rea-agents 5.0.0 → 6.1.0

package/dist/application/javascript/JavaScriptArtifactGraphBuilder.js

@@ -1,14 +1,19 @@
-import { createJavaScriptApplicationGraph, } from "../../domain/javascript/javascriptApplicationGraph.js";
+import { createJavaScriptApplicationGraph, createImmutableJavaScriptApplicationGraphSteps, } from "../../domain/javascript/javascriptApplicationGraph.js";
 import { JavaScriptArtifactGraphAccumulator } from "./JavaScriptArtifactGraphAccumulator.js";
 import { addJavaScriptHtmlRoles, addJavaScriptSourceMapOriginals, } from "./JavaScriptArtifactGraphDocuments.js";
 import { addJavaScriptStaticFindings } from "./JavaScriptArtifactGraphFindings.js";
 import { addJavaScriptModuleRelationships, addJavaScriptSourceModules, } from "./JavaScriptModuleRelationships.js";
 import { completeApplicationCoverage, partialApplicationCoverage, } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
+import { semanticCoverageResourceLimits } from "../../domain/javascript/javascriptSemanticCoverage.js";
+import { SEMANTIC_EXPRESSION_DEPTH_LIMIT, SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT, SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT, semanticResourceLimitReason, } from "../../domain/javascript/javascriptSemanticResourceLimits.js";
 import { addJavaScriptArtifactContainers, addJavaScriptArtifactFiles, addJavaScriptBundlerNodes, addJavaScriptPackageNodes, createJavaScriptArtifactRootNode, } from "./JavaScriptArtifactGraphStructure.js";
 import { addElectronBoundaries } from "./ElectronBoundaryGraph.js";
 import { classifyElectronIpcPairings, collectElectronIpcRecords, } from "./ElectronBoundaryAnalysis.js";
 /** Project artifact and AST facts into JavaScript Application Graph. */
-export const buildJavaScriptArtifactGraph = (snapshot, fileSet, analysis) => {
+export const buildJavaScriptArtifactGraph = (snapshot, fileSet, analysis) => createJavaScriptApplicationGraph(buildJavaScriptArtifactGraphInput(snapshot, fileSet, analysis));
+/** Build a validated application graph with cooperative immutable ownership. */
+export const buildImmutableJavaScriptArtifactGraphSteps = (snapshot, fileSet, analysis) => createImmutableJavaScriptApplicationGraphSteps(buildJavaScriptArtifactGraphInput(snapshot, fileSet, analysis));
+const buildJavaScriptArtifactGraphInput = (snapshot, fileSet, analysis) => {
     const accumulator = new JavaScriptArtifactGraphAccumulator();
     const root = createJavaScriptArtifactRootNode(accumulator, snapshot);
     const context = {
@@ -30,13 +35,13 @@ export const buildJavaScriptArtifactGraph = (snapshot, fileSet, analysis) => {
     const packageRoots = addJavaScriptPackageNodes(context);
     addJavaScriptSourceModules(context);
     addJavaScriptBundlerNodes(context);
-    addJavaScriptModuleRelationships(context);
+    const relationshipOmissions = addJavaScriptModuleRelationships(context);
     addJavaScriptStaticFindings(context);
     addElectronBoundaries(context);
     addJavaScriptHtmlRoles(context);
     addJavaScriptSourceMapOriginals(context);
     const coverage = graphCoverage(context);
-    return createJavaScriptApplicationGraph({
+    return {
         schema: "JavaScriptApplicationGraph",
         root_node_ids: packageRoots.length === 0
             ? [root.node_id]
@@ -44,10 +49,11 @@ export const buildJavaScriptArtifactGraph = (snapshot, fileSet, analysis) => {
         nodes: accumulator.nodes(),
         edges: accumulator.edges(),
         coverage,
-        limitations: graphLimitations(context, coverage.status),
-    });
+        limitations: graphLimitations(context, coverage.status, relationshipOmissions),
+    };
 };
 const graphCoverage = (context) => {
+    const resourceLimits = semanticResourceLimits(context);
     const sourceMapPolicyGap = context.analysis.source_maps.some(({ status }) => status === "invalid");
     const malformedStructuredData = context.analysis.packages.some(({ status }) => status !== "included") ||
         context.analysis.json_modules.some(({ status }) => status !== "included") ||
@@ -60,11 +66,31 @@ const graphCoverage = (context) => {
         partialJavaScript;
     if (context.analysis.truncated_scopes > 0)
         return partialApplicationCoverage([], null);
+    if (resourceLimits.length > 0)
+        return partialApplicationCoverage(resourceLimits.map(applicationGraphResourceLimit), null);
     if (unknownGap)
         return partialApplicationCoverage([], null);
     return completeApplicationCoverage();
 };
-const graphLimitations = (context, coverage) => {
+const semanticResourceLimits = (context) => [
+    ...new Set(context.analysis.files.flatMap(({ semantic }) => semantic === null
+        ? []
+        : semanticCoverageResourceLimits(semantic.ir.coverage))),
+].sort();
+const applicationGraphResourceLimit = (resourceLimit) => ({
+    name: `javascript_semantic_${resourceLimit.replaceAll("-", "_")}`,
+    value: resourceLimit === "primitive-candidates"
+        ? SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT
+        : resourceLimit === "primitive-bytes"
+            ? SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT
+            : SEMANTIC_EXPRESSION_DEPTH_LIMIT,
+    unit: resourceLimit === "expression-depth"
+        ? "depth"
+        : resourceLimit === "primitive-bytes"
+            ? "bytes"
+            : "items",
+});
+const graphLimitations = (context, coverage, relationshipOmissions) => {
     const ipc = collectElectronIpcRecords(context.analysis);
     const pairings = classifyElectronIpcPairings(ipc);
     const electronFindings = context.analysis.files.reduce((count, { javascript }) => count +
@@ -78,6 +104,11 @@ const graphLimitations = (context, coverage) => {
                 javascript.electron.native_addon_bindings.length), 0);
     return [
         ...context.analysis.limitations,
+        ...(relationshipOmissions.selfImports > 0
+            ? [
+                `${String(relationshipOmissions.selfImports)} import ${relationshipOmissions.selfImports === 1 ? "specifier" : "specifiers"} resolved back to the importing module itself and ${relationshipOmissions.selfImports === 1 ? "was" : "were"} omitted; application graph edges cannot be self-referential.`,
+            ]
+            : []),
         "CommonJS and ESM binding relationships were recovered from inert syntax and resolved only within the inventoried artifact container.",
         "Webpack/Rspack factories were recovered from AST literals; REA did not invoke push handlers or bundle bootstrap code.",
         "Static imports, entrypoints, workers, endpoints, and storage relationships do not prove runtime execution.",
@@ -101,6 +132,7 @@ const graphLimitations = (context, coverage) => {
                 "Sender, frame, URL, and origin checks are observations only; REA does not claim that they enforce a complete authorization policy.",
             ]
             : []),
+        ...semanticResourceLimits(context).map(semanticResourceLimitReason),
         ...(context.analysis.files.some(({ javascript }) => (javascript?.electron.native_addon_bindings.length ?? 0) > 0)
             ? [
                 "Native member names are requested by JavaScript syntax and are not verified binary exports in this workflow.",

package/dist/application/javascript/JavaScriptArtifactGraphDocuments.js

@@ -1,5 +1,5 @@
 import { addArtifactContainsEdge, addStaticInferenceEdge, createElectronRoleNode, linkElectronRoleToAsset, } from "./JavaScriptArtifactGraphContext.js";
-import { artifactObservationEvidence } from "./JavaScriptArtifactGraphEvidence.js";
+import { artifactObservationEvidence, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
 import { completeApplicationCoverage } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
 import { resolveArtifactPathByContext } from "./JavaScriptArtifactPathResolution.js";
 /** Project HTML renderer entrypoints and their local script assets. */
@@ -46,8 +46,32 @@ export const addJavaScriptHtmlRoles = (context) => {
                 htmlBaseHref: script.base_href,
             });
             const resolvedPath = resolution.resolved_path;
-            if (resolvedPath === null)
+            if (resolvedPath === null) {
+                context.accumulator.addNode({
+                    kind: role.kind,
+                    identity: role.identity,
+                    observations: [
+                        {
+                            label: script.script_path,
+                            properties: {
+                                mechanism: "html-script-reference",
+                                script_path: script.script_path,
+                                base_href: script.base_href,
+                                ...resolution,
+                            },
+                            evidence: staticInferenceEvidence({
+                                sha256: html.sha256,
+                                path: html.path,
+                                range: script.location,
+                                operation: "resolve-html-script-reference",
+                                coverage: completeApplicationCoverage(),
+                                limitations: resolution.limitations,
+                            }),
+                        },
+                    ],
+                });
                 continue;
+            }
             const resolved = context.fileNodes.get(resolvedPath);
             if (resolved === undefined)
                 continue;

package/dist/application/javascript/JavaScriptArtifactPathResolution.js

@@ -14,16 +14,24 @@ const EXTENSIONS = [
 const NODE_BUILTINS = new Set(builtinModules.map((name) => name.replace(/^node:/u, "")));
 /** Resolve one declaration under its exact syntax/metadata context. */
 export const resolveArtifactPathByContext = (input) => resolvePackagePath(input, new Set());
-const resolvePackagePath = (input, packageChain, mode = "full") => {
+const resolvePackagePath = (input, packageChain, mode = "full", exportsTargetUrl = false) => {
     const rejected = rejectDeclaration(input);
     if (rejected !== null)
         return rejected;
-    const candidate = contextualCandidate(input);
+    const candidate = contextualCandidate(input, exportsTargetUrl);
     if (typeof candidate !== "string")
         return candidate;
     const confined = confineCandidate(input, candidate);
     if (typeof confined !== "string")
         return confined;
+    if (input.context === "html-reference")
+        return outcome(input, resolveFileCandidates(input, [confined]) ?? {
+            resolvedPath: null,
+            status: "not-found",
+            limitations: [
+                `The exact HTML resource ${confined} was not found among the selected application files.`,
+            ],
+        });
     const resolved = mode === "files-and-index"
         ? (resolveFileCandidates(input, [
             ...fileCandidates(confined),
@@ -48,10 +56,11 @@ const rejectDeclaration = (input) => {
         ]);
     return null;
 };
-const contextualCandidate = (input) => {
+const contextualCandidate = (input, exportsTargetUrl) => {
     const { context } = input;
-    const declared = context === "html-reference" ||
+    let declared = context === "html-reference" ||
         context === "url-reference" ||
+        exportsTargetUrl ||
         (context === "module-specifier" && input.moduleKind !== "require")
         ? stripQueryAndFragment(input.declaredPath)
         : input.declaredPath;
@@ -72,6 +81,23 @@ const contextualCandidate = (input) => {
         return unresolvedOutcome(input, "external", [
             "URL schemes and protocol-relative URLs are outside this local artifact path context.",
         ]);
+    // Exports targets use URL paths for both loaders; legacy main fields remain literal.
+    if (exportsTargetUrl ||
+        (context === "module-specifier" && input.moduleKind !== "require")) {
+        try {
+            declared = decodeURIComponent(declared);
+        }
+        catch (cause) {
+            void cause;
+            return unresolvedOutcome(input, "rejected", [
+                "The module URL path contains malformed percent encoding.",
+            ]);
+        }
+        if (declared.includes("\0"))
+            return unresolvedOutcome(input, "rejected", [
+                "The decoded module URL path contains NUL.",
+            ]);
+    }
     const relative = declared.startsWith("/") ? declared.slice(1) : declared;
     return declared.startsWith("/")
         ? relative
@@ -206,6 +232,12 @@ const resolveCandidate = (input, candidate, packageChain) => {
                 `Directory package metadata ${packagePath} is not valid package JSON.`,
             ],
         };
+    if (main.status === "rejected")
+        return {
+            resolvedPath: null,
+            status: "rejected",
+            limitations: [`Package metadata ${packagePath}: ${main.limitation}`],
+        };
     if (main.status === "unmatched")
         return {
             resolvedPath: null,
@@ -242,7 +274,7 @@ const resolveCandidate = (input, candidate, packageChain) => {
             return index;
     }
     // Preserve recursive artifact package lookup only after legacy file/index fallbacks.
-    return candidateOutcome(resolvePackagePath(entryInput, chain));
+    return candidateOutcome(resolvePackagePath(entryInput, chain, "full", main.source === "exports"));
 };
 const candidateOutcome = (nested) => nested.resolution_status === "resolved"
     ? {
@@ -283,9 +315,12 @@ const packageEntry = (text, moduleKind, useExports) => {
                 ? { ...exported, source: "exports" }
                 : exported;
         }
-        const preferred = moduleKind === "import"
-            ? [Reflect.get(value, "module"), Reflect.get(value, "main")]
-            : [Reflect.get(value, "main"), Reflect.get(value, "module")];
+        // Node imports and requires ignore the bundler-only module field. Keep
+        // that fallback for callers without an explicit module-loading kind.
+        const preferred = [
+            Reflect.get(value, "main"),
+            ...(moduleKind === undefined ? [Reflect.get(value, "module")] : []),
+        ];
         const entry = preferred.find((candidate) => candidate !== undefined);
         if (entry === undefined)
             return { status: "missing" };
@@ -299,23 +334,35 @@ const packageEntry = (text, moduleKind, useExports) => {
     }
 };
 const packageExport = (value, moduleKind) => {
-    if (typeof value === "string")
-        return packagePathValue(value);
-    if (typeof value !== "object" || value === null || Array.isArray(value))
-        return { status: "invalid" };
-    const root = Reflect.get(value, ".") ?? value;
-    if (typeof root === "string")
-        return packagePathValue(root);
-    if (typeof root !== "object" || root === null || Array.isArray(root))
-        return { status: "invalid" };
+    const root = typeof value === "object" && value !== null && Object.hasOwn(value, ".")
+        ? Reflect.get(value, ".")
+        : value;
     const flattened = exportTargets(root, packageExportConditions(moduleKind));
     if (flattened.kind === "invalid")
-        return { status: "invalid" };
+        return { status: "rejected", limitation: flattened.limitation };
     const first = flattened.kind === "unmatched" ? undefined : flattened.values[0];
     return first === undefined
-        ? { status: "unmatched", declared: Object.keys(root) }
+        ? {
+            status: "unmatched",
+            declared: typeof root === "object" && root !== null ? Object.keys(root) : [],
+        }
         : { status: "value", value: first };
 };
+const invalidExportTarget = (value, reason) => ({
+    kind: "invalid",
+    limitation: `The package exports target ${JSON.stringify(value) ?? String(value)} ${reason}.`,
+});
+// Node checks raw target segments before URL normalization. Compare encoded
+// segment names here; full URL decoding follows array target selection.
+const forbiddenExportSegment = (value) => value
+    .slice(2)
+    .split(/[\\/]/u)
+    .find((raw) => {
+    const segment = raw.replace(/%[0-9a-f]{2}/giu, (encoded) => String.fromCharCode(Number.parseInt(encoded.slice(1), 16)));
+    return (segment === "." ||
+        segment === ".." ||
+        segment.toLowerCase() === "node_modules");
+});
 /**
  * Resolve a target in Node's declared order. Explicit null blocks an active
  * condition, whereas an unmatched nested object permits the next condition.
@@ -323,30 +370,36 @@ const packageExport = (value, moduleKind) => {
  * preserves the final invalid-versus-null refusal if no string is selected.
  */
 const exportTargets = (value, conditions) => {
-    if (typeof value === "string")
-        return value.startsWith("./")
+    if (typeof value === "string") {
+        if (!value.startsWith("./"))
+            return invalidExportTarget(value, 'must start with "./"');
+        const forbidden = forbiddenExportSegment(value);
+        return forbidden === undefined
             ? { kind: "targets", values: [value] }
-            : { kind: "invalid" };
+            : invalidExportTarget(value, `contains forbidden path segment ${JSON.stringify(forbidden)} before URL normalization`);
+    }
     if (value === null)
         return { kind: "targets", values: [] };
     if (Array.isArray(value)) {
-        let invalid = false;
+        let invalid = null;
         for (const entry of value) {
             const nested = exportTargets(entry, conditions);
             if (nested.kind === "invalid") {
-                invalid = true;
+                invalid = nested.limitation;
                 continue;
             }
             if (nested.kind === "unmatched")
                 continue;
-            invalid = false;
+            invalid = null;
             if (nested.values.length > 0)
                 return nested;
         }
-        return invalid ? { kind: "invalid" } : { kind: "targets", values: [] };
+        return invalid === null
+            ? { kind: "targets", values: [] }
+            : { kind: "invalid", limitation: invalid };
     }
     if (typeof value !== "object")
-        return { kind: "invalid" };
+        return invalidExportTarget(value, "must be a relative string, object, array, or null");
     for (const [condition, target] of Object.entries(value)) {
         if (!conditions.has(condition))
             continue;

package/dist/application/javascript/JavaScriptArtifactReconstruction.js

@@ -1,15 +1,20 @@
 import { lstat, realpath } from "node:fs/promises";
 import { ArtifactReaderFailure } from "../../artifacts/ArtifactReader.js";
 import { createJavaScriptArtifactReader as createReader } from "../../artifacts/javascript/JavaScriptArtifactReader.js";
-import { analyzeJavaScriptArtifactFiles } from "./JavaScriptArtifactAnalysis.js";
+import { analyzeAndProjectJavaScriptArtifactFiles } from "./JavaScriptArtifactAnalysis.js";
 import { readJavaScriptArtifactFiles } from "../../artifacts/javascript/JavaScriptArtifactFiles.js";
-import { buildJavaScriptArtifactGraph } from "./JavaScriptArtifactGraphBuilder.js";
+import { buildImmutableJavaScriptArtifactGraphSteps } from "./JavaScriptArtifactGraphBuilder.js";
 import { javascriptArtifactReconstructionInputSchema, } from "./JavaScriptArtifactReconstructionInput.js";
-import { scanCanonicalArtifactInventory } from "../ArtifactInventory.js";
+import { scanCanonicalArtifactInventory } from "../../artifacts/inventory/ArtifactInventory.js";
 import { summarizeElectronBoundaries } from "./ElectronBoundaryAnalysis.js";
-import { buildJavaScriptSemanticGraph } from "./JavaScriptSemanticGraphBuilder.js";
+import { createJavaScriptSemanticGraphProjection } from "./JavaScriptSemanticGraphBuilder.js";
+import { checkpointJavaScriptAnalysis, completeJavaScriptAnalysisSteps, } from "./JavaScriptAnalysisControl.js";
 /** Reconstruct one local ASAR or extracted directory without executing code. */
-export const reconstructJavaScriptArtifact = async (rawInput, signal) => {
+export const reconstructJavaScriptArtifact = async (rawInput, signal, progress) => {
+    const reportPhase = async (phase, message) => {
+        await progress?.report({ phase, completed: 0, total: 1, message });
+        await checkpointJavaScriptAnalysis(signal);
+    };
     const input = javascriptArtifactReconstructionInputSchema.parse(rawInput);
     abortIfNeeded(signal);
     const path = await realpath(input.input_path);
@@ -19,15 +24,31 @@ export const reconstructJavaScriptArtifact = async (rawInput, signal) => {
         throw new ArtifactReaderFailure("format", `Artifact inventory classified ${path} as ${snapshot.manifest.root_format}, not ${format}`);
     const reader = createReader(path, format);
     try {
+        await reportPhase("read_javascript_artifacts", "Reading inventoried JavaScript application sources");
         const files = await readJavaScriptArtifactFiles(reader, snapshot, signal);
-        const analysis = analyzeJavaScriptArtifactFiles(files);
-        abortIfNeeded(signal);
-        const graph = buildJavaScriptArtifactGraph(snapshot, files, analysis);
-        const semanticGraph = buildJavaScriptSemanticGraph({
-            rootArtifactSha256: snapshot.manifest.root_sha256,
-            applicationGraph: graph,
-            analysis,
+        await reportPhase("parse_javascript_sources", `Parsing and projecting ${String(files.files.length)} application source files`);
+        const semanticProjection = createJavaScriptSemanticGraphProjection();
+        const analysis = await analyzeAndProjectJavaScriptArtifactFiles(files, semanticProjection.projectFile, async (file, completed, total) => {
+            abortIfNeeded(signal);
+            await progress?.report({
+                phase: "parse_javascript_source",
+                completed: 0,
+                total: 1,
+                message: `Parsing and projecting ${file.path} (${String(completed + 1)}/${String(total)})`,
+            });
+            abortIfNeeded(signal);
         });
+        await checkpointJavaScriptAnalysis(signal);
+        abortIfNeeded(signal);
+        await reportPhase("build_javascript_application_graph", "Constructing application and Electron boundary relationships");
+        const applicationGraphSteps = buildImmutableJavaScriptArtifactGraphSteps(snapshot, files, analysis);
+        await reportPhase("seal_javascript_application_graph", "Sealing the validated application graph");
+        const graph = await completeJavaScriptAnalysisSteps(applicationGraphSteps, signal);
+        await reportPhase("build_javascript_semantic_graph", "Binding and validating static semantic relationships");
+        const semanticGraphSteps = semanticProjection.finishImmutableSteps(snapshot.manifest.root_sha256, graph, analysis);
+        await reportPhase("seal_javascript_semantic_graph", "Sealing the validated semantic graph");
+        const semanticGraph = await completeJavaScriptAnalysisSteps(semanticGraphSteps, signal);
+        await checkpointJavaScriptAnalysis(signal);
         return {
             input_path: path,
             format,

package/dist/application/javascript/JavaScriptModuleRelationships.js

@@ -1,6 +1,8 @@
 import { posix } from "node:path";
 import { compareCodePoints } from "../../domain/canonicalOrdering.js";
 import { completeApplicationCoverage, partialApplicationCoverage, } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
+import { semanticCoverageResourceLimits } from "../../domain/javascript/javascriptSemanticCoverage.js";
+import { SEMANTIC_EXPRESSION_DEPTH_LIMIT, SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT, SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT, semanticResourceLimitReason, } from "../../domain/javascript/javascriptSemanticResourceLimits.js";
 import { addAstContainsEdge, artifactLocalIdentity, } from "./JavaScriptArtifactGraphContext.js";
 import { astObservationEvidence, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
 import { resolveArtifactPathByContext, } from "./JavaScriptArtifactPathResolution.js";
@@ -58,6 +60,7 @@ export const addJavaScriptSourceModules = (context) => {
 };
 /** Compose bounded CommonJS and ESM binding relationships across artifact files. */
 export const addJavaScriptModuleRelationships = (context) => {
+    const omissions = { selfImports: 0 };
     for (const analyzed of context.analysis.files) {
         const { file, semantic } = analyzed;
         const source = context.sourceModuleNodes.get(file.path);
@@ -66,16 +69,17 @@ export const addJavaScriptModuleRelationships = (context) => {
         for (const link of semantic.ir.moduleLinks) {
             const input = { context, file, semantic, source, link };
             if (isExportLink(link))
-                addExportRelationship(input);
+                addExportRelationship(input, omissions);
             else if (link.specifier !== null)
-                addImportRelationship(input, source, {
+                addImportRelationship(input, source, omissions, {
                     specifier: link.specifier,
                     importedPath: link.importedName === null ? [] : [link.importedName],
                 });
         }
     }
+    return omissions;
 };
-const addExportRelationship = (input) => {
+const addExportRelationship = (input, omissions) => {
     const { context, file, semantic, source, link } = input;
     if (link.exportedName === null)
         return;
@@ -137,10 +141,18 @@ const addExportRelationship = (input) => {
     });
     const origin = moduleOriginForExport(semantic.ir, link);
     if (origin !== null)
-        addImportRelationship(input, exported, origin);
+        addImportRelationship(input, exported, omissions, origin);
 };
-const addImportRelationship = (input, source, origin) => {
+const addImportRelationship = (input, source, omissions, origin) => {
     const target = resolveModuleTarget(input, origin.specifier);
+    // A specifier that resolves back to the importing module itself (a literal
+    // self-import, self-require, or artifact-confined path alias)
+    // cannot become an edge: the application graph forbids self-referential
+    // edges, and emitting one fails result validation for the whole analysis.
+    if (target.node.node_id === source.node_id) {
+        omissions.selfImports += 1;
+        return;
+    }
     input.context.accumulator.addEdge({
         source_node_id: source.node_id,
         target_node_id: target.node.node_id,
@@ -242,12 +254,29 @@ const relationshipEvidence = (input, operation, limitations, confidence = "high"
     operation,
     coverage: semanticCoverage(input.semantic),
     confidence,
-    limitations: [...input.semantic.ir.limitations, ...limitations],
+    limitations: [
+        ...input.semantic.ir.limitations,
+        ...semanticCoverageResourceLimits(input.semantic.ir.coverage).map(semanticResourceLimitReason),
+        ...limitations,
+    ],
 });
 const semanticCoverage = (semantic) => {
-    if (semantic.ir.coverage.status === "complete")
+    const resourceLimits = semanticCoverageResourceLimits(semantic.ir.coverage);
+    if (semantic.ir.coverage.status === "complete" && resourceLimits.length === 0)
         return completeApplicationCoverage();
-    return partialApplicationCoverage([], semantic.ir.coverage.omittedCount);
+    return partialApplicationCoverage(resourceLimits.map((resourceLimit) => ({
+        name: `javascript_semantic_${resourceLimit.replaceAll("-", "_")}`,
+        value: resourceLimit === "primitive-candidates"
+            ? SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT
+            : resourceLimit === "primitive-bytes"
+                ? SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT
+                : SEMANTIC_EXPRESSION_DEPTH_LIMIT,
+        unit: resourceLimit === "expression-depth"
+            ? "depth"
+            : resourceLimit === "primitive-bytes"
+                ? "bytes"
+                : "items",
+    })), semantic.ir.coverage.omittedCount);
 };
 const moduleFormat = (path, ir) => {
     const extension = posix.extname(path).toLowerCase();

package/dist/application/javascript/JavaScriptRecoveryService.js

@@ -3,7 +3,7 @@ import { AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, } from
 import { createEvidence } from "../../domain/evidence.js";
 import { javascriptRecoveryInputSchema, javascriptRecoveryResultSchema, } from "../../domain/javascript/javascriptRecovery.js";
 import { jsonObjectSchema } from "../../domain/jsonValue.js";
-import { projectInputIssues } from "../../domain/inputIssueProjection.js";
+import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
 import { err, ok } from "../../domain/result.js";
 const OPERATION = "recover_javascript_sources";
 /** Shared CLI/MCP parsing and Evidence for derived JavaScript artifacts. */
@@ -18,7 +18,9 @@ export class JavaScriptRecoveryService {
             return err(new AnalysisCancelledError(OPERATION));
         const parsed = javascriptRecoveryInputSchema.safeParse(input);
         if (!parsed.success)
-            return err(new AnalysisInputError(OPERATION, { cause: parsed.error }, projectInputIssues(parsed.error.issues, input)));
+            return err(analysisInputErrorFromIssues(OPERATION, parsed.error.issues, input, {
+                cause: parsed.error,
+            }));
         const invalidPaths = ["path", "output_directory"].filter((field) => !isAbsolute(parsed.data[field]));
         if (invalidPaths.length > 0)
             return err(new AnalysisInputError(OPERATION, undefined, invalidPaths.map((field) => ({

package/dist/application/javascript/JavaScriptRuntimeObservationService.js

@@ -1,5 +1,5 @@
 import { createJavaScriptRuntimeObservationEvidence } from "./JavaScriptRuntimeObservationEvidence.js";
-import { AnalysisCapabilityUnavailableError } from "../../domain/analysisErrorCore.js";
+import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, } from "../../domain/analysisErrorCore.js";
 import {} from "../../domain/analysisErrorBase.js";
 import { err, ok } from "../../domain/result.js";
 /** List targets exposed by the explicitly selected loopback Inspector. */
@@ -18,6 +18,8 @@ export const observeJavaScriptRuntime = async (provider, input, options = {}) =>
     if (!ready.ok)
         return ready;
     const result = await ready.value.observe(input, options);
+    if (options.signal?.aborted === true)
+        return err(new AnalysisCancelledError("observe_javascript_runtime"));
     return result.ok
         ? ok(createJavaScriptRuntimeObservationEvidence("observe_javascript_runtime", input, result.value, ready.value.identity()))
         : result;

package/dist/application/javascript/JavaScriptRuntimeReconciliationService.js

@@ -2,7 +2,7 @@ import { resolve } from "node:path";
 import { z } from "zod";
 import { AnalysisInputError, AnalysisProtocolError, } from "../../domain/analysisErrorCore.js";
 import {} from "../../domain/analysisErrorBase.js";
-import { projectInputIssues } from "../../domain/inputIssueProjection.js";
+import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
 import { reconcileJavaScriptRuntime } from "../../domain/javascript/javascriptRuntimeReconciliation.js";
 import { reconcileJavaScriptRuntimeInputSchema } from "../../domain/javascript/javascriptRuntimeReconciliationSchemas.js";
 import { err, ok } from "../../domain/result.js";
@@ -12,7 +12,7 @@ const OPERATION = "reconcile_javascript_runtime";
 export const reconcileJavaScriptRuntimeEvidence = (rawInput) => {
     const parsed = reconcileJavaScriptRuntimeInputSchema.safeParse(rawInput);
     if (!parsed.success)
-        return err(new AnalysisInputError(OPERATION, undefined, projectInputIssues(parsed.error.issues, rawInput)));
+        return err(analysisInputErrorFromIssues(OPERATION, parsed.error.issues, rawInput));
     return reconcileJavaScriptRuntimeEvidenceValidated(parsed.data);
 };
 /** Reconcile input already parsed by a trusted adapter boundary. */
@@ -24,7 +24,7 @@ export const reconcileJavaScriptRuntimeEvidenceValidated = (parsedInput) => {
     }
     catch (cause) {
         if (cause instanceof z.ZodError)
-            return err(new AnalysisInputError(OPERATION, undefined, projectInputIssues(cause.issues, parsedInput)));
+            return err(analysisInputErrorFromIssues(OPERATION, cause.issues, parsedInput));
         if (cause instanceof TypeError &&
             SAFE_RECONCILIATION_INPUT_CONSTRAINTS.has(cause.message))
             return err(new AnalysisInputError(OPERATION, undefined, [

package/dist/application/javascript/JavaScriptSemanticGraphAsyncProjection.js

@@ -1,5 +1,5 @@
 import { createJavaScriptSemanticGraphUnknown } from "../../domain/javascript/javascriptSemanticGraph.js";
-import { addSemanticGraphNode, addSemanticGraphRelation, addSemanticGraphUnknown, constructSemanticGraphNode, } from "./JavaScriptSemanticGraphConstruction.js";
+import { retainSemanticGraphNode, addSemanticGraphRelation, addSemanticGraphUnknown, } from "./JavaScriptSemanticGraphConstruction.js";
 import { unknownSemanticEvidence } from "./JavaScriptSemanticGraphEvidence.js";
 import { semanticCallSiteAt, } from "./JavaScriptSemanticGraphFlowProjection.js";
 /** Project literal EventEmitter registrations, removals, and dispatches. */
@@ -34,7 +34,7 @@ export const projectSemanticEvents = (context) => {
             addEventUnknown(context, operation, event, relation);
     }
 };
-const addEventNode = (context, operation, eventKey) => addSemanticGraphNode(context.state, constructSemanticGraphNode(context.file, {
+const addEventNode = (context, operation, eventKey) => retainSemanticGraphNode(context.state, context.file, {
     kind: "event",
     roleKey: `event:${eventKey}`,
     location: operation.eventName === null ? operation.location : null,
@@ -44,8 +44,8 @@ const addEventNode = (context, operation, eventKey) => addSemanticGraphNode(cont
         emitter_key: operation.emitterKey,
         event_name: operation.eventName,
     },
-}, context.state));
-const addListenerNode = (context, operation) => addSemanticGraphNode(context.state, constructSemanticGraphNode(context.file, {
+});
+const addListenerNode = (context, operation) => retainSemanticGraphNode(context.state, context.file, {
     kind: "listener",
     roleKey: `listener:${operation.eventId}`,
     location: operation.listenerLocation ?? operation.location,
@@ -61,7 +61,7 @@ const addListenerNode = (context, operation) => addSemanticGraphNode(context.sta
         event_name: operation.eventName,
         method: operation.method,
     },
-}, context.state));
+});
 const eventEmitterNode = (context, operation) => (operation.emitterBindingId === null
     ? undefined
     : context.bindingNodes.get(operation.emitterBindingId)) ??
@@ -95,7 +95,7 @@ export const projectSemanticTimers = (context) => {
         const owner = operation.ownerCallableId === null
             ? undefined
             : context.callableNodes.get(operation.ownerCallableId);
-        const timer = addSemanticGraphNode(context.state, constructSemanticGraphNode(context.file, {
+        const timer = retainSemanticGraphNode(context.state, context.file, {
             kind: "timer",
             roleKey: operation.timerId,
             location: operation.location,
@@ -105,7 +105,7 @@ export const projectSemanticTimers = (context) => {
                 delay_milliseconds: operation.delayMilliseconds,
                 method: operation.method,
             },
-        }, context.state));
+        });
         return timer === null ? [] : [[operation.timerId, timer]];
     }));
     for (const operation of context.ir.timerOperations)