rea-agents 6.2.0 → 6.4.0

package/dist/application/javascript/JavaScriptArtifactGraphBuilder.js

@@ -1,21 +1,37 @@
-import { createJavaScriptApplicationGraph, createImmutableJavaScriptApplicationGraphSteps, } from "../../domain/javascript/javascriptApplicationGraph.js";
+import { ELECTRON_IDENTITY_LIMITATION } from "../../domain/javascript/javascriptElectronMemberWrites.js";
+import { createJavaScriptApplicationGraph, sealTransferredJavaScriptApplicationGraphSteps, } from "../../domain/javascript/javascriptApplicationGraph.js";
 import { JavaScriptArtifactGraphAccumulator } from "./JavaScriptArtifactGraphAccumulator.js";
 import { selfReferenceOmissions, } from "./JavaScriptArtifactGraphContext.js";
 import { addJavaScriptHtmlRoles, addJavaScriptSourceMapOriginals, } from "./JavaScriptArtifactGraphDocuments.js";
-import { addJavaScriptStaticFindings } from "./JavaScriptArtifactGraphFindings.js";
-import { addJavaScriptModuleRelationships, addJavaScriptSourceModules, } from "./JavaScriptModuleRelationships.js";
+import { addJavaScriptStaticFindingsSteps } from "./JavaScriptArtifactGraphFindings.js";
+import { addJavaScriptModuleRelationshipsSteps, addJavaScriptSourceModules, } from "./JavaScriptModuleRelationships.js";
 import { completeApplicationCoverage, partialApplicationCoverage, } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
-import { semanticCoverageResourceLimits } from "../../domain/javascript/javascriptSemanticCoverage.js";
-import { SEMANTIC_EXPRESSION_DEPTH_LIMIT, SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT, SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT, semanticResourceLimitReason, } from "../../domain/javascript/javascriptSemanticResourceLimits.js";
+import { semanticCoverageResourceLimits, semanticResourceLimitCoverage, } from "../../domain/javascript/javascriptSemanticCoverage.js";
+import { semanticResourceLimitReason } from "../../domain/javascript/javascriptSemanticResourceLimits.js";
 import { addJavaScriptArtifactContainers, addJavaScriptArtifactFiles, addJavaScriptPackageNodes, createJavaScriptArtifactRootNode, } from "./JavaScriptArtifactGraphStructure.js";
 import { addJavaScriptBundlerNodes } from "./JavaScriptArtifactGraphBundlers.js";
 import { addElectronBoundaries } from "./ElectronBoundaryGraph.js";
 import { classifyElectronIpcPairings, collectElectronIpcRecords, } from "./ElectronBoundaryAnalysis.js";
 /** Project artifact and AST facts into JavaScript Application Graph. */
-export const buildJavaScriptArtifactGraph = (snapshot, fileSet, analysis) => createJavaScriptApplicationGraph(buildJavaScriptArtifactGraphInput(snapshot, fileSet, analysis));
-/** Build a validated application graph with cooperative immutable ownership. */
-export const buildImmutableJavaScriptArtifactGraphSteps = (snapshot, fileSet, analysis) => createImmutableJavaScriptApplicationGraphSteps(buildJavaScriptArtifactGraphInput(snapshot, fileSet, analysis));
-const buildJavaScriptArtifactGraphInput = (snapshot, fileSet, analysis) => {
+export const buildJavaScriptArtifactGraph = (snapshot, fileSet, analysis) => createJavaScriptApplicationGraph(completeSynchronously(buildJavaScriptArtifactGraphInputSteps(snapshot, fileSet, analysis)));
+/**
+ * Build a validated application graph with cooperative immutable ownership.
+ * Constructing the graph input also runs in steps: projecting every module
+ * relationship and finding at once held the event loop for seconds.
+ */
+export function* buildImmutableJavaScriptArtifactGraphSteps(snapshot, fileSet, analysis) {
+    const input = yield* buildJavaScriptArtifactGraphInputSteps(snapshot, fileSet, analysis);
+    // The input was built here and is not retained, so it can be transferred.
+    return yield* sealTransferredJavaScriptApplicationGraphSteps(input);
+}
+const completeSynchronously = (steps) => {
+    for (;;) {
+        const step = steps.next();
+        if (step.done === true)
+            return step.value;
+    }
+};
+function* buildJavaScriptArtifactGraphInputSteps(snapshot, fileSet, analysis) {
     const accumulator = new JavaScriptArtifactGraphAccumulator();
     const root = createJavaScriptArtifactRootNode(accumulator, snapshot);
     const context = {
@@ -33,15 +49,33 @@ const buildJavaScriptArtifactGraphInput = (snapshot, fileSet, analysis) => {
         containerNodes: new Map([[snapshot.manifest.root_sha256, root]]),
     };
     addJavaScriptArtifactContainers(context);
+    yield;
     addJavaScriptArtifactFiles(context);
-    const packageRoots = addJavaScriptPackageNodes(context);
-    addJavaScriptSourceModules(context);
-    const bundlerLimitations = addJavaScriptBundlerNodes(context);
-    const relationshipOmissions = addJavaScriptModuleRelationships(context);
-    const findingLimitations = addJavaScriptStaticFindings(context);
-    addElectronBoundaries(context);
-    addJavaScriptHtmlRoles(context);
-    addJavaScriptSourceMapOriginals(context);
+    yield;
+    // Raw observations remain on the file nodes. Only admitted expansions feed
+    // the relationship builders, including their Electron and bundler callers.
+    const projectionContext = {
+        ...context,
+        analysis: {
+            ...analysis,
+            files: analysis.files.map((file) => file.application_projection_failure === undefined
+                ? file
+                : { ...file, javascript: null, semantic: null }),
+        },
+    };
+    const packageRoots = addJavaScriptPackageNodes(projectionContext);
+    yield;
+    addJavaScriptSourceModules(projectionContext);
+    yield;
+    const bundlerLimitations = addJavaScriptBundlerNodes(projectionContext);
+    const relationshipOmissions = yield* addJavaScriptModuleRelationshipsSteps(projectionContext);
+    const findingLimitations = yield* addJavaScriptStaticFindingsSteps(projectionContext);
+    addElectronBoundaries(projectionContext);
+    yield;
+    addJavaScriptHtmlRoles(projectionContext);
+    yield;
+    addJavaScriptSourceMapOriginals(projectionContext);
+    yield;
     const coverage = graphCoverage(context);
     return {
         schema: "JavaScriptApplicationGraph",
@@ -57,7 +91,7 @@ const buildJavaScriptArtifactGraphInput = (snapshot, fileSet, analysis) => {
             ...graphLimitations(context, coverage.status, relationshipOmissions),
         ],
     };
-};
+}
 const graphCoverage = (context) => {
     const resourceLimits = semanticResourceLimits(context);
     const sourceMapPolicyGap = context.analysis.source_maps.some(({ status }) => status === "invalid");
@@ -65,17 +99,29 @@ const graphCoverage = (context) => {
         context.analysis.json_modules.some(({ status }) => status !== "included") ||
         context.analysis.source_maps.some(({ status }) => status === "invalid");
     const partialJavaScript = context.analysis.files.some(({ javascript }) => javascript !== null && javascript.parse_status === "partial");
-    const unknownGap = context.analysis.parse_failures > 0 ||
+    const unknownGap = context.analysis.files.some(({ analysis_failure, application_projection_failure }) => analysis_failure !== undefined ||
+        application_projection_failure !== undefined) ||
+        context.analysis.parse_failures > 0 ||
         context.fileSet.invalid_utf8_files > 0 ||
         sourceMapPolicyGap ||
         malformedStructuredData ||
         partialJavaScript;
-    if (context.analysis.truncated_scopes > 0)
-        return partialApplicationCoverage([], null);
-    if (resourceLimits.length > 0)
-        return partialApplicationCoverage(resourceLimits.map(applicationGraphResourceLimit), null);
+    const executionLimits = context.analysis.files.flatMap(({ analysis_failure, application_projection_failure }) => [analysis_failure, application_projection_failure].flatMap((failure) => failure === undefined
+        ? []
+        : javaScriptAnalysisCoverageLimits(failure.limits)));
+    if (resourceLimits.length > 0 || executionLimits.length > 0)
+        return partialApplicationCoverage([
+            ...new Map([
+                ...semanticResourceLimitCoverage(resourceLimits),
+                ...executionLimits,
+            ].map((limit) => [JSON.stringify(limit), limit])).values(),
+        ], null);
     if (unknownGap)
         return partialApplicationCoverage([], null);
+    if (context.snapshot.integrity_contradictions.length > 0) {
+        const nestedArchiveWasOpaque = context.snapshot.integrity_contradictions.some(({ logical_path }) => logical_path.toLowerCase().endsWith(".asar"));
+        return partialApplicationCoverage([], nestedArchiveWasOpaque ? null : 0);
+    }
     return completeApplicationCoverage();
 };
 const semanticResourceLimits = (context) => [
@@ -83,19 +129,6 @@ const semanticResourceLimits = (context) => [
         ? []
         : semanticCoverageResourceLimits(semantic.ir.coverage))),
 ].sort();
-const applicationGraphResourceLimit = (resourceLimit) => ({
-    name: `javascript_semantic_${resourceLimit.replaceAll("-", "_")}`,
-    value: resourceLimit === "primitive-candidates"
-        ? SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT
-        : resourceLimit === "primitive-bytes"
-            ? SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT
-            : SEMANTIC_EXPRESSION_DEPTH_LIMIT,
-    unit: resourceLimit === "expression-depth"
-        ? "depth"
-        : resourceLimit === "primitive-bytes"
-            ? "bytes"
-            : "items",
-});
 const graphLimitations = (context, coverage, relationshipOmissions) => {
     const ipc = collectElectronIpcRecords(context.analysis);
     const pairings = classifyElectronIpcPairings(ipc);
@@ -110,10 +143,14 @@ const graphLimitations = (context, coverage, relationshipOmissions) => {
                 javascript.electron.native_addon_bindings.length), 0);
     return [
         ...context.analysis.limitations,
+        ...context.snapshot.integrity_contradictions.map(({ logical_path: path }) => `Artifact integrity metadata contradicts observed bytes at ${path}; the observed bytes are untrusted.`),
         ...selfReferenceOmissions(relationshipOmissions.selfImports, ["import specifier", "import specifiers"], "the importing module"),
         "CommonJS and ESM binding relationships were recovered from inert syntax and resolved only within the inventoried artifact container.",
         "Webpack/Rspack factories were recovered from AST literals; REA did not invoke push handlers or bundle bootstrap code.",
         "Static imports, entrypoints, workers, endpoints, and storage relationships do not prove runtime execution.",
+        ...(context.analysis.files.some(({ javascript }) => javascript?.limitations.includes(ELECTRON_IDENTITY_LIMITATION))
+            ? [ELECTRON_IDENTITY_LIMITATION]
+            : []),
         ...(electronFindings === 0
             ? []
             : [
@@ -147,3 +184,4 @@ const graphLimitations = (context, coverage, relationshipOmissions) => {
             ]),
     ];
 };
+import { javaScriptAnalysisCoverageLimits } from "../../domain/javascript/javascriptAnalysisResourceControls.js";

package/dist/application/javascript/JavaScriptArtifactGraphBundlers.js

@@ -1,3 +1,4 @@
+import { compositeKey } from "../../domain/unicodeCodePointOrder.js";
 import { addAstContainsEdge, artifactLocalIdentity, chunkLookupKey, javascriptAnalysisCoverage, moduleLookupKey, selfReferenceOmissions, } from "./JavaScriptArtifactGraphContext.js";
 import { astObservationEvidence, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
 /** Project Webpack/Rspack AST literals and disclose unrepresentable relationships. */
@@ -41,7 +42,7 @@ const createBundlerChunkNode = (context, input) => {
     const chunkKey = `${registration.runtime}:${registration.chunk_keys.join(",")}`;
     return context.accumulator.addNode({
         kind: "javascript-chunk",
-        identity: artifactLocalIdentity(file.sha256, "bundler-chunk", chunkKey),
+        identity: artifactLocalIdentity(file.sha256, "bundler-chunk", compositeKey([registration.runtime, registration.chunk_keys])),
         observations: [
             {
                 label: chunkKey,
@@ -104,7 +105,7 @@ const addBundlerModuleNodes = (context, input) => {
                 },
             ],
         });
-        context.moduleNodes.set(moduleLookupKey(file.path, moduleValue.module_key), module);
+        context.moduleNodes.set(moduleLookupKey(file.path, registration.runtime, moduleValue.module_key), module);
         addAstContainsEdge(context, {
             source: chunk,
             target: module,
@@ -124,7 +125,7 @@ const addBundlerRuntimeEdges = (context, record) => {
     let selfAsyncChunks = 0;
     const { file, registration, chunk, coverage } = record;
     for (const moduleKey of registration.entry_module_keys) {
-        const resolved = context.moduleNodes.get(moduleLookupKey(file.path, moduleKey));
+        const resolved = context.moduleNodes.get(moduleLookupKey(file.path, registration.runtime, moduleKey));
         const target = resolved ?? unresolvedBundlerModuleNode(context, record, moduleKey);
         context.accumulator.addEdge({
             source_node_id: chunk.node_id,

package/dist/application/javascript/JavaScriptArtifactGraphContext.js

@@ -1,3 +1,4 @@
+import { compositeKey } from "../../domain/unicodeCodePointOrder.js";
 import { completeApplicationCoverage, partialApplicationCoverage, } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
 import { JavaScriptArtifactGraphAccumulator } from "./JavaScriptArtifactGraphAccumulator.js";
 import { artifactObservationEvidence, astObservationEvidence, staticInferenceEvidence, unavailableAstEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
@@ -63,12 +64,15 @@ export const addUnavailableStaticParseScope = (context, input) => {
                     path: input.file.path,
                     operation: input.operation,
                     limitation: input.limitation,
+                    ...(input.failure === undefined
+                        ? {}
+                        : { analysis_failure: input.failure }),
                 },
                 evidence: unavailableAstEvidence({
                     sha256: input.file.sha256,
                     path: input.file.path,
                     operation: input.operation,
-                    coverage: partialApplicationCoverage([], null),
+                    coverage: partialApplicationCoverage(input.limits ?? [], null),
                     limitation: input.limitation,
                 }),
             },
@@ -171,9 +175,9 @@ export const selfReferenceOmissions = (count, noun, owner) => count === 0
         `${String(count)} ${count === 1 ? noun[0] : noun[1]} resolved back to ${owner} itself and ${count === 1 ? "was" : "were"} omitted; application graph edges cannot be self-referential.`,
     ];
 /** Deterministic key for one recovered module inside a bundle asset. */
-export const moduleLookupKey = (path, moduleKey) => `${path}\0${moduleKey}`;
+export const moduleLookupKey = (path, runtime, moduleKey) => compositeKey([path, runtime, moduleKey]);
 /** Deterministic key for one recovered bundler chunk inside a bundle asset. */
-export const chunkLookupKey = (path, runtime, chunkKey) => `${path}\0${runtime}\0${chunkKey}`;
+export const chunkLookupKey = (path, runtime, chunkKey) => compositeKey([path, runtime, chunkKey]);
 /** Resolve a relative static specifier without escaping the artifact root. */
 export const resolveArtifactPath = (specifier, sourcePath, files, moduleKind) => resolveArtifactPathByContext({
     declaredPath: specifier,
@@ -183,6 +187,8 @@ export const resolveArtifactPath = (specifier, sourcePath, files, moduleKind) =>
     ...(moduleKind === undefined ? {} : { moduleKind }),
 }).resolved_path;
 /** Locate the recovered module that owns a static finding. */
-export const sourceNodeFor = (context, path, moduleKey) => moduleKey === null
+export const sourceNodeFor = (context, path, moduleKey, runtime) => moduleKey === null
     ? context.sourceModuleNodes.get(path)
-    : context.moduleNodes.get(moduleLookupKey(path, moduleKey));
+    : runtime === undefined
+        ? undefined
+        : context.moduleNodes.get(moduleLookupKey(path, runtime, moduleKey));

package/dist/application/javascript/JavaScriptArtifactGraphFindings.js

@@ -1,10 +1,13 @@
+import { createHash } from "node:crypto";
+import { compactStringIdentityKey } from "../../domain/compactStringIdentity.js";
 import { addStaticInferenceEdge, artifactLocalIdentity, chunkLookupKey, createElectronRoleNode, javascriptAnalysisCoverage, linkElectronRoleToAsset, moduleLookupKey, resolveArtifactPath, selfReferenceOmissions, sourceNodeFor, } from "./JavaScriptArtifactGraphContext.js";
 import { astObservationEvidence, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
 import { resolveArtifactPathByContext } from "./JavaScriptArtifactPathResolution.js";
 /** Project imports, workers, roles, endpoints, storage, and source-map links. */
-export const addJavaScriptStaticFindings = (context) => {
+export function* addJavaScriptStaticFindingsSteps(context) {
     const omissions = { selfReferences: 0 };
     for (const analyzed of context.analysis.files) {
+        yield;
         const { file, javascript } = analyzed;
         const asset = context.assetNodes.get(file.path);
         if (javascript === null || asset === undefined)
@@ -22,10 +25,9 @@ export const addJavaScriptStaticFindings = (context) => {
             addSourceMapEdge(context, { file, asset, value, coverage });
     }
     return selfReferenceOmissions(omissions.selfReferences, ["static reference", "static references"], "the referencing module");
-};
+}
 const addReference = (context, input, omissions) => {
-    const source = sourceNodeFor(context, input.file.path, input.value.module_key) ??
-        input.asset;
+    const source = sourceNodeFor(context, input.file.path, input.value.module_key, input.value.module_runtime) ?? input.asset;
     const resolved = input.value.specifier === null
         ? null
         : resolveReference(context, input.file.path, input.value);
@@ -97,14 +99,15 @@ const addReference = (context, input, omissions) => {
     });
 };
 const addEndpoint = (context, input) => {
-    const source = sourceNodeFor(context, input.file.path, input.value.module_key) ??
-        input.asset;
+    const source = sourceNodeFor(context, input.file.path, input.value.module_key, input.value.module_runtime) ?? input.asset;
+    const key = compactStringIdentityKey(input.value.value);
+    const label = `${input.value.kind} endpoint`;
     const node = context.accumulator.addNode({
         kind: "endpoint",
-        identity: artifactLocalIdentity(input.file.sha256, input.value.kind, input.value.value),
+        identity: artifactLocalIdentity(input.file.sha256, input.value.kind, key),
         observations: [
             {
-                label: input.value.value,
+                label: input.value.value.length <= label.length ? input.value.value : label,
                 properties: {
                     endpoint_kind: input.value.kind,
                     value: input.value.value,
@@ -131,8 +134,7 @@ const addEndpoint = (context, input) => {
     });
 };
 const addStorage = (context, input) => {
-    const source = sourceNodeFor(context, input.file.path, input.value.module_key) ??
-        input.asset;
+    const source = sourceNodeFor(context, input.file.path, input.value.module_key, input.value.module_runtime) ?? input.asset;
     const node = context.accumulator.addNode({
         kind: "storage",
         identity: artifactLocalIdentity(input.file.sha256, input.value.kind, input.value.name ?? input.value.mechanism),
@@ -179,8 +181,7 @@ const addDiscoveredRole = (context, input) => {
         range: input.value.location,
         coverage: input.coverage,
     });
-    const source = sourceNodeFor(context, input.file.path, input.value.module_key) ??
-        input.asset;
+    const source = sourceNodeFor(context, input.file.path, input.value.module_key, input.value.module_runtime) ?? input.asset;
     addStaticInferenceEdge(context, {
         source,
         target: role,
@@ -199,6 +200,9 @@ const addDiscoveredRole = (context, input) => {
     });
 };
 const addSourceMapEdge = (context, input) => {
+    const declaredUrlSha256 = createHash("sha256")
+        .update(input.value.declared_url)
+        .digest("hex");
     const resolvedPath = resolveArtifactPathByContext({
         declaredPath: input.value.declared_url,
         sourcePath: input.file.path,
@@ -207,33 +211,37 @@ const addSourceMapEdge = (context, input) => {
     }).resolved_path;
     const resolvedFile = resolvedPath === null ? undefined : context.filesByPath.get(resolvedPath);
     const resolvedNode = resolvedPath === null ? undefined : context.fileNodes.get(resolvedPath);
-    const target = resolvedFile?.kind === "source-map" && resolvedNode !== undefined
-        ? resolvedNode
-        : context.accumulator.addNode({
-            kind: "source-map",
-            identity: artifactLocalIdentity(input.file.sha256, "unresolved-source-map", input.value.declared_url),
-            observations: [
-                {
-                    label: input.value.declared_url,
-                    properties: {
-                        declared_url: input.value.declared_url,
-                        resolved_path: resolvedPath,
-                        available: false,
-                    },
-                    evidence: staticInferenceEvidence({
-                        sha256: input.file.sha256,
-                        path: input.file.path,
-                        range: input.value.location,
-                        operation: "discover-source-map",
-                        coverage: input.coverage,
-                        confidence: "medium",
-                        limitations: [
+    const isAvailable = resolvedFile?.kind === "source-map" && resolvedNode !== undefined;
+    const target = context.accumulator.addNode({
+        kind: "source-map",
+        identity: isAvailable && resolvedNode !== undefined
+            ? resolvedNode.identity
+            : artifactLocalIdentity(input.file.sha256, "unresolved-source-map", declaredUrlSha256),
+        observations: [
+            {
+                label: "source map reference",
+                properties: {
+                    declared_url: input.value.declared_url,
+                    declared_url_sha256: declaredUrlSha256,
+                    resolved_path: resolvedPath,
+                    available: isAvailable,
+                },
+                evidence: staticInferenceEvidence({
+                    sha256: input.file.sha256,
+                    path: input.file.path,
+                    range: input.value.location,
+                    operation: "discover-source-map",
+                    coverage: input.coverage,
+                    confidence: "medium",
+                    limitations: isAvailable
+                        ? []
+                        : [
                             "The declared source map was not present in the inventoried artifact.",
                         ],
-                    }),
-                },
-            ],
-        });
+                }),
+            },
+        ],
+    });
     addStaticInferenceEdge(context, {
         source: input.asset,
         target,
@@ -242,7 +250,7 @@ const addSourceMapEdge = (context, input) => {
         coverage: input.coverage,
         relation: "maps_to",
         properties: {
-            declared_url: input.value.declared_url,
+            declared_url_sha256: declaredUrlSha256,
             resolved_path: resolvedPath,
         },
     });
@@ -254,7 +262,9 @@ const resolveReference = (context, sourcePath, reference) => {
     const chunk = resolveBundlerChunkReference(context, sourcePath, reference);
     if (chunk !== null)
         return chunk;
-    const module = context.moduleNodes.get(moduleLookupKey(sourcePath, specifier));
+    const module = reference.module_runtime === undefined
+        ? undefined
+        : context.moduleNodes.get(moduleLookupKey(sourcePath, reference.module_runtime, specifier));
     if (module !== undefined) {
         const file = context.filesByPath.get(sourcePath);
         return file === undefined
@@ -292,9 +302,10 @@ const resolveBundlerChunkReference = (context, sourcePath, reference) => {
         return null;
     const registrations = context.analysis.files
         .find(({ file: analyzedFile }) => analyzedFile.path === sourcePath)
-        ?.javascript?.bundler_registrations.filter(({ modules }) => reference.module_key === null
-        ? true
-        : modules.some(({ module_key: moduleKey }) => moduleKey === reference.module_key));
+        ?.javascript?.bundler_registrations.filter(({ runtime, modules }) => reference.module_runtime === undefined
+        ? reference.module_key === null
+        : runtime === reference.module_runtime &&
+            modules.some(({ module_key: moduleKey }) => moduleKey === reference.module_key));
     if (registrations === undefined)
         return null;
     const candidates = registrations.flatMap(({ runtime }) => {

package/dist/application/javascript/JavaScriptArtifactGraphStructure.js

@@ -1,7 +1,10 @@
 import { completeApplicationCoverage } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
-import { addArtifactContainsEdge, addUnavailableStaticParseScope, artifactFileNodeKind, artifactLocalIdentity, createElectronRoleNode, linkElectronRoleToAsset, } from "./JavaScriptArtifactGraphContext.js";
-import { artifactObservationEvidence, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
+import { jsonValueSchema } from "../../domain/jsonValue.js";
+import { freezeJsonSnapshot } from "../../domain/immutableJson.js";
+import { addArtifactContainsEdge, addUnavailableStaticParseScope, artifactFileNodeKind, artifactLocalIdentity, javascriptAnalysisCoverage, createElectronRoleNode, linkElectronRoleToAsset, } from "./JavaScriptArtifactGraphContext.js";
+import { artifactObservationEvidence, astObservationEvidence, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
 import { resolveArtifactPathByContext } from "./JavaScriptArtifactPathResolution.js";
+import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";
 /** Create the exact root artifact node from the inventory manifest. */
 export const createJavaScriptArtifactRootNode = (accumulator, snapshot) => {
     const root = snapshot.nodes.find(({ artifact_id: id }) => id === snapshot.manifest.root_artifact_id);
@@ -77,9 +80,39 @@ export const addJavaScriptArtifactContainers = (context) => {
 };
 /** Project relevant files, ASAR entries, and explicit unavailable parse scopes. */
 export const addJavaScriptArtifactFiles = (context) => {
+    const packagesByPath = indexFirstByPath(context.analysis.packages);
+    const jsonModulesByPath = indexFirstByPath(context.analysis.json_modules);
+    const sourceMapsByPath = indexFirstByPath(context.analysis.source_maps);
     for (const analyzed of context.analysis.files) {
         const { file } = analyzed;
-        const target = createFileTarget(context, file, analyzed.javascript);
+        const jsonValue = jsonModulesByPath.get(file.path);
+        const target = createFileTarget(context, file, analyzed.javascript, jsonValue);
+        if (analyzed.application_projection_failure !== undefined &&
+            analyzed.javascript !== null)
+            context.accumulator.addNode({
+                kind: target.kind,
+                identity: target.identity,
+                observations: [
+                    {
+                        label: file.path,
+                        properties: {
+                            static_analysis: freezeJsonSnapshot(jsonValueSchema.parse(analyzed.javascript)),
+                            semantic_module_analysis: analyzed.semantic === null
+                                ? null
+                                : freezeJsonSnapshot(jsonValueSchema.parse(analyzed.semantic.ir)),
+                            application_projection_failure: analyzed.application_projection_failure.error,
+                        },
+                        evidence: astObservationEvidence({
+                            sha256: file.sha256,
+                            path: file.path,
+                            operation: "retain-unexpanded-static-findings",
+                            range: sourceFileRange(file),
+                            coverage: javascriptAnalysisCoverage(analyzed.javascript),
+                            limitations: [analyzed.application_projection_failure.reason],
+                        }),
+                    },
+                ],
+            });
         context.fileNodes.set(file.path, target);
         if (file.kind === "javascript")
             context.assetNodes.set(file.path, target);
@@ -112,7 +145,16 @@ export const addJavaScriptArtifactFiles = (context) => {
                 }),
             });
         }
-        if (file.kind === "javascript" &&
+        if (analyzed.analysis_failure !== undefined)
+            addUnavailableStaticParseScope(context, {
+                file,
+                asset: target,
+                operation: "analyze-javascript-source",
+                limitation: analyzed.analysis_failure.reason,
+                failure: analyzed.analysis_failure.error,
+                limits: javaScriptAnalysisCoverageLimits(analyzed.analysis_failure.limits),
+            });
+        else if (file.kind === "javascript" &&
             (analyzed.javascript === null ||
                 analyzed.javascript.parse_status === "failed"))
             addUnavailableStaticParseScope(context, {
@@ -123,7 +165,16 @@ export const addJavaScriptArtifactFiles = (context) => {
                     ? "JavaScript syntax could not be parsed."
                     : `JavaScript text was unavailable: ${file.text.reason}.`,
             });
-        const packageValue = context.analysis.packages.find(({ path }) => path === file.path);
+        if (analyzed.application_projection_failure !== undefined)
+            addUnavailableStaticParseScope(context, {
+                file,
+                asset: target,
+                operation: "project-javascript-application",
+                limitation: analyzed.application_projection_failure.reason,
+                failure: analyzed.application_projection_failure.error,
+                limits: javaScriptAnalysisCoverageLimits(analyzed.application_projection_failure.limits),
+            });
+        const packageValue = packagesByPath.get(file.path);
         if (packageValue !== undefined && packageValue.status !== "included")
             addUnavailableStaticParseScope(context, {
                 file,
@@ -131,7 +182,6 @@ export const addJavaScriptArtifactFiles = (context) => {
                 operation: "parse-package-json",
                 limitation: packageValue.limitation,
             });
-        const jsonValue = context.analysis.json_modules.find(({ path }) => path === file.path);
         if (jsonValue !== undefined && jsonValue.status !== "included")
             addUnavailableStaticParseScope(context, {
                 file,
@@ -139,7 +189,7 @@ export const addJavaScriptArtifactFiles = (context) => {
                 operation: "parse-json-module",
                 limitation: jsonValue.limitation,
             });
-        const sourceMap = context.analysis.source_maps.find(({ path }) => path === file.path);
+        const sourceMap = sourceMapsByPath.get(file.path);
         if (sourceMap !== undefined && sourceMap.status === "invalid")
             addUnavailableStaticParseScope(context, {
                 file,
@@ -149,9 +199,24 @@ export const addJavaScriptArtifactFiles = (context) => {
             });
     }
 };
+const sourceFileRange = (file) => {
+    if (!file.text.included)
+        throw new TypeError("Retained static facts require their source text");
+    let line = 1;
+    let lastLineStart = 0;
+    for (const match of file.text.value.matchAll(/\r\n|[\n\r\u2028\u2029]/gu)) {
+        line += 1;
+        lastLineStart = match.index + match[0].length;
+    }
+    return {
+        start: { line: 1, column: 0 },
+        end: { line, column: file.text.value.length - lastLineStart },
+    };
+};
 /** Project package metadata and its declared Electron roles. */
 export const addJavaScriptPackageNodes = (context) => {
     const roots = [];
+    const rootPath = applicationManifestPath(context);
     for (const packageValue of context.analysis.packages) {
         const file = context.filesByPath.get(packageValue.path);
         if (file === undefined)
@@ -180,7 +245,7 @@ export const addJavaScriptPackageNodes = (context) => {
                 },
             ],
         });
-        if (roots.length === 0) {
+        if (file.path === rootPath) {
             roots.push(node);
             context.accumulator.addEdge({
                 source_node_id: node.node_id,
@@ -202,6 +267,8 @@ export const addJavaScriptPackageNodes = (context) => {
                 file,
                 operation: "inventory-package",
             });
+        if (dependencyManifest(file.path))
+            continue;
         addPackageRole(context, {
             packageNode: node,
             packageFile: file,
@@ -217,9 +284,15 @@ export const addJavaScriptPackageNodes = (context) => {
     }
     return roots;
 };
-const createFileTarget = (context, file, javascript) => {
+/** Dependency-only artifacts retain their inventory root. */
+const applicationManifestPath = (context) => context.analysis.packages
+    .map(({ path }) => path)
+    .filter((path) => context.filesByPath.has(path) && !dependencyManifest(path))
+    .sort((left, right) => left.split("/").length - right.split("/").length ||
+    compareUnicodeCodePoints(left, right))[0];
+const dependencyManifest = (path) => path.split("/").slice(0, -1).includes("node_modules");
+const createFileTarget = (context, file, javascript, json) => {
     const kind = artifactFileNodeKind(file.kind);
-    const json = context.analysis.json_modules.find(({ path }) => path === file.path);
     return context.accumulator.addNode({
         kind,
         identity: {
@@ -253,6 +326,14 @@ const createFileTarget = (context, file, javascript) => {
         ],
     });
 };
+const indexFirstByPath = (values) => {
+    const index = new Map();
+    for (const value of values) {
+        if (!index.has(value.path))
+            index.set(value.path, value);
+    }
+    return index;
+};
 const createAsarEntry = (context, file) => {
     const isAsar = context.snapshot.manifest.root_format === "asar" ||
         file.container_sha256 !== context.snapshot.manifest.root_sha256;
@@ -333,3 +414,4 @@ const containerProperties = (container) => ({
     bytes: container.bytes,
     inventory_artifact_id: container.inventory_artifact_id,
 });
+import { javaScriptAnalysisCoverageLimits } from "../../domain/javascript/javascriptAnalysisResourceControls.js";