rea-agents 6.4.0 → 6.5.0

package/dist/application/javascript/JavaScriptApplicationService.js

@@ -9,7 +9,7 @@ import { err, ok } from "../../domain/result.js";
 import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
 import { createOwnedJavaScriptApplicationEvidenceCooperatively } from "./JavaScriptApplicationEvidence.js";
 import { assertJavaScriptAnalysisActive, checkpointJavaScriptAnalysis, completeJavaScriptAnalysisSteps, } from "./JavaScriptAnalysisControl.js";
-import { reconstructJavaScriptArtifact } from "./JavaScriptArtifactReconstruction.js";
+import { reconstructJavaScriptArtifact, } from "./JavaScriptArtifactReconstruction.js";
 import { JAVASCRIPT_APPLICATION_PROVIDER } from "../InvestigationProviders.js";
 const OPERATION = "analyze_javascript_application";
 /** Statically analyze one local JavaScript/Electron application. */
@@ -21,6 +21,9 @@ export const analyzeJavaScriptApplication = async (rawInput, scope, options = {}
 };
 /** Analyze input already parsed by a trusted adapter boundary. */
 export const analyzeJavaScriptApplicationValidated = async (input, scope, options = {}) => {
+    let reconstructed;
+    let result;
+    let evidence;
     try {
         assertJavaScriptAnalysisActive(options.signal);
         await options.progress?.report({
@@ -30,17 +33,7 @@ export const analyzeJavaScriptApplicationValidated = async (input, scope, option
             message: "Inventorying and parsing application artifacts",
         });
         await checkpointJavaScriptAnalysis(options.signal);
-        const reconstructed = await reconstructJavaScriptArtifact({
-            input_path: input.input_path,
-            format: input.format,
-            integrity_policy: input.integrity_policy,
-            ...(input.max_heap_mb === undefined
-                ? {}
-                : { max_heap_mb: input.max_heap_mb }),
-            ...(input.analysis_timeout_ms === undefined
-                ? {}
-                : { analysis_timeout_ms: input.analysis_timeout_ms }),
-        }, scope, options.signal, options.progress);
+        reconstructed = await reconstructJavaScriptArtifact(input, scope, options.signal, options.progress);
         const { electron_summary: summary, ...application } = reconstructed;
         await options.progress?.report({
             phase: "validate_javascript_application_result",
@@ -49,7 +42,7 @@ export const analyzeJavaScriptApplicationValidated = async (input, scope, option
             message: "Validating result metadata and cross-graph bindings",
         });
         await checkpointJavaScriptAnalysis(options.signal);
-        const result = await completeJavaScriptAnalysisSteps(parseOwnedJavaScriptApplicationAnalysisSteps({
+        result = await completeJavaScriptAnalysisSteps(parseOwnedJavaScriptApplicationAnalysisSteps({
             ...application,
             summary,
             limitations: reconstructed.graph.limitations,
@@ -61,7 +54,7 @@ export const analyzeJavaScriptApplicationValidated = async (input, scope, option
             message: "Creating and hashing application analysis Evidence",
         });
         await checkpointJavaScriptAnalysis(options.signal);
-        const evidence = await createOwnedJavaScriptApplicationEvidenceCooperatively(input, result, options.signal, options.progress);
+        evidence = await createOwnedJavaScriptApplicationEvidenceCooperatively(input, result, options.signal, options.progress);
         await checkpointJavaScriptAnalysis(options.signal);
         await options.progress?.report({
             phase: "analyze_javascript_application",
@@ -74,6 +67,28 @@ export const analyzeJavaScriptApplicationValidated = async (input, scope, option
         return ok(evidence);
     }
     catch (cause) {
+        if (cause instanceof ArtifactReaderFailure &&
+            cause.reason === "cancelled" &&
+            reconstructed !== undefined) {
+            try {
+                if (result === undefined) {
+                    const { electron_summary: summary, ...application } = reconstructed;
+                    result = await completeJavaScriptAnalysisSteps(parseOwnedJavaScriptApplicationAnalysisSteps({
+                        ...application,
+                        summary,
+                        limitations: reconstructed.graph.limitations,
+                    }));
+                }
+                evidence ??=
+                    await createOwnedJavaScriptApplicationEvidenceCooperatively(input, result);
+                return err(artifactFailureToOperationError(cause).retainPartialObservation(evidence));
+            }
+            catch (completionCause) {
+                // A validation or Evidence failure while finishing the partial result
+                // remains the primary failure instead of being hidden by cancellation.
+                cause = completionCause;
+            }
+        }
         // Preserve execution constraints and their completed partial Evidence.
         if (cause instanceof AnalysisError)
             return err(cause);

package/dist/application/javascript/JavaScriptApplicationWorkflowService.js

@@ -1,6 +1,5 @@
 import { z } from "zod";
 import { AnalysisProtocolError } from "../../domain/analysisErrorCore.js";
-import {} from "../../domain/analysisErrorBase.js";
 import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
 import { compareJavaScriptApplicationVersions } from "../../domain/javascript/javascriptApplicationVersionComparison.js";
 import { compareApplicationVersionsInputSchema, applicationVersionIdentitiesSchema, } from "../../domain/javascript/javascriptApplicationVersionComparisonSchemas.js";

package/dist/application/javascript/JavaScriptArtifactAnalysis.js

@@ -1,12 +1,13 @@
 import { createHash } from "node:crypto";
+import { moduleResolutionModeForJavaScriptReference } from "../../domain/javascript/javascriptModuleResolutionMode.js";
 import { setImmediate } from "node:timers/promises";
-import { resolveJavaScriptSourceMapReference } from "../../domain/javascript/javascriptSourceMapPaths.js";
+import { resolveJavaScriptSourceMapReferences } from "../../domain/javascript/javascriptSourceMapPaths.js";
 import { analyzeParsedJavaScriptStaticSourceSteps } from "../../domain/javascript/javascriptStaticAnalysis.js";
 import { analyzeParsedJavaScriptSemanticsSteps, classifyParsedJavaScriptOpenReceiversSteps, } from "../../domain/javascript/javascriptSemanticAnalysis.js";
 import { projectJavaScriptModuleSemantics } from "../../domain/javascript/javascriptModuleSemanticIr.js";
 import { parseJavaScriptSource } from "../../domain/javascript/javascriptSourceParser.js";
 import { hasValidSourceMapContents } from "../../domain/sourceMapContents.js";
-import { flattenSourceMapLeaves } from "../../domain/sourceMapEnvelope.js";
+import { flattenSourceMapLeaves, sourceMapJsonText, } from "../../domain/sourceMapEnvelope.js";
 import { failedJavaScriptStaticAnalysis } from "../../domain/javascript/javascriptStaticAnalysisHelpers.js";
 import { analyzeJavaScriptJsonModule } from "./JavaScriptJsonModules.js";
 import { completeJavaScriptAnalysisSteps } from "./JavaScriptAnalysisControl.js";
@@ -47,12 +48,21 @@ export const analyzeAndProjectJavaScriptArtifactFiles = async (fileSet, projectS
 export const analyzeAndAdoptJavaScriptArtifactFiles = async (fileSet, worker, projection, beforeFile, signal) => {
     const state = emptyArtifactAnalysis();
     let interruption = null;
-    for (const [index, file] of fileSet.files.entries()) {
+    const selectedFileCount = fileSet.files.length - (fileSet.source_selection?.unselected_files ?? 0);
+    let selectedFileIndex = 0;
+    for (const file of fileSet.files) {
         try {
             await setImmediate();
-            await beforeFile(file, index, fileSet.files.length);
+            if (classifyOutsideAnalysisScope(file, state, projection)) {
+                if (signal?.aborted === true) {
+                    interruption = new AnalysisCancelledError("analyze_javascript_application");
+                    break;
+                }
+                continue;
+            }
             if (signal?.aborted === true)
                 throw new AnalysisCancelledError("analyze_javascript_application");
+            await beforeFile(file, selectedFileIndex++, selectedFileCount);
             if (file.kind !== "javascript" || !file.text.included) {
                 const steps = analyzeArtifactFileSteps(file, {
                     state,
@@ -157,6 +167,8 @@ export const analyzeAndAdoptJavaScriptArtifactFiles = async (fileSet, worker, pr
         for (const file of fileSet.files) {
             if (analyzedPaths.has(file.path))
                 continue;
+            if (classifyOutsideAnalysisScope(file, state, projection))
+                continue;
             state.files.push({
                 file,
                 javascript: null,
@@ -188,23 +200,35 @@ const finalizeArtifactAnalysis = (state) => {
         packages: state.packages,
         json_modules: state.jsonModules,
         html_scripts: state.htmlScripts,
+        html_inline_scripts: state.htmlInlineScripts,
         source_maps: state.sourceMaps,
         visited_ast_nodes: state.visitedNodes,
-        findings: state.findings + state.htmlScripts.length,
+        findings: state.findings +
+            state.htmlScripts.length +
+            state.htmlInlineScripts.reduce((count, { script_count }) => count + script_count, 0),
         modules: state.modules,
         parse_failures: state.parseFailures,
         limitations: [
             "JavaScript and HTML were parsed as inert text; bundle bootstrap code was never executed.",
             "Static paths and relationships may remain unresolved when expressions are dynamic or obfuscated.",
+            ...state.htmlInlineScripts.map(htmlInlineScriptLimitation),
             ...state.files.flatMap(({ analysis_failure, application_projection_failure }) => [analysis_failure, application_projection_failure].flatMap((failure) => (failure === undefined ? [] : [failure.reason]))),
         ],
     };
 };
 function* analyzeArtifactFileSteps(file, context) {
     const { state } = context;
+    if (classifyOutsideAnalysisScope(file, state))
+        return;
     addStructuredObservations(file, state);
-    if (file.kind === "html" && file.text.included)
-        state.htmlScripts.push(...parseHtmlScripts(file.path, file.text.value));
+    if (file.kind === "html" && file.text.included) {
+        const html = parseHtmlScripts(file.path, file.text.value);
+        // Append without spreading: argument count is bounded by the engine.
+        for (const script of html.scripts)
+            state.htmlScripts.push(script);
+        if (html.inlineScripts !== null)
+            state.htmlInlineScripts.push(html.inlineScripts);
+    }
     if (file.kind === "source-map")
         addSourceMap(file, context);
     if (file.kind !== "javascript" || !file.text.included) {
@@ -224,7 +248,7 @@ function* analyzeArtifactFileSteps(file, context) {
     const staticFindings = findingCount(analysis);
     yield;
     const semantics = analysis.parse_status === "complete" || analysis.parse_status === "partial"
-        ? yield* analyzeParsedJavaScriptSemanticsSteps(parsed)
+        ? yield* analyzeParsedJavaScriptSemanticsSteps(parsed, moduleResolutionModeForJavaScriptReference(file.path, "static-import"))
         : null;
     const projected = semantics === null
         ? null
@@ -240,6 +264,14 @@ function* analyzeArtifactFileSteps(file, context) {
     if (analysis.parse_status === "failed")
         state.parseFailures += 1;
 }
+const classifyOutsideAnalysisScope = (file, state, projection) => {
+    if (file.text.included || file.text.reason !== "outside-analysis-scope")
+        return false;
+    state.files.push({ file, javascript: null, semantic: null });
+    if (file.kind === "javascript")
+        projection?.recordUnavailableFile(file, "Source was not analyzed because it is outside the caller-selected source_paths.", null, "incomplete-module");
+    return true;
+};
 const addSourceMap = (file, context) => {
     const sourceMap = parseSourceMap(file);
     context.state.sourceMaps.push(sourceMap);
@@ -249,6 +281,7 @@ const emptyArtifactAnalysis = () => ({
     packages: [],
     jsonModules: [],
     htmlScripts: [],
+    htmlInlineScripts: [],
     sourceMaps: [],
     visitedNodes: 0,
     findings: 0,
@@ -306,49 +339,69 @@ const unavailablePackage = (file, limitation) => ({
     limitation,
 });
 const parseHtmlScripts = (path, text) => {
-    const { scripts, baseHref } = htmlArtifactReferences(text);
-    return scripts.map(({ scriptPath, startOffset, endOffset }) => ({
-        html_path: path,
-        script_path: scriptPath,
-        base_href: baseHref,
-        location: rangeForOffsets(text, startOffset, endOffset),
-    }));
+    const { scripts, inlineScripts, inlineScriptCount, baseHref } = htmlArtifactReferences(text);
+    return {
+        scripts: scripts.map(({ scriptPath, location }) => ({
+            html_path: path,
+            script_path: scriptPath,
+            base_href: baseHref,
+            location,
+        })),
+        inlineScripts: inlineScriptCount === 0
+            ? null
+            : {
+                path,
+                script_count: inlineScriptCount,
+                scripts: inlineScripts.map(({ scriptType, location }) => ({
+                    script_type: scriptType,
+                    location,
+                })),
+            },
+    };
 };
 const parseSourceMap = (file) => {
     if (!file.text.included)
         return unavailableSourceMap(file);
     let value;
     try {
-        value = JSON.parse(file.text.value);
+        value = JSON.parse(sourceMapJsonText(file.text.value));
     }
     catch (cause) {
         void cause;
         return invalidSourceMap(file, "Source map is not valid JSON.");
     }
-    const maps = flattenSourceMaps(value);
+    const maps = flattenSourceMapLeaves(value);
     if (maps === undefined)
         return invalidSourceMap(file, "Source map is not a version 3 map.");
     return collectSourceMapOriginals(file, maps);
 };
 const collectSourceMapOriginals = (file, maps) => {
     const sources = [];
+    let declarationIndex = 0;
     for (const map of maps) {
         const names = map.sources;
         if (!Array.isArray(names))
             return invalidSourceMap(file, "Source map has no sources array.");
         const contents = map.sourcesContent;
-        if (!hasValidSourceMapContents(names.length, contents))
-            return invalidSourceMap(file, "Source map sourcesContent must contain one string or null entry per source.");
+        if (!hasValidSourceMapContents(contents))
+            return invalidSourceMap(file, "Source map sourcesContent must be an array of strings or null entries.");
         if (map.sourceRoot != null && typeof map.sourceRoot !== "string")
             return invalidSourceMap(file, "Source map sourceRoot must be a string or null.");
         const root = typeof map.sourceRoot === "string" ? map.sourceRoot : null;
-        for (const [index, raw] of names.entries()) {
-            if (typeof raw !== "string")
+        const sourceNames = [];
+        for (const raw of names) {
+            if (raw !== null && typeof raw !== "string")
                 return invalidSourceMap(file, "Source map contains a non-string source name.");
+            sourceNames.push(raw);
+        }
+        const references = resolveJavaScriptSourceMapReferences(sourceNames, root, file.path);
+        for (const [index, reference] of references.entries()) {
             const rawContent = Array.isArray(contents) ? contents[index] : undefined;
             const content = typeof rawContent === "string" ? rawContent : null;
             sources.push({
-                reference: resolveJavaScriptSourceMapReference(raw, root, file.path),
+                source_index: index,
+                declaration_index: declarationIndex++,
+                reference,
                 content,
                 content_sha256: content === null ? null : sha256(content),
             });
@@ -362,6 +415,17 @@ const collectSourceMapOriginals = (file, maps) => {
         limitation: null,
     };
 };
+/** Name the HTML file and lines whose inline JavaScript was not analyzed. */
+export const htmlInlineScriptLimitation = ({ path, script_count: count, scripts, }) => {
+    const lines = scripts
+        .slice(0, HTML_INLINE_SCRIPT_LIMITATION_LINES)
+        .map(({ location }) => String(location.start.line));
+    const unnamed = count - lines.length;
+    const one = count === 1;
+    return `${path} has ${String(count)} inline JavaScript ${one ? "body" : "bodies"} starting at line${one ? "" : "s"} ${lines.join(", ")}${unnamed > 0 ? ` and ${String(unnamed)} more` : ""} that ${one ? "was" : "were"} not analyzed; endpoints, storage, imports and other facts in ${one ? "it" : "them"} are absent from the evidence.`;
+};
+// Keep the agent-facing limitation short; the unknown scope keeps the ranges.
+const HTML_INLINE_SCRIPT_LIMITATION_LINES = 10;
 const unavailableSourceMap = (file) => {
     if (file.text.included)
         throw new TypeError("Expected unavailable source-map text");
@@ -373,10 +437,6 @@ const unavailableSourceMap = (file) => {
         limitation: "Source-map text could not be decoded as UTF-8.",
     };
 };
-const flattenSourceMaps = (root) => {
-    const leaves = flattenSourceMapLeaves(root);
-    return leaves === undefined ? undefined : [...leaves];
-};
 const invalidSourceMap = (file, limitation) => ({
     path: file.path,
     sha256: file.sha256,
@@ -396,14 +456,6 @@ const findingCount = (analysis) => analysis.references.length +
     analysis.electron.sender_validations.length +
     analysis.electron.utility_processes.length +
     analysis.electron.native_addon_bindings.length;
-const rangeForOffsets = (text, start, end) => ({
-    start: pointForOffset(text, start),
-    end: pointForOffset(text, end),
-});
-const pointForOffset = (text, offset) => {
-    const lines = text.slice(0, offset).split(/\r\n|\r|\n/u);
-    return { line: lines.length, column: lines.at(-1)?.length ?? 0 };
-};
 const optionalString = (value) => typeof value === "string" && value.length > 0 ? value : null;
 const sha256 = (value) => createHash("sha256").update(value).digest("hex");
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);

package/dist/application/javascript/JavaScriptArtifactGraphAccumulator.js

@@ -1,32 +1,53 @@
 import { createJavaScriptApplicationEdge, createJavaScriptApplicationNode, } from "../../domain/javascript/javascriptApplicationGraph.js";
-/** Deduplicate graph entities while retaining distinct evidence observations. */
+import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";
+/**
+ * Own live construction nodes and deduplicate their evidence observations.
+ * Consumers retain references but must not mutate the owned observations;
+ * nodes() finalizes their canonical order before graph validation/output.
+ */
 export class JavaScriptArtifactGraphAccumulator {
     #nodes = new Map();
     #edges = new Map();
-    /** Create or merge one canonical node, retaining a stable live construction reference. */
+    /** Merge observations into a stable live node; order is finalized by nodes(). */
     addNode(input) {
         const created = createJavaScriptApplicationNode(displayableNode(input));
         const existing = this.#nodes.get(created.node_id);
         if (existing === undefined) {
-            this.#nodes.set(created.node_id, created);
+            this.#nodes.set(created.node_id, {
+                node: created,
+                observationIndices: new Map(created.observations.map((observation, index) => [
+                    observation.observation_id,
+                    index,
+                ])),
+                dirty: false,
+            });
             return created;
         }
-        const bySemanticId = new Map([...existing.observations, ...created.observations].map((observation) => [
-            observation.observation_id,
-            observation,
-        ]));
-        const observations = [...bySemanticId.values()].sort((left, right) => left.observation_id < right.observation_id
-            ? -1
-            : left.observation_id > right.observation_id
-                ? 1
-                : 0);
-        // Both factories already validated and identified these observations.
-        // Replacing the node retained every previous observation array through
-        // path/chunk/IPC indexes when multiple paths shared an entity identity.
-        existing.observations.length = 0;
-        for (const observation of observations)
-            existing.observations.push(observation);
-        return existing;
+        const observations = existing.node.observations;
+        // The first factory input can contain duplicate IDs. As before, a later
+        // merge retains only their last occurrences without replacing the array.
+        if (existing.observationIndices.size !== observations.length) {
+            let retained = 0;
+            for (const [index, observation] of observations.entries()) {
+                if (existing.observationIndices.get(observation.observation_id) !== index)
+                    continue;
+                observations[retained] = observation;
+                existing.observationIndices.set(observation.observation_id, retained);
+                retained += 1;
+            }
+            observations.length = retained;
+        }
+        for (const observation of created.observations) {
+            const index = existing.observationIndices.get(observation.observation_id);
+            if (index === undefined) {
+                existing.observationIndices.set(observation.observation_id, observations.length);
+                observations.push(observation);
+                existing.dirty = true;
+            }
+            else
+                observations[index] = observation;
+        }
+        return existing.node;
     }
     /** Create or replace one canonical edge by semantic identifier. */
     addEdge(input) {
@@ -34,9 +55,18 @@ export class JavaScriptArtifactGraphAccumulator {
         this.#edges.set(edge.edge_id, edge);
         return edge;
     }
-    /** Return all accumulated canonical nodes. */
+    /** Finalize observation order in place and return all canonical nodes. */
     nodes() {
-        return [...this.#nodes.values()];
+        return [...this.#nodes.values()].map((entry) => {
+            if (entry.dirty) {
+                entry.node.observations.sort((left, right) => compareUnicodeCodePoints(left.observation_id, right.observation_id));
+                entry.observationIndices.clear();
+                for (const [index, observation] of entry.node.observations.entries())
+                    entry.observationIndices.set(observation.observation_id, index);
+                entry.dirty = false;
+            }
+            return entry.node;
+        });
     }
     /** Return all accumulated canonical edges. */
     edges() {

package/dist/application/javascript/JavaScriptArtifactGraphBuilder.js

@@ -1,11 +1,11 @@
 import { ELECTRON_IDENTITY_LIMITATION } from "../../domain/javascript/javascriptElectronMemberWrites.js";
 import { createJavaScriptApplicationGraph, sealTransferredJavaScriptApplicationGraphSteps, } from "../../domain/javascript/javascriptApplicationGraph.js";
 import { JavaScriptArtifactGraphAccumulator } from "./JavaScriptArtifactGraphAccumulator.js";
-import { selfReferenceOmissions, } from "./JavaScriptArtifactGraphContext.js";
+import { HTML_INLINE_SCRIPT_LOCATION_COVERAGE_LIMIT, omittedHtmlInlineScriptLocations, selfReferenceOmissions, } from "./JavaScriptArtifactGraphContext.js";
 import { addJavaScriptHtmlRoles, addJavaScriptSourceMapOriginals, } from "./JavaScriptArtifactGraphDocuments.js";
 import { addJavaScriptStaticFindingsSteps } from "./JavaScriptArtifactGraphFindings.js";
 import { addJavaScriptModuleRelationshipsSteps, addJavaScriptSourceModules, } from "./JavaScriptModuleRelationships.js";
-import { completeApplicationCoverage, partialApplicationCoverage, } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
+import { completeApplicationCoverage, partialApplicationCoverage, truncatedApplicationCoverage, } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
 import { semanticCoverageResourceLimits, semanticResourceLimitCoverage, } from "../../domain/javascript/javascriptSemanticCoverage.js";
 import { semanticResourceLimitReason } from "../../domain/javascript/javascriptSemanticResourceLimits.js";
 import { addJavaScriptArtifactContainers, addJavaScriptArtifactFiles, addJavaScriptPackageNodes, createJavaScriptArtifactRootNode, } from "./JavaScriptArtifactGraphStructure.js";
@@ -39,8 +39,12 @@ function* buildJavaScriptArtifactGraphInputSteps(snapshot, fileSet, analysis) {
         snapshot,
         fileSet,
         analysis,
+        directoryPaths: new Set(snapshot.occurrences
+            .filter(({ entry_kind }) => entry_kind === "directory")
+            .map(({ logical_path }) => logical_path)),
         root,
         filesByPath: new Map(fileSet.files.map((file) => [file.path, file])),
+        unanalyzedFiles: fileSet.unanalyzed_files,
         fileNodes: new Map(),
         assetNodes: new Map(),
         sourceModuleNodes: new Map(),
@@ -99,23 +103,38 @@ const graphCoverage = (context) => {
         context.analysis.json_modules.some(({ status }) => status !== "included") ||
         context.analysis.source_maps.some(({ status }) => status === "invalid");
     const partialJavaScript = context.analysis.files.some(({ javascript }) => javascript !== null && javascript.parse_status === "partial");
-    const unknownGap = context.analysis.files.some(({ analysis_failure, application_projection_failure }) => analysis_failure !== undefined ||
-        application_projection_failure !== undefined) ||
+    const unknownGap = (context.fileSet.source_selection?.unselected_files ?? 0) > 0 ||
+        context.fileSet.unavailable_relevant_files.length > 0 ||
+        context.analysis.files.some(({ analysis_failure, application_projection_failure }) => analysis_failure !== undefined ||
+            application_projection_failure !== undefined) ||
         context.analysis.parse_failures > 0 ||
         context.fileSet.invalid_utf8_files > 0 ||
+        context.analysis.html_inline_scripts.length > 0 ||
         sourceMapPolicyGap ||
         malformedStructuredData ||
         partialJavaScript;
     const executionLimits = context.analysis.files.flatMap(({ analysis_failure, application_projection_failure }) => [analysis_failure, application_projection_failure].flatMap((failure) => failure === undefined
         ? []
         : javaScriptAnalysisCoverageLimits(failure.limits)));
-    if (resourceLimits.length > 0 || executionLimits.length > 0)
-        return partialApplicationCoverage([
+    // Capped inline script locations truncate the result. The total omission
+    // stays unknown because the unanalyzed bodies hide an unknown fact count.
+    const inlineScriptsTruncated = omittedHtmlInlineScriptLocations(context.analysis.html_inline_scripts) > 0;
+    if (resourceLimits.length > 0 ||
+        executionLimits.length > 0 ||
+        inlineScriptsTruncated) {
+        const limits = [
             ...new Map([
                 ...semanticResourceLimitCoverage(resourceLimits),
                 ...executionLimits,
+                ...(inlineScriptsTruncated
+                    ? [HTML_INLINE_SCRIPT_LOCATION_COVERAGE_LIMIT]
+                    : []),
             ].map((limit) => [JSON.stringify(limit), limit])).values(),
-        ], null);
+        ];
+        return inlineScriptsTruncated
+            ? truncatedApplicationCoverage(limits, null)
+            : partialApplicationCoverage(limits, null);
+    }
     if (unknownGap)
         return partialApplicationCoverage([], null);
     if (context.snapshot.integrity_contradictions.length > 0) {
@@ -143,6 +162,11 @@ const graphLimitations = (context, coverage, relationshipOmissions) => {
                 javascript.electron.native_addon_bindings.length), 0);
     return [
         ...context.analysis.limitations,
+        ...(context.fileSet.source_selection === undefined
+            ? []
+            : [
+                `Caller-selected source analysis leaves ${String(context.fileSet.source_selection.unselected_files)} inventoried files outside analysis scope. Inventory identity covers the complete artifact; relationships through unselected sources remain unknown.`,
+            ]),
         ...context.snapshot.integrity_contradictions.map(({ logical_path: path }) => `Artifact integrity metadata contradicts observed bytes at ${path}; the observed bytes are untrusted.`),
         ...selfReferenceOmissions(relationshipOmissions.selfImports, ["import specifier", "import specifiers"], "the importing module"),
         "CommonJS and ESM binding relationships were recovered from inert syntax and resolved only within the inventoried artifact container.",

package/dist/application/javascript/JavaScriptArtifactGraphContext.js

@@ -1,8 +1,17 @@
 import { compositeKey } from "../../domain/unicodeCodePointOrder.js";
-import { completeApplicationCoverage, partialApplicationCoverage, } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
+import { completeApplicationCoverage, partialApplicationCoverage, truncatedApplicationCoverage, } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
+import { HTML_INLINE_SCRIPT_LOCATION_LIMIT } from "../../domain/javascript/htmlArtifactReferences.js";
 import { JavaScriptArtifactGraphAccumulator } from "./JavaScriptArtifactGraphAccumulator.js";
 import { artifactObservationEvidence, astObservationEvidence, staticInferenceEvidence, unavailableAstEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
-import { resolveArtifactPathByContext, } from "./JavaScriptArtifactPathResolution.js";
+import { artifactPathResolutionProperties, resolveArtifactPathByContext, } from "./JavaScriptArtifactPathResolution.js";
+/** The per-file bound on retained inline HTML script locations. */
+export const HTML_INLINE_SCRIPT_LOCATION_COVERAGE_LIMIT = {
+    name: "html_inline_script_locations_per_file",
+    value: HTML_INLINE_SCRIPT_LOCATION_LIMIT,
+    unit: "items",
+};
+/** Count inline HTML script locations dropped by the per-file bound. */
+export const omittedHtmlInlineScriptLocations = (files) => files.reduce((omitted, { script_count, scripts }) => omitted + script_count - scripts.length, 0);
 /** Add a direct artifact-containment edge. */
 export const addArtifactContainsEdge = (context, input) => {
     context.accumulator.addEdge({
@@ -49,6 +58,12 @@ export const addStaticInferenceEdge = (context, input) => {
             range: input.range,
             operation: "map-static-relationship",
             coverage: input.coverage,
+            ...(input.confidence === undefined
+                ? {}
+                : { confidence: input.confidence }),
+            ...(input.limitations === undefined
+                ? {}
+                : { limitations: input.limitations }),
         }),
     });
 };
@@ -61,6 +76,8 @@ export const addUnavailableStaticParseScope = (context, input) => {
             {
                 label: `${input.file.path} parse scope`,
                 properties: {
+                    // Details come first so they cannot replace the gap's own fields.
+                    ...input.details,
                     path: input.file.path,
                     operation: input.operation,
                     limitation: input.limitation,
@@ -72,7 +89,9 @@ export const addUnavailableStaticParseScope = (context, input) => {
                     sha256: input.file.sha256,
                     path: input.file.path,
                     operation: input.operation,
-                    coverage: partialApplicationCoverage(input.limits ?? [], null),
+                    coverage: input.omittedCount !== undefined && input.omittedCount > 0
+                        ? truncatedApplicationCoverage(input.limits ?? [], input.omittedCount)
+                        : partialApplicationCoverage(input.limits ?? [], null),
                     limitation: input.limitation,
                 }),
             },
@@ -119,6 +138,7 @@ export const createElectronRoleNode = (context, input) => context.accumulator.ad
         {
             label: input.resolution.resolved_path ?? input.resolution.declared_path,
             properties: {
+                ...artifactPathResolutionProperties(input.resolution),
                 declared_path: input.resolution.declared_path,
                 resolution_context: input.resolution.resolution_context,
                 resolved_path: input.resolution.resolved_path,
@@ -179,11 +199,12 @@ export const moduleLookupKey = (path, runtime, moduleKey) => compositeKey([path,
 /** Deterministic key for one recovered bundler chunk inside a bundle asset. */
 export const chunkLookupKey = (path, runtime, chunkKey) => compositeKey([path, runtime, chunkKey]);
 /** Resolve a relative static specifier without escaping the artifact root. */
-export const resolveArtifactPath = (specifier, sourcePath, files, moduleKind) => resolveArtifactPathByContext({
+export const resolveArtifactPath = (specifier, sourcePath, files, moduleKind, directoryPaths) => resolveArtifactPathByContext({
     declaredPath: specifier,
     sourcePath,
     context: "module-specifier",
     files,
+    ...(directoryPaths === undefined ? {} : { directoryPaths }),
     ...(moduleKind === undefined ? {} : { moduleKind }),
 }).resolved_path;
 /** Locate the recovered module that owns a static finding. */