rea-agents 6.0.0 → 6.2.0

package/dist/application/javascript/JavaScriptApplicationEvidence.js

@@ -1,11 +1,28 @@
-import { createEvidence, } from "../../domain/evidence.js";
+import { createImmutableEvidenceSteps, } from "../../domain/evidence.js";
 import { JAVASCRIPT_APPLICATION_PROVIDER } from "../InvestigationProviders.js";
-/** Create Evidence for one deterministic local JavaScript application graph. */
-export const createJavaScriptApplicationEvidence = (input, result) => createEvidence({
+import { freezeOwnedJsonSnapshotSteps } from "../../domain/immutableJson.js";
+import { rememberOwnedApplicationGraphEvidence } from "./JavaScriptApplicationEvidenceGraph.js";
+import { completeJavaScriptAnalysisSteps } from "./JavaScriptAnalysisControl.js";
+import { jsonValueValidationSteps } from "../../domain/jsonValue.js";
+/** Create owned analysis Evidence while allowing request cancellation during sealing and hashing. */
+export const createOwnedJavaScriptApplicationEvidenceCooperatively = async (input, result, signal, progress) => {
+    await reportEvidencePhase(progress, "seal_javascript_application_result", "Sealing the complete application analysis result");
+    const snapshot = await completeJavaScriptAnalysisSteps(freezeOwnedJsonSnapshotSteps(result), signal);
+    await reportEvidencePhase(progress, "validate_javascript_application_evidence", "Validating the immutable application Evidence JSON");
+    // The Evidence envelope consumes the completed immutable validation cache.
+    await completeJavaScriptAnalysisSteps(jsonValueValidationSteps(snapshot), signal);
+    await reportEvidencePhase(progress, "hash_javascript_application_evidence", "Hashing the complete application analysis Evidence");
+    const evidence = await completeJavaScriptAnalysisSteps(createImmutableEvidenceSteps(applicationSubject(snapshot), JAVASCRIPT_APPLICATION_PROVIDER, applicationObservation(input, snapshot)), signal);
+    return rememberOwnedApplicationGraphEvidence(evidence, snapshot);
+};
+const reportEvidencePhase = (progress, phase, message) => progress?.report({ phase, completed: 0, total: 1, message }) ??
+    Promise.resolve();
+const applicationSubject = (result) => ({
     path: result.input_path,
     sha256: result.root_artifact_sha256,
     format: result.format,
-}, JAVASCRIPT_APPLICATION_PROVIDER, {
+});
+const applicationObservation = (input, result) => ({
     predicateType: "rea.javascript-application-analysis",
     operation: "analyze_javascript_application",
     parameters: parameters(input),

package/dist/application/javascript/JavaScriptApplicationEvidenceGraph.js

@@ -1,11 +1,25 @@
 import { JAVASCRIPT_APPLICATION_PROVIDER, JAVASCRIPT_RUNTIME_RECONCILIATION_PROVIDER, MANAGED_WORKFLOW_PROVIDER, } from "../InvestigationProviders.js";
-import { parseEvidence } from "../../domain/evidence.js";
+import { isImmutableEvidence, parseEvidence, } from "../../domain/evidence.js";
 import { analyzeJavaScriptApplicationInputSchema, javascriptApplicationAnalysisResultSchema, } from "../../domain/javascript/javascriptApplicationAnalysis.js";
 import { javascriptRuntimeReconciliationResultSchema } from "../../domain/javascript/javascriptRuntimeReconciliationSchemas.js";
 import { managedApplicationGraphResultSchema } from "../../domain/managed/managedApplicationGraph.js";
+const ownedApplicationSources = new WeakMap();
+/** Retain the producer-validated meaning of its exact immutable result snapshot. */
+export const rememberOwnedApplicationGraphEvidence = (evidence, result) => {
+    if (!isImmutableEvidence(evidence) ||
+        evidence.normalized_result !== result ||
+        evidence.operation !== "analyze_javascript_application" ||
+        !providerMatches(evidence, JAVASCRIPT_APPLICATION_PROVIDER))
+        throw new TypeError("Owned application Evidence must bind its exact validated immutable result");
+    ownedApplicationSources.set(evidence, Object.freeze(staticApplicationSourceForResult(evidence, result)));
+    return evidence;
+};
 /** Parse and authenticate one REA-produced JavaScript Application Graph Evidence. */
 export const parseApplicationGraphEvidence = (input) => {
     const evidence = parseEvidence(input);
+    const owned = ownedApplicationSources.get(evidence);
+    if (owned !== undefined)
+        return owned;
     if (evidence.operation === "analyze_javascript_application" &&
         evidence.predicate_type === "rea.javascript-application-analysis" &&
         providerMatches(evidence, JAVASCRIPT_APPLICATION_PROVIDER))
@@ -21,10 +35,13 @@ export const parseApplicationGraphEvidence = (input) => {
     throw new TypeError("Application workflow requires authenticated analyze_javascript_application, reconcile_javascript_runtime, or project_managed_application_graph Evidence");
 };
 const staticApplicationSource = (evidence) => {
+    const result = javascriptApplicationAnalysisResultSchema.parse(evidence.normalized_result);
+    return staticApplicationSourceForResult(evidence, result);
+};
+const staticApplicationSourceForResult = (evidence, result) => {
     if (evidence.authority !== "shipped-artifact" ||
         evidence.confidence !== "derived")
         throw new TypeError("JavaScript application Evidence authority or confidence is invalid");
-    const result = javascriptApplicationAnalysisResultSchema.parse(evidence.normalized_result);
     if (evidence.predicate_type !== "rea.javascript-application-analysis")
         throw new TypeError("JavaScript application Evidence predicate does not match its result shape");
     analyzeJavaScriptApplicationInputSchema.parse({

package/dist/application/javascript/JavaScriptApplicationService.js

@@ -1,13 +1,14 @@
 import { z } from "zod";
 import { ArtifactReaderFailure } from "../../artifacts/ArtifactReader.js";
-import { analyzeJavaScriptApplicationInputSchema, javascriptApplicationAnalysisResultSchema, } from "../../domain/javascript/javascriptApplicationAnalysis.js";
-import { AnalysisInputError, AnalysisOutputError, } from "../../domain/analysisErrorCore.js";
+import { analyzeJavaScriptApplicationInputSchema, parseOwnedJavaScriptApplicationAnalysisSteps, } from "../../domain/javascript/javascriptApplicationAnalysis.js";
+import { AnalysisAccessDeniedError, AnalysisInputError, AnalysisOutputError, AnalysisUnsupportedTargetError, } from "../../domain/analysisErrorCore.js";
 import { ArtifactOperationError } from "../../domain/artifactOperationError.js";
 import {} from "../../domain/analysisErrorBase.js";
-import { projectInputIssues } from "../../domain/inputIssueProjection.js";
+import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
 import { err, ok } from "../../domain/result.js";
 import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
-import { createJavaScriptApplicationEvidence } from "./JavaScriptApplicationEvidence.js";
+import { createOwnedJavaScriptApplicationEvidenceCooperatively } from "./JavaScriptApplicationEvidence.js";
+import { assertJavaScriptAnalysisActive, checkpointJavaScriptAnalysis, completeJavaScriptAnalysisSteps, } from "./JavaScriptAnalysisControl.js";
 import { reconstructJavaScriptArtifact } from "./JavaScriptArtifactReconstruction.js";
 import { JAVASCRIPT_APPLICATION_PROVIDER } from "../InvestigationProviders.js";
 const OPERATION = "analyze_javascript_application";
@@ -15,18 +16,20 @@ const OPERATION = "analyze_javascript_application";
 export const analyzeJavaScriptApplication = async (rawInput, options = {}) => {
     const parsed = analyzeJavaScriptApplicationInputSchema.safeParse(rawInput);
     if (!parsed.success)
-        return err(new AnalysisInputError(OPERATION, undefined, projectInputIssues(parsed.error.issues, rawInput)));
+        return err(analysisInputErrorFromIssues(OPERATION, parsed.error.issues, rawInput));
     return analyzeJavaScriptApplicationValidated(parsed.data, options);
 };
 /** Analyze input already parsed by a trusted adapter boundary. */
 export const analyzeJavaScriptApplicationValidated = async (input, options = {}) => {
-    await options.progress?.report({
-        phase: "analyze_javascript_application",
-        completed: 0,
-        total: 1,
-        message: "Inventorying and parsing application artifacts",
-    });
     try {
+        assertJavaScriptAnalysisActive(options.signal);
+        await options.progress?.report({
+            phase: "analyze_javascript_application",
+            completed: 0,
+            total: 1,
+            message: "Inventorying and parsing application artifacts",
+        });
+        await checkpointJavaScriptAnalysis(options.signal);
         const reconstructed = await reconstructJavaScriptArtifact({
             input_path: input.input_path,
             format: input.format,
@@ -36,20 +39,23 @@ export const analyzeJavaScriptApplicationValidated = async (input, options = {})
             phase: "validate_javascript_application_result",
             completed: 0,
             total: 1,
-            message: "Validating the application analysis result",
+            message: "Validating result metadata and cross-graph bindings",
         });
-        const result = javascriptApplicationAnalysisResultSchema.parse({
+        await checkpointJavaScriptAnalysis(options.signal);
+        const result = await completeJavaScriptAnalysisSteps(parseOwnedJavaScriptApplicationAnalysisSteps({
             ...application,
             summary,
             limitations: reconstructed.graph.limitations,
-        });
+        }), options.signal);
         await options.progress?.report({
             phase: "create_javascript_application_evidence",
             completed: 0,
             total: 1,
             message: "Creating and hashing application analysis Evidence",
         });
-        const evidence = createJavaScriptApplicationEvidence(input, result);
+        await checkpointJavaScriptAnalysis(options.signal);
+        const evidence = await createOwnedJavaScriptApplicationEvidenceCooperatively(input, result, options.signal, options.progress);
+        await checkpointJavaScriptAnalysis(options.signal);
         await options.progress?.report({
             phase: "analyze_javascript_application",
             completed: 1,
@@ -57,9 +63,15 @@ export const analyzeJavaScriptApplicationValidated = async (input, options = {})
             message: "Application graph and Electron boundaries reconstructed",
             terminal: true,
         });
+        assertJavaScriptAnalysisActive(options.signal);
         return ok(evidence);
     }
     catch (cause) {
+        // Input selection failures are already typed by their cause.
+        if (cause instanceof AnalysisInputError ||
+            cause instanceof AnalysisUnsupportedTargetError ||
+            cause instanceof AnalysisAccessDeniedError)
+            return err(cause);
         if (cause instanceof ArtifactReaderFailure)
             return err(new ArtifactOperationError(OPERATION, cause.reason, cause.details, cause.message));
         if (cause instanceof z.ZodError)

package/dist/application/javascript/JavaScriptApplicationWorkflowService.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { AnalysisInputError, AnalysisProtocolError, } from "../../domain/analysisErrorCore.js";
 import {} from "../../domain/analysisErrorBase.js";
-import { projectInputIssues } from "../../domain/inputIssueProjection.js";
+import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
 import { compareJavaScriptApplicationVersions } from "../../domain/javascript/javascriptApplicationVersionComparison.js";
 import { compareApplicationVersionsInputSchema } from "../../domain/javascript/javascriptApplicationVersionComparisonSchemas.js";
 import { compareJavaScriptExportShapes } from "../../domain/javascript/javascriptExportShapeComparison.js";
@@ -18,7 +18,7 @@ export const traceApplicationFeatureEvidence = (rawInput) => {
     const operation = "trace_application_feature";
     const parsed = traceApplicationFeatureInputSchema.safeParse(rawInput);
     if (!parsed.success)
-        return err(new AnalysisInputError(operation, undefined, projectInputIssues(parsed.error.issues, rawInput)));
+        return err(analysisInputErrorFromIssues(operation, parsed.error.issues, rawInput));
     return traceApplicationFeatureEvidenceValidated(parsed.data);
 };
 /** Derive one feature trace from input parsed by a trusted adapter. */
@@ -50,7 +50,7 @@ export const compareApplicationVersionsEvidence = (rawInput) => {
     const operation = "compare_application_versions";
     const parsed = compareApplicationVersionsInputSchema.safeParse(rawInput);
     if (!parsed.success)
-        return err(new AnalysisInputError(operation, undefined, projectInputIssues(parsed.error.issues, rawInput)));
+        return err(analysisInputErrorFromIssues(operation, parsed.error.issues, rawInput));
     return compareApplicationVersionsEvidenceValidated(parsed.data);
 };
 /** Compare versions from input parsed by a trusted adapter. */
@@ -116,7 +116,7 @@ export const compareJavaScriptExportShapesEvidence = (rawInput) => {
     const operation = "compare_javascript_export_shapes";
     const parsed = compareJavaScriptExportShapesInputSchema.safeParse(rawInput);
     if (!parsed.success)
-        return err(new AnalysisInputError(operation, undefined, projectInputIssues(parsed.error.issues, rawInput)));
+        return err(analysisInputErrorFromIssues(operation, parsed.error.issues, rawInput));
     return compareJavaScriptExportShapesEvidenceValidated(parsed.data);
 };
 /** Compare exact export shapes from input parsed by a trusted adapter. */
@@ -153,7 +153,7 @@ export const compareJavaScriptExportShapesEvidenceValidated = (input) => {
     }
 };
 const workflowFailure = (operation, cause, input) => cause instanceof z.ZodError
-    ? err(new AnalysisInputError(operation, undefined, projectInputIssues(cause.issues, input)))
+    ? err(analysisInputErrorFromIssues(operation, cause.issues, input))
     : cause instanceof TypeError &&
         SAFE_APPLICATION_INPUT_CONSTRAINTS.has(cause.message)
         ? err(new AnalysisInputError(operation, undefined, [

package/dist/application/javascript/JavaScriptArtifactAnalysis.js

@@ -1,7 +1,8 @@
 import { createHash } from "node:crypto";
 import { setImmediate } from "node:timers/promises";
+import { resolveJavaScriptSourceMapReference } from "../../domain/javascript/javascriptSourceMapPaths.js";
 import { analyzeParsedJavaScriptStaticSource } from "../../domain/javascript/javascriptStaticAnalysis.js";
-import { analyzeParsedJavaScriptSemantics } from "../../domain/javascript/javascriptSemanticAnalysis.js";
+import { analyzeParsedJavaScriptSemantics, classifyParsedJavaScriptOpenReceivers, } from "../../domain/javascript/javascriptSemanticAnalysis.js";
 import { parseJavaScriptSource } from "../../domain/javascript/javascriptSourceParser.js";
 import { hasValidSourceMapContents } from "../../domain/sourceMapContents.js";
 import { flattenSourceMapLeaves } from "../../domain/sourceMapEnvelope.js";
@@ -77,14 +78,15 @@ const analyzeArtifactFile = (file, context) => {
         state.files.push({ file, javascript: null, semantic: null });
         return;
     }
-    const parsed = parseJavaScriptSource(file.text.value);
+    const parsed = parseJavaScriptSource(file.text.value, file.path);
     if (parsed === null) {
         const analysis = failedJavaScriptStaticAnalysis();
         state.files.push({ file, javascript: analysis, semantic: null });
         state.parseFailures += 1;
         return;
     }
-    const analysis = analyzeParsedJavaScriptStaticSource(file.text.value, parsed);
+    const openReceiverFacts = classifyParsedJavaScriptOpenReceivers(parsed);
+    const analysis = analyzeParsedJavaScriptStaticSource(file.text.value, parsed, openReceiverFacts);
     const staticFindings = findingCount(analysis);
     const semantics = analysis.parse_status === "complete" || analysis.parse_status === "partial"
         ? analyzeParsedJavaScriptSemantics(parsed)
@@ -202,14 +204,16 @@ const collectSourceMapOriginals = (file, maps) => {
         const contents = map.sourcesContent;
         if (!hasValidSourceMapContents(names.length, contents))
             return invalidSourceMap(file, "Source map sourcesContent must contain one string or null entry per source.");
-        const root = typeof map.sourceRoot === "string" ? map.sourceRoot : "";
+        if (map.sourceRoot != null && typeof map.sourceRoot !== "string")
+            return invalidSourceMap(file, "Source map sourceRoot must be a string or null.");
+        const root = typeof map.sourceRoot === "string" ? map.sourceRoot : null;
         for (const [index, raw] of names.entries()) {
             if (typeof raw !== "string")
                 return invalidSourceMap(file, "Source map contains a non-string source name.");
             const rawContent = Array.isArray(contents) ? contents[index] : undefined;
             const content = typeof rawContent === "string" ? rawContent : null;
             sources.push({
-                source: resolveSourceName(root, raw),
+                reference: resolveJavaScriptSourceMapReference(raw, root, file.path),
                 content,
                 content_sha256: content === null ? null : sha256(content),
             });
@@ -262,10 +266,9 @@ const rangeForOffsets = (text, start, end) => ({
     end: pointForOffset(text, end),
 });
 const pointForOffset = (text, offset) => {
-    const lines = text.slice(0, offset).split("\n");
+    const lines = text.slice(0, offset).split(/\r\n|\r|\n/u);
     return { line: lines.length, column: lines.at(-1)?.length ?? 0 };
 };
-const resolveSourceName = (root, source) => `${root}${root !== "" && !root.endsWith("/") ? "/" : ""}${source}`;
 const optionalString = (value) => typeof value === "string" && value.length > 0 ? value : null;
 const sha256 = (value) => createHash("sha256").update(value).digest("hex");
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);

package/dist/application/javascript/JavaScriptArtifactGraphBuilder.js

@@ -1,14 +1,21 @@
-import { createJavaScriptApplicationGraph, } from "../../domain/javascript/javascriptApplicationGraph.js";
+import { createJavaScriptApplicationGraph, createImmutableJavaScriptApplicationGraphSteps, } from "../../domain/javascript/javascriptApplicationGraph.js";
 import { JavaScriptArtifactGraphAccumulator } from "./JavaScriptArtifactGraphAccumulator.js";
+import { selfReferenceOmissions, } from "./JavaScriptArtifactGraphContext.js";
 import { addJavaScriptHtmlRoles, addJavaScriptSourceMapOriginals, } from "./JavaScriptArtifactGraphDocuments.js";
 import { addJavaScriptStaticFindings } from "./JavaScriptArtifactGraphFindings.js";
 import { addJavaScriptModuleRelationships, addJavaScriptSourceModules, } from "./JavaScriptModuleRelationships.js";
 import { completeApplicationCoverage, partialApplicationCoverage, } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
-import { addJavaScriptArtifactContainers, addJavaScriptArtifactFiles, addJavaScriptBundlerNodes, addJavaScriptPackageNodes, createJavaScriptArtifactRootNode, } from "./JavaScriptArtifactGraphStructure.js";
+import { semanticCoverageResourceLimits } from "../../domain/javascript/javascriptSemanticCoverage.js";
+import { SEMANTIC_EXPRESSION_DEPTH_LIMIT, SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT, SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT, semanticResourceLimitReason, } from "../../domain/javascript/javascriptSemanticResourceLimits.js";
+import { addJavaScriptArtifactContainers, addJavaScriptArtifactFiles, addJavaScriptPackageNodes, createJavaScriptArtifactRootNode, } from "./JavaScriptArtifactGraphStructure.js";
+import { addJavaScriptBundlerNodes } from "./JavaScriptArtifactGraphBundlers.js";
 import { addElectronBoundaries } from "./ElectronBoundaryGraph.js";
 import { classifyElectronIpcPairings, collectElectronIpcRecords, } from "./ElectronBoundaryAnalysis.js";
 /** Project artifact and AST facts into JavaScript Application Graph. */
-export const buildJavaScriptArtifactGraph = (snapshot, fileSet, analysis) => {
+export const buildJavaScriptArtifactGraph = (snapshot, fileSet, analysis) => createJavaScriptApplicationGraph(buildJavaScriptArtifactGraphInput(snapshot, fileSet, analysis));
+/** Build a validated application graph with cooperative immutable ownership. */
+export const buildImmutableJavaScriptArtifactGraphSteps = (snapshot, fileSet, analysis) => createImmutableJavaScriptApplicationGraphSteps(buildJavaScriptArtifactGraphInput(snapshot, fileSet, analysis));
+const buildJavaScriptArtifactGraphInput = (snapshot, fileSet, analysis) => {
     const accumulator = new JavaScriptArtifactGraphAccumulator();
     const root = createJavaScriptArtifactRootNode(accumulator, snapshot);
     const context = {
@@ -29,14 +36,14 @@ export const buildJavaScriptArtifactGraph = (snapshot, fileSet, analysis) => {
     addJavaScriptArtifactFiles(context);
     const packageRoots = addJavaScriptPackageNodes(context);
     addJavaScriptSourceModules(context);
-    addJavaScriptBundlerNodes(context);
-    addJavaScriptModuleRelationships(context);
-    addJavaScriptStaticFindings(context);
+    const bundlerLimitations = addJavaScriptBundlerNodes(context);
+    const relationshipOmissions = addJavaScriptModuleRelationships(context);
+    const findingLimitations = addJavaScriptStaticFindings(context);
     addElectronBoundaries(context);
     addJavaScriptHtmlRoles(context);
     addJavaScriptSourceMapOriginals(context);
     const coverage = graphCoverage(context);
-    return createJavaScriptApplicationGraph({
+    return {
         schema: "JavaScriptApplicationGraph",
         root_node_ids: packageRoots.length === 0
             ? [root.node_id]
@@ -44,10 +51,15 @@ export const buildJavaScriptArtifactGraph = (snapshot, fileSet, analysis) => {
         nodes: accumulator.nodes(),
         edges: accumulator.edges(),
         coverage,
-        limitations: graphLimitations(context, coverage.status),
-    });
+        limitations: [
+            ...bundlerLimitations,
+            ...findingLimitations,
+            ...graphLimitations(context, coverage.status, relationshipOmissions),
+        ],
+    };
 };
 const graphCoverage = (context) => {
+    const resourceLimits = semanticResourceLimits(context);
     const sourceMapPolicyGap = context.analysis.source_maps.some(({ status }) => status === "invalid");
     const malformedStructuredData = context.analysis.packages.some(({ status }) => status !== "included") ||
         context.analysis.json_modules.some(({ status }) => status !== "included") ||
@@ -60,11 +72,31 @@ const graphCoverage = (context) => {
         partialJavaScript;
     if (context.analysis.truncated_scopes > 0)
         return partialApplicationCoverage([], null);
+    if (resourceLimits.length > 0)
+        return partialApplicationCoverage(resourceLimits.map(applicationGraphResourceLimit), null);
     if (unknownGap)
         return partialApplicationCoverage([], null);
     return completeApplicationCoverage();
 };
-const graphLimitations = (context, coverage) => {
+const semanticResourceLimits = (context) => [
+    ...new Set(context.analysis.files.flatMap(({ semantic }) => semantic === null
+        ? []
+        : semanticCoverageResourceLimits(semantic.ir.coverage))),
+].sort();
+const applicationGraphResourceLimit = (resourceLimit) => ({
+    name: `javascript_semantic_${resourceLimit.replaceAll("-", "_")}`,
+    value: resourceLimit === "primitive-candidates"
+        ? SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT
+        : resourceLimit === "primitive-bytes"
+            ? SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT
+            : SEMANTIC_EXPRESSION_DEPTH_LIMIT,
+    unit: resourceLimit === "expression-depth"
+        ? "depth"
+        : resourceLimit === "primitive-bytes"
+            ? "bytes"
+            : "items",
+});
+const graphLimitations = (context, coverage, relationshipOmissions) => {
     const ipc = collectElectronIpcRecords(context.analysis);
     const pairings = classifyElectronIpcPairings(ipc);
     const electronFindings = context.analysis.files.reduce((count, { javascript }) => count +
@@ -78,6 +110,7 @@ const graphLimitations = (context, coverage) => {
                 javascript.electron.native_addon_bindings.length), 0);
     return [
         ...context.analysis.limitations,
+        ...selfReferenceOmissions(relationshipOmissions.selfImports, ["import specifier", "import specifiers"], "the importing module"),
         "CommonJS and ESM binding relationships were recovered from inert syntax and resolved only within the inventoried artifact container.",
         "Webpack/Rspack factories were recovered from AST literals; REA did not invoke push handlers or bundle bootstrap code.",
         "Static imports, entrypoints, workers, endpoints, and storage relationships do not prove runtime execution.",
@@ -101,6 +134,7 @@ const graphLimitations = (context, coverage) => {
                 "Sender, frame, URL, and origin checks are observations only; REA does not claim that they enforce a complete authorization policy.",
             ]
             : []),
+        ...semanticResourceLimits(context).map(semanticResourceLimitReason),
         ...(context.analysis.files.some(({ javascript }) => (javascript?.electron.native_addon_bindings.length ?? 0) > 0)
             ? [
                 "Native member names are requested by JavaScript syntax and are not verified binary exports in this workflow.",

package/dist/application/javascript/JavaScriptArtifactGraphBundlers.js

@@ -1,7 +1,8 @@
-import { addAstContainsEdge, artifactLocalIdentity, chunkLookupKey, javascriptAnalysisCoverage, moduleLookupKey, } from "./JavaScriptArtifactGraphContext.js";
+import { addAstContainsEdge, artifactLocalIdentity, chunkLookupKey, javascriptAnalysisCoverage, moduleLookupKey, selfReferenceOmissions, } from "./JavaScriptArtifactGraphContext.js";
 import { astObservationEvidence, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
-/** Project Webpack/Rspack chunk and factory literals recovered from AST. */
+/** Project Webpack/Rspack AST literals and disclose unrepresentable relationships. */
 export const addJavaScriptBundlerNodes = (context) => {
+    let selfAsyncChunks = 0;
     for (const analyzed of context.analysis.files) {
         const { file, javascript } = analyzed;
         const asset = context.assetNodes.get(file.path);
@@ -31,8 +32,9 @@ export const addJavaScriptBundlerNodes = (context) => {
             addBundlerModuleNodes(context, { ...input, chunk });
         }
         for (const record of records)
-            addBundlerRuntimeEdges(context, record);
+            selfAsyncChunks += addBundlerRuntimeEdges(context, record);
     }
+    return selfReferenceOmissions(selfAsyncChunks, ["bundler async-chunk reference", "bundler async-chunk references"], "the requesting chunk");
 };
 const createBundlerChunkNode = (context, input) => {
     const { file, registration, coverage, limitations } = input;
@@ -119,6 +121,7 @@ const addBundlerModuleNodes = (context, input) => {
     }
 };
 const addBundlerRuntimeEdges = (context, record) => {
+    let selfAsyncChunks = 0;
     const { file, registration, chunk, coverage } = record;
     for (const moduleKey of registration.entry_module_keys) {
         const resolved = context.moduleNodes.get(moduleLookupKey(file.path, moduleKey));
@@ -147,6 +150,10 @@ const addBundlerRuntimeEdges = (context, record) => {
     for (const chunkKey of registration.async_chunk_keys) {
         const lookup = chunkLookupKey(file.path, registration.runtime, chunkKey);
         const resolved = context.chunkNodes.get(lookup);
+        if (resolved?.node_id === chunk.node_id) {
+            selfAsyncChunks++;
+            continue;
+        }
         const target = resolved ?? unresolvedBundlerChunkNode(context, record, chunkKey);
         context.accumulator.addEdge({
             source_node_id: chunk.node_id,
@@ -169,6 +176,7 @@ const addBundlerRuntimeEdges = (context, record) => {
             }),
         });
     }
+    return selfAsyncChunks;
 };
 const unresolvedBundlerModuleNode = (context, record, moduleKey) => context.accumulator.addNode({
     kind: "javascript-module",

package/dist/application/javascript/JavaScriptArtifactGraphContext.js

@@ -161,6 +161,15 @@ export const linkElectronRoleToAsset = (context, input) => {
         }),
     });
 };
+/**
+ * Disclose relationships omitted because they resolved to their own source;
+ * the application graph forbids self-referential edges.
+ */
+export const selfReferenceOmissions = (count, noun, owner) => count === 0
+    ? []
+    : [
+        `${String(count)} ${count === 1 ? noun[0] : noun[1]} resolved back to ${owner} itself and ${count === 1 ? "was" : "were"} omitted; application graph edges cannot be self-referential.`,
+    ];
 /** Deterministic key for one recovered module inside a bundle asset. */
 export const moduleLookupKey = (path, moduleKey) => `${path}\0${moduleKey}`;
 /** Deterministic key for one recovered bundler chunk inside a bundle asset. */

package/dist/application/javascript/JavaScriptArtifactGraphDocuments.js

@@ -109,16 +109,16 @@ export const addJavaScriptSourceMapOriginals = (context) => {
                     strategy: "source-map-original",
                     stability: "source-map-exact",
                     source_map_sha256: mapFile.sha256,
-                    original_source: original.source,
+                    original_source: original.reference.source_name,
+                    source_root: original.reference.source_root,
                     source_sha256: original.content_sha256,
                 },
                 observations: [
                     {
-                        label: original.source,
+                        label: original.reference.source_name || null,
+                        source_map_reference: original.reference,
                         properties: {
-                            source: original.source,
                             content_available: original.content !== null,
-                            source_sha256: original.content_sha256,
                         },
                         evidence: artifactObservationEvidence({
                             sha256: mapFile.sha256,
@@ -134,7 +134,10 @@ export const addJavaScriptSourceMapOriginals = (context) => {
                 source_node_id: mapNode.node_id,
                 target_node_id: node.node_id,
                 relation: "contains",
-                properties: { original_source: original.source },
+                properties: {
+                    original_source: original.reference.source_name,
+                    source_root: original.reference.source_root,
+                },
                 evidence: artifactObservationEvidence({
                     sha256: mapFile.sha256,
                     path: mapFile.path,

package/dist/application/javascript/JavaScriptArtifactGraphFindings.js

@@ -1,8 +1,9 @@
-import { addStaticInferenceEdge, artifactLocalIdentity, chunkLookupKey, createElectronRoleNode, javascriptAnalysisCoverage, linkElectronRoleToAsset, moduleLookupKey, resolveArtifactPath, sourceNodeFor, } from "./JavaScriptArtifactGraphContext.js";
+import { addStaticInferenceEdge, artifactLocalIdentity, chunkLookupKey, createElectronRoleNode, javascriptAnalysisCoverage, linkElectronRoleToAsset, moduleLookupKey, resolveArtifactPath, selfReferenceOmissions, sourceNodeFor, } from "./JavaScriptArtifactGraphContext.js";
 import { astObservationEvidence, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
 import { resolveArtifactPathByContext } from "./JavaScriptArtifactPathResolution.js";
 /** Project imports, workers, roles, endpoints, storage, and source-map links. */
 export const addJavaScriptStaticFindings = (context) => {
+    const omissions = { selfReferences: 0 };
     for (const analyzed of context.analysis.files) {
         const { file, javascript } = analyzed;
         const asset = context.assetNodes.get(file.path);
@@ -10,7 +11,7 @@ export const addJavaScriptStaticFindings = (context) => {
             continue;
         const coverage = javascriptAnalysisCoverage(javascript);
         for (const value of javascript.references)
-            addReference(context, { file, asset, value, coverage });
+            addReference(context, { file, asset, value, coverage }, omissions);
         for (const value of javascript.endpoints)
             addEndpoint(context, { file, asset, value, coverage });
         for (const value of javascript.storage)
@@ -20,8 +21,9 @@ export const addJavaScriptStaticFindings = (context) => {
         for (const value of javascript.source_map_urls)
             addSourceMapEdge(context, { file, asset, value, coverage });
     }
+    return selfReferenceOmissions(omissions.selfReferences, ["static reference", "static references"], "the referencing module");
 };
-const addReference = (context, input) => {
+const addReference = (context, input, omissions) => {
     const source = sourceNodeFor(context, input.file.path, input.value.module_key) ??
         input.asset;
     const resolved = input.value.specifier === null
@@ -70,6 +72,13 @@ const addReference = (context, input) => {
             });
         return;
     }
+    // A reference that resolves to its own source, such as a bundled module
+    // requiring its own key, cannot become an edge: the application graph
+    // forbids self-referential edges and one would fail the whole analysis.
+    if (resolved?.node.node_id === source.node_id) {
+        omissions.selfReferences += 1;
+        return;
+    }
     const target = resolved?.node ??
         unresolvedReferenceNode(context, input.file, input.value, input.coverage);
     addStaticInferenceEdge(context, {

package/dist/application/javascript/JavaScriptArtifactGraphStructure.js

@@ -2,7 +2,6 @@ import { completeApplicationCoverage } from "../../domain/javascript/javascriptA
 import { addArtifactContainsEdge, addUnavailableStaticParseScope, artifactFileNodeKind, artifactLocalIdentity, createElectronRoleNode, linkElectronRoleToAsset, } from "./JavaScriptArtifactGraphContext.js";
 import { artifactObservationEvidence, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
 import { resolveArtifactPathByContext } from "./JavaScriptArtifactPathResolution.js";
-export { addJavaScriptBundlerNodes } from "./JavaScriptArtifactGraphBundlers.js";
 /** Create the exact root artifact node from the inventory manifest. */
 export const createJavaScriptArtifactRootNode = (accumulator, snapshot) => {
     const root = snapshot.nodes.find(({ artifact_id: id }) => id === snapshot.manifest.root_artifact_id);