rea-agents 1.7.0 → 2.1.0

package/dist/application/JavaScriptApplicationEvidenceGraph.js

@@ -0,0 +1,89 @@
+import { JAVASCRIPT_APPLICATION_PROVIDER, JAVASCRIPT_RUNTIME_RECONCILIATION_PROVIDER, MANAGED_WORKFLOW_PROVIDER, } from "./InvestigationProviders.js";
+import { parseEvidence } from "../domain/evidence.js";
+import { analyzeJavaScriptApplicationInputSchema, javascriptApplicationAnalysisResultSchema, } from "../domain/javascriptApplicationAnalysis.js";
+import { javascriptRuntimeReconciliationResultSchema } from "../domain/javascriptRuntimeReconciliationSchemas.js";
+import { managedApplicationGraphResultSchema } from "../domain/managedApplicationGraph.js";
+/** Parse and authenticate one REA-produced JavaScript Application Graph Evidence. */
+export const parseApplicationGraphEvidence = (input) => {
+    const evidence = parseEvidence(input);
+    if (evidence.operation === "analyze_javascript_application" &&
+        evidence.predicate_type === "rea.javascript-application-analysis/v1" &&
+        providerMatches(evidence, JAVASCRIPT_APPLICATION_PROVIDER))
+        return staticApplicationSource(evidence);
+    if (evidence.operation === "reconcile_javascript_runtime" &&
+        evidence.predicate_type === "rea.javascript-runtime-reconciliation/v1" &&
+        providerMatches(evidence, JAVASCRIPT_RUNTIME_RECONCILIATION_PROVIDER))
+        return staticRuntimeSource(evidence);
+    if (evidence.operation === "project_managed_application_graph" &&
+        evidence.predicate_type === "rea.managed-application-graph/v1" &&
+        providerMatches(evidence, MANAGED_WORKFLOW_PROVIDER))
+        return managedApplicationSource(evidence);
+    throw new TypeError("Application workflow requires authenticated analyze_javascript_application, reconcile_javascript_runtime, or project_managed_application_graph Evidence");
+};
+const staticApplicationSource = (evidence) => {
+    if (evidence.authority !== "shipped-artifact" ||
+        evidence.confidence !== "derived")
+        throw new TypeError("JavaScript application Evidence authority or confidence is invalid");
+    const result = javascriptApplicationAnalysisResultSchema.parse(evidence.normalized_result);
+    analyzeJavaScriptApplicationInputSchema.parse({
+        input_path: result.input_path,
+        ...evidence.parameters,
+    });
+    assertApplicationSubject(evidence, result);
+    return {
+        evidence,
+        graph: result.graph,
+        kind: "static-application",
+        rootArtifactSha256: result.root_artifact_sha256,
+    };
+};
+const staticRuntimeSource = (evidence) => {
+    if (evidence.authority !== "analyst-inference" ||
+        evidence.confidence !== "inferred")
+        throw new TypeError("JavaScript runtime reconciliation Evidence authority or confidence is invalid");
+    const result = javascriptRuntimeReconciliationResultSchema.parse(evidence.normalized_result);
+    if (result.evidence_links.some((evidenceId) => !evidence.evidence_links.includes(evidenceId)))
+        throw new TypeError("Runtime reconciliation result references Evidence outside its envelope");
+    const applicationLayer = result.static_layers.find(({ role }) => role === "application");
+    if (applicationLayer === undefined)
+        throw new TypeError("Runtime reconciliation application layer is missing");
+    return {
+        evidence,
+        graph: result.graph,
+        kind: "static-runtime-reconciliation",
+        rootArtifactSha256: applicationLayer.root_artifact_sha256,
+    };
+};
+const managedApplicationSource = (evidence) => {
+    if (evidence.authority !== "analyst-inference" ||
+        evidence.confidence !== "inferred")
+        throw new TypeError("Managed application graph Evidence authority or confidence is invalid");
+    const result = managedApplicationGraphResultSchema.parse(evidence.normalized_result);
+    if (result.evidence_links.some((evidenceId) => !evidence.evidence_links.includes(evidenceId)))
+        throw new TypeError("Managed application graph result references Evidence outside its envelope");
+    return {
+        evidence,
+        graph: result.graph,
+        kind: "managed-application",
+        rootArtifactSha256: result.root_artifact_sha256,
+    };
+};
+const assertApplicationSubject = (evidence, result) => {
+    if (evidence.subject === null ||
+        evidence.subject.digest.sha256 !== result.root_artifact_sha256 ||
+        evidence.subject.format !== result.format)
+        throw new TypeError("JavaScript application Evidence subject does not match its result");
+};
+const providerMatches = (evidence, provider) => evidence.provider.id === provider.id &&
+    evidence.provider.name === provider.name &&
+    evidence.provider.version === provider.version;
+/** Parse unique, artifact-bound Evidence that may extend a native handoff. */
+export const parseNativeApplicationEvidence = (inputs) => {
+    const parsed = inputs.map((input) => parseEvidence(input));
+    if (parsed.some(({ subject }) => subject === null))
+        throw new TypeError("Native handoff Evidence requires an artifact subject");
+    const ids = parsed.map(({ evidence_id: id }) => id);
+    if (new Set(ids).size !== ids.length)
+        throw new TypeError("Native handoff Evidence must be unique");
+    return parsed;
+};

package/dist/application/JavaScriptApplicationService.js

@@ -0,0 +1,74 @@
+import { z } from "zod";
+import { ArtifactReaderFailure } from "../artifacts/ArtifactReader.js";
+import { analyzeJavaScriptApplicationInputSchema, javascriptApplicationAnalysisResultSchema, } from "../domain/javascriptApplicationAnalysis.js";
+import { AnalysisCapabilityUnavailableError, AnalysisInputError, AnalysisProtocolError, ArtifactOperationError, PermissionRequiredError, } from "../domain/errors.js";
+import { err, ok } from "../domain/result.js";
+import { createJavaScriptApplicationEvidence } from "./JavaScriptApplicationEvidence.js";
+import { reconstructJavaScriptArtifact } from "./JavaScriptArtifactReconstruction.js";
+const OPERATION = "analyze_javascript_application";
+/** Authorize and statically analyze one local JavaScript/Electron application. */
+export const analyzeJavaScriptApplication = async (authority, rawInput, options = {}) => {
+    const parsed = analyzeJavaScriptApplicationInputSchema.safeParse(rawInput);
+    if (!parsed.success)
+        return err(new AnalysisInputError(OPERATION));
+    return analyzeJavaScriptApplicationValidated(authority, parsed.data, options);
+};
+/** Analyze input already parsed by a trusted adapter boundary. */
+export const analyzeJavaScriptApplicationValidated = async (authority, input, options = {}) => {
+    if (authority === undefined)
+        return err(new AnalysisCapabilityUnavailableError("rea-javascript-application", OPERATION, "JavaScript application permission policy is not configured"));
+    const authorized = await authority.authorize({
+        capability: "investigation_input",
+        roots: [input.input_path],
+        executables: [],
+        environment_names: [],
+        network: "none",
+        mount: false,
+        operation_identity: `${OPERATION}:${input.input_path}`,
+    }, "read");
+    if (!authorized.ok)
+        return err(authorized.error instanceof PermissionRequiredError
+            ? authorized.error
+            : new ArtifactOperationError(OPERATION, "path", {
+                logicalPath: input.input_path,
+                declaredSha256: null,
+                calculatedSha256: null,
+                unpacked: false,
+            }));
+    await options.progress?.report({
+        phase: "analyze_javascript_application",
+        completed: 0,
+        total: 1,
+        message: "Inventorying and parsing approved application artifacts",
+    });
+    try {
+        const reconstructed = await reconstructJavaScriptArtifact({
+            input_path: input.input_path,
+            format: input.format,
+            source_map_read_approved: input.source_map_read_approved,
+            limits: input.limits,
+        }, options.signal);
+        const { electron_summary: summary, ...application } = reconstructed;
+        const result = javascriptApplicationAnalysisResultSchema.parse({
+            schema_version: 1,
+            ...application,
+            summary,
+            limitations: reconstructed.graph.limitations,
+        });
+        await options.progress?.report({
+            phase: "analyze_javascript_application",
+            completed: 1,
+            total: 1,
+            message: "Application graph and Electron boundaries reconstructed",
+            terminal: true,
+        });
+        return ok(createJavaScriptApplicationEvidence(input, result));
+    }
+    catch (cause) {
+        if (cause instanceof ArtifactReaderFailure)
+            return err(new ArtifactOperationError(OPERATION, cause.reason, cause.details));
+        if (cause instanceof z.ZodError)
+            return err(new AnalysisProtocolError("JavaScript application analysis produced an invalid result", { cause }));
+        return err(new ArtifactOperationError(OPERATION, "io"));
+    }
+};

package/dist/application/JavaScriptApplicationWorkflowEvidence.js

@@ -0,0 +1,29 @@
+import { createEvidence, } from "../domain/evidence.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { JAVASCRIPT_APPLICATION_WORKFLOW_PROVIDER } from "./InvestigationProviders.js";
+/** Create derived Evidence for one bounded application-graph feature trace. */
+export const createApplicationFeatureTraceEvidence = (parameters, result) => createEvidence(undefined, JAVASCRIPT_APPLICATION_WORKFLOW_PROVIDER, {
+    predicateType: "rea.application-feature-trace/v1",
+    operation: "trace_application_feature",
+    parameters,
+    result: jsonValueSchema.parse(result),
+    rawResult: null,
+    confidence: "inferred",
+    authority: "analyst-inference",
+    environment: null,
+    limitations: result.limitations,
+    evidenceLinks: result.evidence_links,
+});
+/** Create derived Evidence for one tiered application version comparison. */
+export const createApplicationVersionComparisonEvidence = (parameters, result) => createEvidence(undefined, JAVASCRIPT_APPLICATION_WORKFLOW_PROVIDER, {
+    predicateType: "rea.application-version-comparison/v1",
+    operation: "compare_application_versions",
+    parameters,
+    result: jsonValueSchema.parse(result),
+    rawResult: null,
+    confidence: "inferred",
+    authority: "analyst-inference",
+    environment: null,
+    limitations: result.limitations,
+    evidenceLinks: result.evidence_links,
+});

package/dist/application/JavaScriptApplicationWorkflowService.js

@@ -0,0 +1,90 @@
+import { z } from "zod";
+import { AnalysisInputError, AnalysisProtocolError, } from "../domain/errors.js";
+import { projectInputIssues } from "../domain/inputIssueProjection.js";
+import { compareJavaScriptApplicationVersions } from "../domain/javascriptApplicationVersionComparison.js";
+import { compareApplicationVersionsInputSchema } from "../domain/javascriptApplicationVersionComparisonSchemas.js";
+import { traceApplicationFeature } from "../domain/javascriptFeatureTrace.js";
+import { traceApplicationFeatureInputSchema } from "../domain/javascriptFeatureTraceSchemas.js";
+import { err, ok } from "../domain/result.js";
+import { parseApplicationGraphEvidence, parseNativeApplicationEvidence, } from "./JavaScriptApplicationEvidenceGraph.js";
+import { createApplicationFeatureTraceEvidence, createApplicationVersionComparisonEvidence, } from "./JavaScriptApplicationWorkflowEvidence.js";
+/** Authenticate Evidence and derive one bounded cross-layer feature trace. */
+export const traceApplicationFeatureEvidence = (rawInput) => {
+    const operation = "trace_application_feature";
+    const parsed = traceApplicationFeatureInputSchema.safeParse(rawInput);
+    if (!parsed.success)
+        return err(new AnalysisInputError(operation, undefined, projectInputIssues(parsed.error.issues, rawInput)));
+    return traceApplicationFeatureEvidenceValidated(parsed.data);
+};
+/** Derive one feature trace from input parsed by a trusted adapter. */
+export const traceApplicationFeatureEvidenceValidated = (input) => {
+    const operation = "trace_application_feature";
+    try {
+        const source = parseApplicationGraphEvidence(input.application);
+        const nativeEvidence = parseNativeApplicationEvidence(input.native_observations);
+        const result = traceApplicationFeature({
+            sourceEvidenceId: source.evidence.evidence_id,
+            graph: source.graph,
+            nativeEvidence,
+            seed: input.seed,
+            direction: input.direction,
+            limits: input.limits,
+        });
+        return ok(createApplicationFeatureTraceEvidence({
+            application_evidence_id: source.evidence.evidence_id,
+            native_evidence_ids: nativeEvidence.map(({ evidence_id: id }) => id),
+            seed: input.seed,
+            direction: input.direction,
+            limits: input.limits,
+        }, result));
+    }
+    catch (cause) {
+        return workflowFailure(operation, cause);
+    }
+};
+/** Authenticate both graphs and derive a tiered cross-version change graph. */
+export const compareApplicationVersionsEvidence = (rawInput) => {
+    const operation = "compare_application_versions";
+    const parsed = compareApplicationVersionsInputSchema.safeParse(rawInput);
+    if (!parsed.success)
+        return err(new AnalysisInputError(operation, undefined, projectInputIssues(parsed.error.issues, rawInput)));
+    return compareApplicationVersionsEvidenceValidated(parsed.data);
+};
+/** Compare versions from input parsed by a trusted adapter. */
+export const compareApplicationVersionsEvidenceValidated = (input) => {
+    const operation = "compare_application_versions";
+    try {
+        const left = parseApplicationGraphEvidence(input.left);
+        const right = parseApplicationGraphEvidence(input.right);
+        const leftNative = parseNativeApplicationEvidence(input.left_native_observations);
+        const rightNative = parseNativeApplicationEvidence(input.right_native_observations);
+        const result = compareJavaScriptApplicationVersions({
+            left: {
+                evidenceId: left.evidence.evidence_id,
+                rootArtifactSha256: left.rootArtifactSha256,
+                graph: left.graph,
+            },
+            right: {
+                evidenceId: right.evidence.evidence_id,
+                rootArtifactSha256: right.rootArtifactSha256,
+                graph: right.graph,
+            },
+            leftNativeEvidence: leftNative,
+            rightNativeEvidence: rightNative,
+            limits: input.limits,
+        });
+        return ok(createApplicationVersionComparisonEvidence({
+            left_evidence_id: left.evidence.evidence_id,
+            right_evidence_id: right.evidence.evidence_id,
+            left_native_evidence_ids: leftNative.map(({ evidence_id: id }) => id),
+            right_native_evidence_ids: rightNative.map(({ evidence_id: id }) => id),
+            limits: input.limits,
+        }, result));
+    }
+    catch (cause) {
+        return workflowFailure(operation, cause);
+    }
+};
+const workflowFailure = (operation, cause) => err(cause instanceof z.ZodError || cause instanceof TypeError
+    ? new AnalysisInputError(operation)
+    : new AnalysisProtocolError("JavaScript application workflow produced an invalid result", { cause }));

package/dist/application/JavaScriptArtifactAnalysis.js

@@ -1,5 +1,8 @@
 import { createHash } from "node:crypto";
 import { analyzeJavaScriptStaticSource } from "../domain/javascriptStaticAnalysis.js";
+import { analyzeJavaScriptSemantics } from "../domain/javascriptSemanticAnalysis.js";
+import { DEFAULT_JAVASCRIPT_SEMANTIC_LIMITS, } from "../domain/javascriptSemanticIr.js";
+import { analyzeJavaScriptJsonModule } from "./JavaScriptJsonModules.js";
 /** Analyze selected text files under one shared AST, finding, module, and time budget. */
 export const analyzeJavaScriptArtifactFiles = (fileSet, input, now) => {
     const state = emptyArtifactAnalysis();
@@ -23,6 +26,7 @@ const finalizeArtifactAnalysis = (state, input) => {
     return {
         files: state.files,
         packages: state.packages,
+        json_modules: state.jsonModules,
         html_scripts: state.htmlScripts.slice(0, input.limits.max_findings),
         source_maps: state.sourceMaps,
         visited_ast_nodes: state.visitedNodes,
@@ -46,14 +50,13 @@ const finalizeArtifactAnalysis = (state, input) => {
 };
 const analyzeArtifactFile = (file, context) => {
     const { state, input } = context;
-    if (file.kind === "package-json")
-        state.packages.push(parsePackage(file));
+    addStructuredObservations(file, state);
     if (file.kind === "html" && file.text.included)
         state.htmlScripts.push(...parseHtmlScripts(file.path, file.text.value, Math.max(0, input.limits.max_findings - state.findings)));
     if (file.kind === "source-map")
         addSourceMap(file, context);
     if (file.kind !== "javascript" || !file.text.included) {
-        state.files.push({ file, javascript: null });
+        state.files.push({ file, javascript: null, semantic: null });
         return;
     }
     const remainingNodes = input.limits.max_ast_nodes - state.visitedNodes;
@@ -63,7 +66,7 @@ const analyzeArtifactFile = (file, context) => {
         remainingFindings <= 0 ||
         remainingModules <= 0 ||
         context.now() > context.deadline) {
-        state.files.push({ file, javascript: null });
+        state.files.push({ file, javascript: null, semantic: null });
         state.truncatedScopes += 1;
         return;
     }
@@ -74,14 +77,33 @@ const analyzeArtifactFile = (file, context) => {
         deadline: context.deadline,
         now: context.now,
     });
-    state.files.push({ file, javascript: analysis });
+    const staticFindings = findingCount(analysis);
+    const semanticFindingBudget = Math.max(0, input.limits.max_findings - state.findings - staticFindings);
+    const semanticLimits = {
+        ...DEFAULT_JAVASCRIPT_SEMANTIC_LIMITS,
+        maxScopes: remainingNodes,
+        maxBindings: remainingNodes,
+        maxCallables: remainingNodes,
+        maxReferences: remainingNodes,
+        maxModuleLinks: semanticFindingBudget,
+    };
+    const semantics = analysis.parse_status === "complete" || analysis.parse_status === "partial"
+        ? analyzeJavaScriptSemantics(file.text.value, semanticLimits)
+        : null;
+    state.files.push({
+        file,
+        javascript: analysis,
+        semantic: semantics === null ? null : { ir: semantics, limits: semanticLimits },
+    });
     state.visitedNodes += analysis.visited_ast_nodes;
-    state.findings += findingCount(analysis);
+    state.findings += staticFindings + (semantics?.moduleLinks.length ?? 0);
     state.modules += analysis.bundler_registrations.reduce((count, registration) => count + registration.modules.length, 0);
     if (analysis.parse_status === "failed")
         state.parseFailures += 1;
     if (analysis.parse_status === "truncated")
         state.truncatedScopes += 1;
+    if (semantics?.coverage.status === "truncated")
+        state.truncatedScopes += 1;
 };
 const addSourceMap = (file, context) => {
     const sourceMap = parseSourceMap(file, {
@@ -96,6 +118,7 @@ const addSourceMap = (file, context) => {
 const emptyArtifactAnalysis = () => ({
     files: [],
     packages: [],
+    jsonModules: [],
     htmlScripts: [],
     sourceMaps: [],
     visitedNodes: 0,
@@ -105,6 +128,16 @@ const emptyArtifactAnalysis = () => ({
     truncatedScopes: 0,
     sourceMapSources: 0,
 });
+const addStructuredObservations = (file, state) => {
+    if (file.kind === "package-json")
+        state.packages.push(parsePackage(file));
+    if (file.kind !== "json")
+        return;
+    const json = analyzeJavaScriptJsonModule(file);
+    state.jsonModules.push(json);
+    if (json.status === "invalid")
+        state.parseFailures += 1;
+};
 const parsePackage = (file) => {
     if (!file.text.included)
         return unavailablePackage(file, "Package metadata text was unavailable.");
@@ -146,6 +179,7 @@ const unavailablePackage = (file, limitation) => ({
 });
 const parseHtmlScripts = (path, text, maximum) => {
     const scripts = [];
+    const baseHref = htmlBaseHref(text);
     const pattern = /<script\b[^>]*\bsrc\s*=\s*(["'])([^"']+)\1[^>]*>/giu;
     for (const match of text.matchAll(pattern)) {
         const script = match[2]?.slice(0, 4_096);
@@ -155,11 +189,16 @@ const parseHtmlScripts = (path, text, maximum) => {
         scripts.push({
             html_path: path,
             script_path: script,
+            base_href: baseHref,
             location: rangeForOffsets(text, start, start + match[0].length),
         });
     }
     return scripts;
 };
+const htmlBaseHref = (text) => {
+    const match = /<base\b[^>]*\bhref\s*=\s*(["'])([^"']+)\1[^>]*>/iu.exec(text);
+    return match?.[2]?.slice(0, 4_096) ?? null;
+};
 const parseSourceMap = (file, context) => {
     if (!file.text.included)
         return unavailableSourceMap(file);
@@ -284,7 +323,13 @@ const findingCount = (analysis) => analysis.references.length +
     analysis.storage.length +
     analysis.role_paths.length +
     analysis.source_map_urls.length +
-    analysis.bundler_registrations.length;
+    analysis.bundler_registrations.length +
+    analysis.electron.browser_windows.length +
+    analysis.electron.context_bridge_apis.length +
+    analysis.electron.ipc.length +
+    analysis.electron.sender_validations.length +
+    analysis.electron.utility_processes.length +
+    analysis.electron.native_addon_bindings.length;
 const rangeForOffsets = (text, start, end) => ({
     start: pointForOffset(text, start),
     end: pointForOffset(text, end),

package/dist/application/JavaScriptArtifactFiles.js

@@ -197,6 +197,8 @@ const relevantKind = (path) => {
     const lower = path.toLowerCase();
     if (lower === "package.json" || lower.endsWith("/package.json"))
         return "package-json";
+    if (lower.endsWith(".json"))
+        return "json";
     if (/\.(?:cjs|mjs|js|jsx|ts|tsx)$/u.test(lower))
         return "javascript";
     if (/\.html?$/u.test(lower))
@@ -215,10 +217,12 @@ const filePriority = (kind) => {
             return 1;
         case "javascript":
             return 2;
-        case "source-map":
+        case "json":
             return 3;
-        case "native-addon":
+        case "source-map":
             return 4;
+        case "native-addon":
+            return 5;
     }
 };
 const isFilesystemAsar = (entry, path) => entry.kind === "file" &&

package/dist/application/JavaScriptArtifactGraphBuilder.js

@@ -3,8 +3,11 @@ import { JavaScriptArtifactGraphAccumulator } from "./JavaScriptArtifactGraphAcc
 import { javaScriptAnalysisLimits, } from "./JavaScriptArtifactGraphContext.js";
 import { addJavaScriptHtmlRoles, addJavaScriptSourceMapOriginals, } from "./JavaScriptArtifactGraphDocuments.js";
 import { addJavaScriptStaticFindings } from "./JavaScriptArtifactGraphFindings.js";
+import { addJavaScriptModuleRelationships, addJavaScriptSourceModules, } from "./JavaScriptModuleRelationships.js";
 import { completeReconstructionCoverage, partialReconstructionCoverage, } from "./JavaScriptArtifactGraphEvidence.js";
 import { addJavaScriptArtifactContainers, addJavaScriptArtifactFiles, addJavaScriptBundlerNodes, addJavaScriptPackageNodes, createJavaScriptArtifactRootNode, } from "./JavaScriptArtifactGraphStructure.js";
+import { addElectronBoundaries } from "./ElectronBoundaryGraph.js";
+import { classifyElectronIpcPairings, collectElectronIpcRecords, } from "./ElectronBoundaryAnalysis.js";
 /** Project bounded artifact and AST facts into JavaScript Application Graph v1. */
 export const buildJavaScriptArtifactGraph = (snapshot, fileSet, analysis, input) => {
     const accumulator = new JavaScriptArtifactGraphAccumulator();
@@ -19,14 +22,19 @@ export const buildJavaScriptArtifactGraph = (snapshot, fileSet, analysis, input)
         filesByPath: new Map(fileSet.files.map((file) => [file.path, file])),
         fileNodes: new Map(),
         assetNodes: new Map(),
+        sourceModuleNodes: new Map(),
+        chunkNodes: new Map(),
         moduleNodes: new Map(),
         containerNodes: new Map([[snapshot.manifest.root_sha256, root]]),
     };
     addJavaScriptArtifactContainers(context);
     addJavaScriptArtifactFiles(context);
     const packageRoots = addJavaScriptPackageNodes(context);
+    addJavaScriptSourceModules(context);
     addJavaScriptBundlerNodes(context);
+    addJavaScriptModuleRelationships(context);
     addJavaScriptStaticFindings(context);
+    addElectronBoundaries(context);
     addJavaScriptHtmlRoles(context);
     addJavaScriptSourceMapOriginals(context);
     const coverage = graphCoverage(context);
@@ -47,34 +55,91 @@ const graphCoverage = (context) => {
         context.accumulator.omittedObservations();
     const sourceMapPolicyGap = context.analysis.source_maps.some(({ status }) => status === "not-approved");
     const malformedStructuredData = context.analysis.packages.some(({ status }) => status !== "included") ||
+        context.analysis.json_modules.some(({ status }) => status !== "included") ||
         context.analysis.source_maps.some(({ status }) => status === "invalid");
+    const partialJavaScript = context.analysis.files.some(({ javascript }) => javascript !== null && javascript.parse_status === "partial");
     const unknownGap = context.analysis.parse_failures > 0 ||
         context.fileSet.invalid_utf8_files > 0 ||
         sourceMapPolicyGap ||
-        malformedStructuredData;
+        malformedStructuredData ||
+        partialJavaScript;
     if (context.analysis.truncated_scopes > 0)
-        return partialReconstructionCoverage(reconstructionLimits(context.input), null, true);
+        return partialReconstructionCoverage(reconstructionLimits(context.input), truncationOmittedCount(context), true);
     if (exactLimitOmissions > 0)
         return partialReconstructionCoverage(reconstructionLimits(context.input), exactLimitOmissions, true);
     if (unknownGap)
         return partialReconstructionCoverage(reconstructionLimits(context.input), null, false);
     return completeReconstructionCoverage(reconstructionLimits(context.input));
 };
-const graphLimitations = (context, coverage) => [
-    ...context.analysis.limitations,
-    "Webpack/Rspack factories were recovered from AST literals; REA did not invoke push handlers or bundle bootstrap code.",
-    "Static imports, entrypoints, workers, endpoints, and storage relationships do not prove runtime execution.",
-    ...(context.accumulator.omittedObservations() === 0
-        ? []
-        : [
-            "Repeated content identities exceeded the per-node observation bound; containment edges still preserve inventoried paths.",
-        ]),
-    ...(coverage === "complete"
-        ? []
-        : [
-            "Graph coverage is incomplete; unavailable facts remain explicit and must not be read as absence.",
-        ]),
-];
+const truncationOmittedCount = (context) => {
+    const staticTruncations = context.analysis.files.filter(({ javascript }) => javascript?.parse_status === "truncated");
+    if (staticTruncations.length > 0)
+        return null;
+    const semanticTruncations = context.analysis.files.flatMap(({ semantic }) => semantic?.ir.coverage.status === "truncated" ? [semantic.ir.coverage] : []);
+    const sourceMapTruncations = context.analysis.source_maps.filter(({ status }) => status === "truncated");
+    if (sourceMapTruncations.length > 0)
+        return null;
+    if (semanticTruncations.length !== context.analysis.truncated_scopes)
+        return null;
+    const omissions = semanticTruncations.map(({ omittedCount }) => omittedCount);
+    return omissions.some((omitted) => omitted === null)
+        ? null
+        : omissions.reduce((total, omitted) => total + (omitted ?? 0), 0);
+};
+const graphLimitations = (context, coverage) => {
+    const ipc = collectElectronIpcRecords(context.analysis);
+    const pairings = classifyElectronIpcPairings(ipc);
+    const electronFindings = context.analysis.files.reduce((count, { javascript }) => count +
+        (javascript === null
+            ? 0
+            : javascript.electron.browser_windows.length +
+                javascript.electron.context_bridge_apis.length +
+                javascript.electron.ipc.length +
+                javascript.electron.sender_validations.length +
+                javascript.electron.utility_processes.length +
+                javascript.electron.native_addon_bindings.length), 0);
+    return [
+        ...context.analysis.limitations,
+        "CommonJS and ESM binding relationships were recovered from inert syntax and resolved only within the inventoried artifact container.",
+        "Webpack/Rspack factories were recovered from AST literals; REA did not invoke push handlers or bundle bootstrap code.",
+        "Static imports, entrypoints, workers, endpoints, and storage relationships do not prove runtime execution.",
+        ...(electronFindings === 0
+            ? []
+            : [
+                "Electron relationships are derived from inert syntax; runtime registration, reachability, defaults, and enforcement remain unproven.",
+            ]),
+        ...(ipc.some(({ finding }) => finding.channel === null)
+            ? [
+                "Dynamic IPC channel expressions remain unresolved and are never paired by textual similarity.",
+            ]
+            : []),
+        ...(pairings.some(({ status }) => status === "ambiguous")
+            ? [
+                "Some literal IPC channels have multiple compatible main handlers; ambiguous calls are not paired to any handler.",
+            ]
+            : []),
+        ...(context.analysis.files.some(({ javascript }) => (javascript?.electron.sender_validations.length ?? 0) > 0)
+            ? [
+                "Sender, frame, URL, and origin checks are observations only; REA does not claim that they enforce a complete authorization policy.",
+            ]
+            : []),
+        ...(context.analysis.files.some(({ javascript }) => (javascript?.electron.native_addon_bindings.length ?? 0) > 0)
+            ? [
+                "Native member names are requested by JavaScript syntax and are not verified binary exports in this workflow.",
+            ]
+            : []),
+        ...(context.accumulator.omittedObservations() === 0
+            ? []
+            : [
+                "Repeated content identities exceeded the per-node observation bound; containment edges still preserve inventoried paths.",
+            ]),
+        ...(coverage === "complete"
+            ? []
+            : [
+                "Graph coverage is incomplete; unavailable facts remain explicit and must not be read as absence.",
+            ]),
+    ];
+};
 const reconstructionLimits = (input) => [
     {
         name: "max-entries",