilesystemAsar(entry, path);
+        context.registry.add(path, nestedAsar ? "directory" : entry.kind);
+        if (nestedAsar) {
+            await visitNestedAsar(entry, path, context);
+            continue;
+        }
+        const expected = context.expected.get(path);
+        if (expected === undefined)
+            continue;
+        const selection = context.selections.get(path);
+        const text = await readTextIfSelected(context, {
+            reader,
+            entry,
+            expected,
+            selection,
+        });
+        context.files.push({
+            path,
+            container_sha256: containerSha256,
+            sha256: expected.sha256,
+            bytes: expected.bytes,
+            inventory_artifact_id: expected.inventoryArtifactId,
+            kind: expected.kind,
+            unpacked: entry.unpacked,
+            text,
+        });
+    }
+};
+const visitNestedAsar = async (entry, path, context) => {
+    const inventory = expectedContainer(path, context);
+    context.containers.push(inventory);
+    const nested = new AsarArtifactReader(entry.adapterKey);
+    try {
+        await visitReader(nested, path, inventory.sha256, context);
+    }
+    finally {
+        await nested.close();
+    }
+};
+const expectedContainer = (path, context) => {
+    const container = context.expectedContainers.get(path);
+    if (container === undefined)
+        throw new ArtifactReaderFailure("integrity", `Nested ASAR disappeared from inventory: ${path}`);
+    return container;
+};
+const readTextIfSelected = async (context, input) => {
+    if (input.expected.kind === "native-addon")
+        return { included: false, reason: "not-applicable" };
+    if (input.selection?.selected !== true)
+        return {
+            included: false,
+            reason: input.selection?.reason ?? "file-limit",
+        };
+    const bytes = await readBounded(await input.reader.open(input.entry, context.signal), context.input.limits.max_text_file_bytes, context.signal);
+    const digest = createHash("sha256").update(bytes).digest("hex");
+    if (digest !== input.expected.sha256 || bytes.length !== input.expected.bytes)
+        throw new ArtifactReaderFailure("integrity", `Artifact entry changed after inventory: ${input.expected.path}`);
+    context.textBytes += bytes.length;
+    try {
+        return {
+            included: true,
+            value: new TextDecoder("utf-8", { fatal: true }).decode(bytes),
+        };
+    }
+    catch {
+        context.invalidUtf8 += 1;
+        return { included: false, reason: "invalid-utf8" };
+    }
+};
+const expectedInventory = (snapshot) => {
+    const nodes = new Map(snapshot.nodes.map((node) => [node.artifact_id, node]));
+    const files = new Map();
+    const containers = new Map();
+    for (const occurrence of snapshot.occurrences) {
+        if (occurrence.artifact_id === null || occurrence.logical_path === ".")
+            continue;
+        const node = nodes.get(occurrence.artifact_id);
+        if (node === undefined)
+            throw new ArtifactReaderFailure("integrity", `Artifact inventory node is missing: ${occurrence.logical_path}`);
+        if (occurrence.logical_path.toLowerCase().endsWith(".asar"))
+            containers.set(occurrence.logical_path, {
+                path: occurrence.logical_path,
+                sha256: node.sha256,
+                bytes: node.size,
+                inventory_artifact_id: node.artifact_id,
+            });
+        const kind = relevantKind(occurrence.logical_path);
+        if (kind === undefined)
+            continue;
+        files.set(occurrence.logical_path, {
+            path: occurrence.logical_path,
+            sha256: node.sha256,
+            bytes: node.size,
+            inventoryArtifactId: node.artifact_id,
+            kind,
+        });
+    }
+    return { files, containers };
+};
+const selectTextFiles = (files, input) => {
+    const selected = new Map();
+    let fileCount = 0;
+    let bytes = 0;
+    const ordered = [...files.values()].sort((left, right) => {
+        const priority = filePriority(left.kind) - filePriority(right.kind);
+        return priority === 0 ? compareCodePoints(left.path, right.path) : priority;
+    });
+    for (const file of ordered) {
+        if (file.kind === "native-addon")
+            continue;
+        if (file.kind === "source-map" && !input.source_map_read_approved) {
+            selected.set(file.path, { selected: false, reason: "not-approved" });
+            continue;
+        }
+        if (fileCount >= input.limits.max_text_files ||
+            file.bytes > input.limits.max_text_file_bytes) {
+            selected.set(file.path, { selected: false, reason: "file-limit" });
+            continue;
+        }
+        if (bytes + file.bytes > input.limits.max_total_text_bytes) {
+            selected.set(file.path, { selected: false, reason: "byte-limit" });
+            continue;
+        }
+        selected.set(file.path, { selected: true, reason: null });
+        fileCount += 1;
+        bytes += file.bytes;
+    }
+    return selected;
+};
+const readBounded = async (stream, maximum, signal) => {
+    const chunks = [];
+    let bytes = 0;
+    for await (const raw of stream) {
+        abortIfNeeded(signal);
+        const chunk = streamChunkToBuffer(raw);
+        bytes += chunk.length;
+        if (bytes > maximum) {
+            stream.destroy();
+            throw new ArtifactReaderFailure("limit", "Selected JavaScript artifact text exceeded its byte limit");
+        }
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks, bytes);
+};
+const assertExpectedFilesWereVisited = (expected, actual) => {
+    const observed = new Set(actual.map(({ path }) => path));
+    for (const path of expected.keys())
+        if (!observed.has(path))
+            throw new ArtifactReaderFailure("integrity", `Relevant artifact entry disappeared after inventory: ${path}`);
+};
+const relevantKind = (path) => {
+    const lower = path.toLowerCase();
+    if (lower === "package.json" || lower.endsWith("/package.json"))
+        return "package-json";
+    if (/\.(?:cjs|mjs|js|jsx|ts|tsx)$/u.test(lower))
+        return "javascript";
+    if (/\.html?$/u.test(lower))
+        return "html";
+    if (lower.endsWith(".map"))
+        return "source-map";
+    if (lower.endsWith(".node"))
+        return "native-addon";
+    return undefined;
+};
+const filePriority = (kind) => {
+    switch (kind) {
+        case "package-json":
+            return 0;
+        case "html":
+            return 1;
+        case "javascript":
+            return 2;
+        case "source-map":
+            return 3;
+        case "native-addon":
+            return 4;
+    }
+};
+const isFilesystemAsar = (entry, path) => entry.kind === "file" &&
+    path.toLowerCase().endsWith(".asar") &&
+    isAbsolute(entry.adapterKey);
+const abortIfNeeded = (signal) => {
+    if (signal?.aborted === true)
+        throw new ArtifactReaderFailure("cancelled", "JavaScript artifact reconstruction cancelled");
+};
+const compareCodePoints = (left, right) => left < right ? -1 : left > right ? 1 : 0;

package/dist/application/JavaScriptArtifactGraphAccumulator.js

@@ -0,0 +1,54 @@
+import { createJavaScriptApplicationEdge, createJavaScriptApplicationNode, } from "../domain/javascriptApplicationGraph.js";
+/** Deduplicate graph entities while retaining distinct evidence observations. */
+export class JavaScriptArtifactGraphAccumulator {
+    #nodes = new Map();
+    #edges = new Map();
+    #omittedObservations = 0;
+    /** Create or merge one canonical node. */
+    addNode(input) {
+        const created = createJavaScriptApplicationNode(input);
+        const existing = this.#nodes.get(created.node_id);
+        if (existing === undefined) {
+            this.#nodes.set(created.node_id, created);
+            return created;
+        }
+        const bySemanticId = new Map([...existing.observations, ...created.observations].map((observation) => [
+            observation.observation_id,
+            observationInput(observation),
+        ]));
+        const observations = [...bySemanticId.entries()]
+            .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+            .slice(0, 64)
+            .map(([, observation]) => observation);
+        this.#omittedObservations += Math.max(0, bySemanticId.size - 64);
+        const merged = createJavaScriptApplicationNode({
+            kind: existing.kind,
+            identity: existing.identity,
+            observations,
+        });
+        this.#nodes.set(merged.node_id, merged);
+        return merged;
+    }
+    /** Create or replace one canonical edge by semantic identifier. */
+    addEdge(input) {
+        const edge = createJavaScriptApplicationEdge(input);
+        this.#edges.set(edge.edge_id, edge);
+        return edge;
+    }
+    /** Return all accumulated canonical nodes. */
+    nodes() {
+        return [...this.#nodes.values()];
+    }
+    /** Return all accumulated canonical edges. */
+    edges() {
+        return [...this.#edges.values()];
+    }
+    /** Count distinct node observations omitted by the graph contract bound. */
+    omittedObservations() {
+        return this.#omittedObservations;
+    }
+}
+const observationInput = (observation) => {
+    const { observation_id: _observationId, identifier_strategy: _strategy, ...input } = observation;
+    return input;
+};

package/dist/application/JavaScriptArtifactGraphBuilder.js

@@ -0,0 +1,144 @@
+import { createJavaScriptApplicationGraph, } from "../domain/javascriptApplicationGraph.js";
+import { JavaScriptArtifactGraphAccumulator } from "./JavaScriptArtifactGraphAccumulator.js";
+import { javaScriptAnalysisLimits, } from "./JavaScriptArtifactGraphContext.js";
+import { addJavaScriptHtmlRoles, addJavaScriptSourceMapOriginals, } from "./JavaScriptArtifactGraphDocuments.js";
+import { addJavaScriptStaticFindings } from "./JavaScriptArtifactGraphFindings.js";
+import { completeReconstructionCoverage, partialReconstructionCoverage, } from "./JavaScriptArtifactGraphEvidence.js";
+import { addJavaScriptArtifactContainers, addJavaScriptArtifactFiles, addJavaScriptBundlerNodes, addJavaScriptPackageNodes, createJavaScriptArtifactRootNode, } from "./JavaScriptArtifactGraphStructure.js";
+import { addElectronBoundaries } from "./ElectronBoundaryGraph.js";
+import { classifyElectronIpcPairings, collectElectronIpcRecords, } from "./ElectronBoundaryAnalysis.js";
+/** Project bounded artifact and AST facts into JavaScript Application Graph v1. */
+export const buildJavaScriptArtifactGraph = (snapshot, fileSet, analysis, input) => {
+    const accumulator = new JavaScriptArtifactGraphAccumulator();
+    const root = createJavaScriptArtifactRootNode(accumulator, snapshot);
+    const context = {
+        accumulator,
+        snapshot,
+        fileSet,
+        analysis,
+        input,
+        root,
+        filesByPath: new Map(fileSet.files.map((file) => [file.path, file])),
+        fileNodes: new Map(),
+        assetNodes: new Map(),
+        moduleNodes: new Map(),
+        containerNodes: new Map([[snapshot.manifest.root_sha256, root]]),
+    };
+    addJavaScriptArtifactContainers(context);
+    addJavaScriptArtifactFiles(context);
+    const packageRoots = addJavaScriptPackageNodes(context);
+    addJavaScriptBundlerNodes(context);
+    addJavaScriptStaticFindings(context);
+    addElectronBoundaries(context);
+    addJavaScriptHtmlRoles(context);
+    addJavaScriptSourceMapOriginals(context);
+    const coverage = graphCoverage(context);
+    return createJavaScriptApplicationGraph({
+        schema: "JavaScriptApplicationGraph",
+        schema_version: 1,
+        root_node_ids: packageRoots.length === 0
+            ? [root.node_id]
+            : packageRoots.map(({ node_id: id }) => id),
+        nodes: accumulator.nodes(),
+        edges: accumulator.edges(),
+        coverage,
+        limitations: graphLimitations(context, coverage.status),
+    });
+};
+const graphCoverage = (context) => {
+    const exactLimitOmissions = context.fileSet.limit_omitted_text_files +
+        context.accumulator.omittedObservations();
+    const sourceMapPolicyGap = context.analysis.source_maps.some(({ status }) => status === "not-approved");
+    const malformedStructuredData = context.analysis.packages.some(({ status }) => status !== "included") ||
+        context.analysis.source_maps.some(({ status }) => status === "invalid");
+    const partialJavaScript = context.analysis.files.some(({ javascript }) => javascript !== null && javascript.parse_status === "partial");
+    const unknownGap = context.analysis.parse_failures > 0 ||
+        context.fileSet.invalid_utf8_files > 0 ||
+        sourceMapPolicyGap ||
+        malformedStructuredData ||
+        partialJavaScript;
+    if (context.analysis.truncated_scopes > 0)
+        return partialReconstructionCoverage(reconstructionLimits(context.input), null, true);
+    if (exactLimitOmissions > 0)
+        return partialReconstructionCoverage(reconstructionLimits(context.input), exactLimitOmissions, true);
+    if (unknownGap)
+        return partialReconstructionCoverage(reconstructionLimits(context.input), null, false);
+    return completeReconstructionCoverage(reconstructionLimits(context.input));
+};
+const graphLimitations = (context, coverage) => {
+    const ipc = collectElectronIpcRecords(context.analysis);
+    const pairings = classifyElectronIpcPairings(ipc);
+    const electronFindings = context.analysis.files.reduce((count, { javascript }) => count +
+        (javascript === null
+            ? 0
+            : javascript.electron.browser_windows.length +
+                javascript.electron.context_bridge_apis.length +
+                javascript.electron.ipc.length +
+                javascript.electron.sender_validations.length +
+                javascript.electron.utility_processes.length +
+                javascript.electron.native_addon_bindings.length), 0);
+    return [
+        ...context.analysis.limitations,
+        "Webpack/Rspack factories were recovered from AST literals; REA did not invoke push handlers or bundle bootstrap code.",
+        "Static imports, entrypoints, workers, endpoints, and storage relationships do not prove runtime execution.",
+        ...(electronFindings === 0
+            ? []
+            : [
+                "Electron relationships are derived from inert syntax; runtime registration, reachability, defaults, and enforcement remain unproven.",
+            ]),
+        ...(ipc.some(({ finding }) => finding.channel === null)
+            ? [
+                "Dynamic IPC channel expressions remain unresolved and are never paired by textual similarity.",
+            ]
+            : []),
+        ...(pairings.some(({ status }) => status === "ambiguous")
+            ? [
+                "Some literal IPC channels have multiple compatible main handlers; ambiguous calls are not paired to any handler.",
+            ]
+            : []),
+        ...(context.analysis.files.some(({ javascript }) => (javascript?.electron.sender_validations.length ?? 0) > 0)
+            ? [
+                "Sender, frame, URL, and origin checks are observations only; REA does not claim that they enforce a complete authorization policy.",
+            ]
+            : []),
+        ...(context.analysis.files.some(({ javascript }) => (javascript?.electron.native_addon_bindings.length ?? 0) > 0)
+            ? [
+                "Native member names are requested by JavaScript syntax and are not verified binary exports in this workflow.",
+            ]
+            : []),
+        ...(context.accumulator.omittedObservations() === 0
+            ? []
+            : [
+                "Repeated content identities exceeded the per-node observation bound; containment edges still preserve inventoried paths.",
+            ]),
+        ...(coverage === "complete"
+            ? []
+            : [
+                "Graph coverage is incomplete; unavailable facts remain explicit and must not be read as absence.",
+            ]),
+    ];
+};
+const reconstructionLimits = (input) => [
+    {
+        name: "max-entries",
+        value: input.limits.max_entries,
+        unit: "items",
+    },
+    {
+        name: "max-total-artifact-bytes",
+        value: input.limits.max_total_artifact_bytes,
+        unit: "bytes",
+    },
+    {
+        name: "max-text-files",
+        value: input.limits.max_text_files,
+        unit: "items",
+    },
+    {
+        name: "max-total-text-bytes",
+        value: input.limits.max_total_text_bytes,
+        unit: "bytes",
+    },
+    ...javaScriptAnalysisLimits(input),
+    { name: "max-observations-per-node", value: 64, unit: "items" },
+];

package/dist/application/JavaScriptArtifactGraphContext.js

@@ -0,0 +1,205 @@
+import { posix } from "node:path";
+import { JavaScriptArtifactGraphAccumulator } from "./JavaScriptArtifactGraphAccumulator.js";
+import { artifactObservationEvidence, astObservationEvidence, completeReconstructionCoverage, partialReconstructionCoverage, staticInferenceEvidence, unavailableAstEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
+/** Add a direct artifact-containment edge. */
+export const addArtifactContainsEdge = (context, input) => {
+    context.accumulator.addEdge({
+        source_node_id: input.source.node_id,
+        target_node_id: input.target.node_id,
+        relation: "contains",
+        properties: { path: input.file.path },
+        evidence: artifactObservationEvidence({
+            sha256: input.operation === "inventory-entry"
+                ? input.file.container_sha256
+                : input.file.sha256,
+            path: input.file.path,
+            operation: input.operation,
+            coverage: completeReconstructionCoverage(),
+        }),
+    });
+};
+/** Add an exact AST containment edge. */
+export const addAstContainsEdge = (context, input) => {
+    context.accumulator.addEdge({
+        source_node_id: input.source.node_id,
+        target_node_id: input.target.node_id,
+        relation: "contains",
+        properties: input.properties,
+        evidence: astObservationEvidence({
+            sha256: input.file.sha256,
+            path: input.file.path,
+            range: input.range,
+            operation: "map-bundler-structure",
+            coverage: input.coverage,
+        }),
+    });
+};
+/** Add an explicitly inferred static relationship edge. */
+export const addStaticInferenceEdge = (context, input) => {
+    context.accumulator.addEdge({
+        source_node_id: input.source.node_id,
+        target_node_id: input.target.node_id,
+        relation: input.relation,
+        properties: input.properties,
+        evidence: staticInferenceEvidence({
+            sha256: input.file.sha256,
+            path: input.file.path,
+            range: input.range,
+            operation: "map-static-relationship",
+            coverage: input.coverage,
+        }),
+    });
+};
+/** Preserve a static parse or approval gap as an explicit unknown scope. */
+export const addUnavailableStaticParseScope = (context, input) => {
+    const node = context.accumulator.addNode({
+        kind: "unknown",
+        identity: artifactLocalIdentity(input.file.sha256, "static-parse-scope", `${input.operation}:${input.file.path}`),
+        observations: [
+            {
+                label: `${input.file.path} parse scope`,
+                properties: {
+                    path: input.file.path,
+                    operation: input.operation,
+                    limitation: input.limitation,
+                },
+                evidence: unavailableAstEvidence({
+                    sha256: input.file.sha256,
+                    path: input.file.path,
+                    operation: input.operation,
+                    coverage: partialReconstructionCoverage([], null, false),
+                    limitation: input.limitation,
+                }),
+            },
+        ],
+    });
+    context.accumulator.addEdge({
+        source_node_id: input.asset.node_id,
+        target_node_id: node.node_id,
+        relation: "contains",
+        properties: { scope: "unavailable-static-analysis" },
+        evidence: artifactObservationEvidence({
+            sha256: input.file.sha256,
+            path: input.file.path,
+            operation: "associate-unavailable-parse-scope",
+            coverage: completeReconstructionCoverage(),
+        }),
+    });
+};
+/** Coverage for one bounded JavaScript AST analysis. */
+export const javascriptAnalysisCoverage = (analysis, input) => analysis.parse_status === "complete"
+    ? completeReconstructionCoverage(javaScriptAnalysisLimits(input))
+    : {
+        status: "partial",
+        truncated: analysis.parse_status === "truncated",
+        omitted_count: null,
+        limits: javaScriptAnalysisLimits(input),
+    };
+/** Stable identity for a fact scoped to one exact artifact. */
+export const artifactLocalIdentity = (sha256, namespace, key) => ({
+    strategy: "artifact-local-key",
+    stability: "artifact-version",
+    artifact_sha256: sha256,
+    namespace: namespace.slice(0, 512),
+    key: key.slice(0, 4_096),
+});
+/** Create or merge an Electron role inferred from static syntax or metadata. */
+export const createElectronRoleNode = (context, input) => context.accumulator.addNode({
+    kind: input.kind,
+    identity: artifactLocalIdentity(input.anchor.sha256, "electron-role", `${input.kind}:${input.resolvedPath ?? input.declaredPath}`),
+    observations: [
+        {
+            label: input.resolvedPath ?? input.declaredPath,
+            properties: {
+                declared_path: input.declaredPath,
+                resolved_path: input.resolvedPath,
+                mechanism: input.mechanism,
+            },
+            evidence: staticInferenceEvidence({
+                sha256: input.anchor.sha256,
+                path: input.anchor.path,
+                operation: "discover-electron-entrypoint",
+                coverage: input.coverage ?? completeReconstructionCoverage(),
+                ...(input.range === undefined ? {} : { range: input.range }),
+            }),
+        },
+    ],
+});
+/** Resolve an Electron role to an inventoried asset when available. */
+export const linkElectronRoleToAsset = (context, input) => {
+    if (input.path === null)
+        return;
+    const asset = context.assetNodes.get(input.path) ?? context.fileNodes.get(input.path);
+    if (asset === undefined)
+        return;
+    context.accumulator.addEdge({
+        source_node_id: input.role.node_id,
+        target_node_id: asset.node_id,
+        relation: "maps_to",
+        properties: { resolved_path: input.path },
+        evidence: staticInferenceEvidence({
+            sha256: input.anchor.sha256,
+            path: input.anchor.path,
+            operation: "resolve-electron-entrypoint",
+            coverage: input.coverage ?? completeReconstructionCoverage(),
+            ...(input.range === undefined ? {} : { range: input.range }),
+        }),
+    });
+};
+/** Deterministic key for one recovered module inside a bundle asset. */
+export const moduleLookupKey = (path, moduleKey) => `${path}\0${moduleKey}`;
+/** Resolve a relative static specifier without escaping the artifact root. */
+export const resolveArtifactPath = (specifier, sourcePath, files) => {
+    const clean = specifier.split("#", 1)[0]?.split("?", 1)[0] ?? "";
+    if (clean === "" || /^[A-Za-z][A-Za-z+.-]*:/u.test(clean))
+        return null;
+    if (!clean.startsWith(".") && !clean.startsWith("/"))
+        return null;
+    const candidate = posix.normalize(clean.startsWith("/")
+        ? clean.slice(1)
+        : posix.join(posix.dirname(sourcePath), clean));
+    if (candidate === ".." || candidate.startsWith("../"))
+        return null;
+    for (const path of pathCandidates(candidate))
+        if (files.has(path))
+            return path;
+    return null;
+};
+/** Locate the recovered module that owns a static finding. */
+export const sourceNodeFor = (context, path, moduleKey) => moduleKey === null
+    ? undefined
+    : context.moduleNodes.get(moduleLookupKey(path, moduleKey));
+const pathCandidates = (path) => [
+    path,
+    `${path}.js`,
+    `${path}.mjs`,
+    `${path}.cjs`,
+    `${path}.ts`,
+    `${path}.tsx`,
+    `${path}.node`,
+    posix.join(path, "index.js"),
+    posix.join(path, "index.ts"),
+];
+/** Named AST budgets committed to graph evidence coverage. */
+export const javaScriptAnalysisLimits = (input) => [
+    {
+        name: "max-ast-nodes",
+        value: input.limits.max_ast_nodes,
+        unit: "items",
+    },
+    {
+        name: "max-findings",
+        value: input.limits.max_findings,
+        unit: "items",
+    },
+    {
+        name: "max-modules",
+        value: input.limits.max_modules,
+        unit: "items",
+    },
+    {
+        name: "max-parse-milliseconds",
+        value: input.limits.max_parse_milliseconds,
+        unit: "milliseconds",
+    },
+];