rea-agents 6.4.0 → 6.5.0

package/dist/browser/WebSourceMapFetcher.js

@@ -1,15 +1,20 @@
 import * as t from "@babel/types";
-import { decodeValidatedSourceMapLeaves, isBeforeSourceMapLeafStop, resolveSourceMapSource, } from "../javascript/sourceMaps/DecodedSourceMap.js";
+import { decodeValidatedSourceMapLeaves, isBeforeSourceMapLeafStop, } from "../javascript/sourceMaps/DecodedSourceMap.js";
 import { sanitizeBrowserUrl } from "../domain/browserObservation.js";
+import { AnalysisResourceConstraintError } from "../domain/analysisErrorCore.js";
 import { isUrlLikeModuleSpecifier } from "../domain/webBundleAnalyzerAst.js";
 import { analyzeParsedJavaScriptReferences } from "../domain/javascript/javascriptSemanticAnalysis.js";
 import { traverseJavaScriptAst } from "../domain/javascript/javascriptSemanticTraversal.js";
 import { parseJavaScriptSource } from "../domain/javascript/javascriptSourceParser.js";
+import { isTypeOnlyExportDeclaration, isTypeOnlyImportDeclaration, } from "../domain/javascript/javascriptModuleDeclaration.js";
+import { stringValue } from "../domain/javascript/javascriptStaticAnalysisHelpers.js";
 import { webSourceMapsSchema } from "../domain/webBundleAnalysis.js";
 import { createWebTextArtifact } from "../domain/webContentArtifact.js";
 import { safeParseJson } from "../domain/safeJson.js";
+import { sourceMapJsonText } from "../domain/sourceMapEnvelope.js";
+import { resolveJavaScriptSourceMapUrl } from "../domain/javascript/javascriptSourceMapPaths.js";
 import { jsonParts } from "../domain/jsonSerialization.js";
-import { inspectSourceMapValue, sourceMapJsonText, SourceMapFormatFailure, } from "../javascript/sourceMaps/SourceMapFormat.js";
+import { inspectSourceMapValue, SourceMapFormatFailure, } from "../javascript/sourceMaps/SourceMapFormat.js";
 import { WEB_SOURCE_MAP_LIMITS } from "../domain/webSourceLocation.js";
 // Source maps are normally fetched as a small part of a larger inspection.
 // Bound a stalled server to 30 seconds and bound raw map input retained for
@@ -28,7 +33,7 @@ export const fetchWebSourceMaps = async (requests, input, signal, host = { fetch
     const abortFromCaller = () => operationController.abort(signal?.reason);
     signal?.addEventListener("abort", abortFromCaller, { once: true });
     const operationSignal = operationController.signal;
-    const deadlineAt = Date.now() + (host.timeoutMs ?? SOURCE_MAP_FETCH_TIMEOUT_MS);
+    const deadlineAt = performance.now() + (host.timeoutMs ?? SOURCE_MAP_FETCH_TIMEOUT_MS);
     const budget = {
         retainedBytes: 0,
         deadlineAt,
@@ -46,23 +51,36 @@ export const fetchWebSourceMaps = async (requests, input, signal, host = { fetch
             const reservation = sourceMapFailureReservation(request) + 1;
             if (reservation >
                 SOURCE_MAP_OUTPUT_BYTES - budget.decodedRecords.expandedBytes) {
-                const unprocessed = requests.length - items.length;
-                limitation = `Source-map output budget was exhausted before processing ${String(unprocessed)} requested map${unprocessed === 1 ? "" : "s"}. Their results are unknown.`;
+                limitation = sourceMapOutputLimitation(requests.length - items.length);
                 break;
             }
             const expandedBytesBeforeItem = budget.decodedRecords.expandedBytes;
             budget.decodedRecords.expandedBytes += reservation;
-            if (operationSignal.aborted || Date.now() >= deadlineAt) {
+            if (operationSignal.aborted || performance.now() >= deadlineAt) {
                 items.push(emptySourceMapItem(request, "fetch_failed", "Source-map fetching exceeded its operation deadline."));
                 continue;
             }
             const item = await fetchOne(request, input, operationSignal, host, budget);
-            if (item.artifact === null)
+            if (item.artifact === null) {
+                const failureBytes = sourceMapFailureReservation(request, item.effective_url ?? null, item.limitation, item.status) + 1;
+                if (failureBytes > SOURCE_MAP_OUTPUT_BYTES - expandedBytesBeforeItem) {
+                    limitation = sourceMapOutputLimitation(requests.length - items.length);
+                    break;
+                }
                 budget.decodedRecords.expandedBytes =
-                    expandedBytesBeforeItem + reservation;
+                    expandedBytesBeforeItem + failureBytes;
+            }
             items.push(item);
         }
     }
+    catch (cause) {
+        if (signal?.aborted === true)
+            throw cause;
+        if (cause instanceof SourceMapFormatFailure && cause.reason === "limit")
+            limitation = sourceMapOutputLimitation(requests.length - items.length);
+        else
+            throw cause;
+    }
     finally {
         clearTimeout(timeout);
         signal?.removeEventListener("abort", abortFromCaller);
@@ -77,6 +95,7 @@ export const fetchWebSourceMaps = async (requests, input, signal, host = { fetch
         ...(limitation === undefined ? {} : { limitation }),
     });
 };
+const sourceMapOutputLimitation = (unprocessed) => `source-map output budget could not retain results for ${String(unprocessed)} requested map${unprocessed === 1 ? "" : "s"}. their results are unknown.`;
 const sourceMapsStatus = (items, omitted) => {
     const retained = items.filter(({ status }) => status === "included" || status === "partial").length;
     if (items.length === 0 || retained === 0)
@@ -115,14 +134,38 @@ class SourceMapRedirectLocationError extends Error {
 const fetchOne = async (request, input, signal, host, budget) => {
     if (!approvedUrl(request.fetchUrl, input.allowed_origins))
         return emptySourceMapItem(request, "policy_filtered", "Declared source-map URL is outside the approved exact origins.");
+    let effectiveUrl = null;
     try {
-        const fetched = await fetchFollowingApprovedRedirects(request.fetchUrl, input.allowed_origins, signal, host);
+        const fetched = await fetchFollowingApprovedRedirects(request.fetchUrl, input.allowed_origins, signal, host, (url) => {
+            effectiveUrl = url;
+        });
         if (fetched === undefined)
-            return emptySourceMapItem(request, "policy_filtered", "A source-map redirect left the approved exact origins.");
+            return emptySourceMapItem(request, "policy_filtered", "A source-map redirect left the approved exact origins.", effectiveUrl);
         const { response, fetchedUrl } = fetched;
+        try {
+            // Admit the resolution identity before reading or retaining its body.
+            consumeExpandedBytes(budget.decodedRecords, jsonBytes(fetchedUrl) - 4);
+        }
+        catch (cause) {
+            try {
+                await response.body?.cancel();
+            }
+            catch (cleanupCause) {
+                if (cause instanceof SourceMapFormatFailure && cause.reason === "limit")
+                    throw sourceMapOutputError(cause, {
+                        cause: new AggregateError([cause, cleanupCause], "Source-map response cleanup failed after its output exceeded capacity."),
+                        cleanup: {
+                            reason: "Source-map response cancellation failed after its output exceeded capacity.",
+                            resources: ["source-map-response"],
+                        },
+                    });
+                throw cause;
+            }
+            throw cause;
+        }
         if (!response.ok) {
             await response.body?.cancel();
-            return emptySourceMapItem(request, "fetch_failed", `Source-map server returned HTTP ${String(response.status)}.`);
+            return emptySourceMapItem(request, "fetch_failed", `Source-map server returned HTTP ${String(response.status)}.`, fetchedUrl);
         }
         checkOperation(undefined, signal, budget.deadlineAt);
         return normalizeSourceMap(request, await readBoundedText(response, budget, host.maxResponseBytes ?? SOURCE_MAP_RESPONSE_BYTES, signal), fetchedUrl, {
@@ -132,16 +175,20 @@ const fetchOne = async (request, input, signal, host, budget) => {
         });
     }
     catch (cause) {
+        if (cause instanceof AnalysisResourceConstraintError)
+            throw cause;
+        if (cause instanceof SourceMapFormatFailure && cause.reason === "limit")
+            throw cause;
         if (signal?.aborted === true &&
             !(signal.reason instanceof SourceMapDeadlineError))
             throw cause;
         if (cause instanceof SourceMapEncodingError)
-            return emptySourceMapItem(request, "invalid", cause.message);
+            return emptySourceMapItem(request, "invalid", cause.message, effectiveUrl);
         return emptySourceMapItem(request, "fetch_failed", cause instanceof SourceMapRedirectLocationError ||
             cause instanceof SourceMapSizeLimitError ||
             cause instanceof SourceMapDeadlineError
             ? cause.message
-            : "Source-map fetch or validation failed.");
+            : "Source-map fetch or validation failed.", effectiveUrl);
     }
 };
 /**
@@ -156,7 +203,7 @@ export const isFetchRedirectStatus = (status) => status === 301 ||
     status === 303 ||
     status === 307 ||
     status === 308;
-const fetchFollowingApprovedRedirects = async (initialUrl, allowedOrigins, signal, host) => {
+const fetchFollowingApprovedRedirects = async (initialUrl, allowedOrigins, signal, host, observeResponse) => {
     let current = initialUrl;
     const visited = new Set();
     for (;;) {
@@ -177,6 +224,7 @@ const fetchFollowingApprovedRedirects = async (initialUrl, allowedOrigins, signa
             referrerPolicy: "no-referrer",
             ...(signal === undefined ? {} : { signal }),
         }), signal);
+        observeResponse(current);
         if (signal !== undefined && signalIsAborted(signal)) {
             await response.body?.cancel(signal.reason).catch(() => undefined);
             throw signal.reason;
@@ -316,7 +364,7 @@ const promiseWithAbort = (promise, signal) => {
 const normalizeSourceMap = (request, text, fetchedUrl, context) => {
     const parsedJson = safeParseJson(sourceMapJsonText(text));
     if (!parsedJson.ok)
-        return emptySourceMapItem(request, "invalid", "Source-map JSON is not a version 3 map.");
+        return emptySourceMapItem(request, "invalid", "Source-map JSON is not a version 3 map.", fetchedUrl);
     const retainedBytesBeforeMap = context.budget.expandedBytes;
     try {
         const check = () => checkOperation(undefined, context.signal, context.deadlineAt);
@@ -327,8 +375,8 @@ const normalizeSourceMap = (request, text, fetchedUrl, context) => {
         });
         context.budget.expandedBytes =
             retainedBytesBeforeMap -
-                sourceMapFailureReservation(request) +
-                sourceMapSuccessReservation(request);
+                SOURCE_MAP_FAILURE_ENVELOPE_BYTES +
+                SOURCE_MAP_SUCCESS_ENVELOPE_BYTES;
         consumeExpandedBytes(context.budget, jsonBytes(text) +
             artifactMetadataBytes("application/source-map+json", text) -
             4);
@@ -340,15 +388,18 @@ const normalizeSourceMap = (request, text, fetchedUrl, context) => {
         const sourceJsonBytes = new Map();
         const nameJsonBytes = new Map();
         const originalSources = [];
+        let declarationIndex = 0;
         for (const { leaf, resolvedSources } of decoded) {
             for (const [index, rawSource] of leaf.map.sources.entries()) {
                 if ((index & 255) === 0)
                     check();
-                const resolved = resolvedSources[index] ?? rawSource ?? "[unknown-source]";
-                const sanitized = cachedSanitized(sourcesByRaw, resolved);
+                const resolved = rawSource === null ? null : (resolvedSources[index] ?? null);
+                const sanitized = resolved === null ? null : cachedSanitized(sourcesByRaw, resolved);
                 const content = leaf.map.sourcesContent?.[index] ?? null;
-                consumeExpandedBytes(context.budget, cachedJsonBytes(sourceJsonBytes, sanitized) +
-                    sourceEntryOverheadBytes() +
+                consumeExpandedBytes(context.budget, (sanitized === null
+                    ? 4
+                    : cachedJsonBytes(sourceJsonBytes, sanitized)) +
+                    sourceEntryOverheadBytes(index, declarationIndex) +
                     (originalSources.length === 0 ? 0 : 1) +
                     (content === null
                         ? 0
@@ -356,6 +407,8 @@ const normalizeSourceMap = (request, text, fetchedUrl, context) => {
                             artifactMetadataBytes(sourceMediaType(rawSource), content) -
                             4));
                 originalSources.push({
+                    source_index: index,
+                    declaration_index: declarationIndex++,
                     source: sanitized,
                     artifact: content === null
                         ? null
@@ -364,7 +417,10 @@ const normalizeSourceMap = (request, text, fetchedUrl, context) => {
             }
         }
         const mappings = [];
-        for (const { leaf, rows, resolvedSources } of decoded)
+        declarationIndex = 0;
+        for (const { leaf, rows, resolvedSources } of decoded) {
+            const declarationBase = declarationIndex;
+            declarationIndex += leaf.map.sources.length;
             for (const [line, row] of rows.entries()) {
                 if ((line & 255) === 0)
                     check();
@@ -374,16 +430,20 @@ const normalizeSourceMap = (request, text, fetchedUrl, context) => {
                     if (segment.length === 1)
                         continue;
                     const rawSource = leaf.map.sources[segment[1]];
-                    const resolved = resolvedSources[segment[1]] ?? rawSource ?? "[unknown-source]";
-                    const source = cachedSanitized(sourcesByRaw, resolved);
+                    if (rawSource === undefined)
+                        continue;
+                    const resolved = rawSource === null ? null : (resolvedSources[segment[1]] ?? null);
+                    const source = resolved === null ? null : cachedSanitized(sourcesByRaw, resolved);
                     const name = segment.length === 5 ? (leaf.map.names[segment[4]] ?? null) : null;
                     const generatedLine = leaf.offset.line + line + 1;
                     const generatedColumn = segment[0] + (line === 0 ? leaf.offset.column : 0);
-                    consumeExpandedBytes(context.budget, cachedJsonBytes(sourceJsonBytes, source) +
+                    consumeExpandedBytes(context.budget, (source === null ? 4 : cachedJsonBytes(sourceJsonBytes, source)) +
                         (name === null ? 4 : cachedJsonBytes(nameJsonBytes, name)) +
-                        mappingRowBytes(generatedLine, generatedColumn, segment[2] + 1, segment[3]) +
+                        mappingRowBytes(segment[1], declarationBase + segment[1], generatedLine, generatedColumn, segment[2] + 1, segment[3]) +
                         (mappings.length === 0 ? 0 : 1));
                     mappings.push({
+                        source_index: segment[1],
+                        declaration_index: declarationBase + segment[1],
                         generated_line: generatedLine,
                         generated_column: generatedColumn,
                         source,
@@ -393,12 +453,13 @@ const normalizeSourceMap = (request, text, fetchedUrl, context) => {
                     });
                 }
             }
+        }
         const modules = originalModuleEdges(originalSources, check, (edge) => consumeExpandedBytes(context.budget, Buffer.byteLength(JSON.stringify(edge)) + 1));
         check();
         if (modules.incomplete.length > 0)
             consumeExpandedBytes(context.budget, jsonBytes(`Module edges are incomplete: ${modules.incomplete.length} of ${originalSources.filter(({ artifact }) => artifact !== null).length} original sources could not be parsed in full (${modules.incomplete.join(", ")}).`) - 4);
         const parsed = {
-            ...sourceMapContext(request),
+            ...sourceMapContext(request, fetchedUrl),
             artifact: createWebTextArtifact(text, "application/source-map+json"),
             original_sources: originalSources,
             original_module_edges: modules.edges,
@@ -418,11 +479,11 @@ const normalizeSourceMap = (request, text, fetchedUrl, context) => {
         // reservation while keeping cumulative fetch and decoder-work accounting.
         context.budget.expandedBytes = retainedBytesBeforeMap;
         if (cause instanceof SourceMapFormatFailure && cause.reason === "limit")
-            return emptySourceMapItem(request, "fetch_failed", cause.message);
+            return emptySourceMapItem(request, "fetch_failed", cause.message, fetchedUrl);
         if (context.signal?.aborted === true ||
             cause instanceof SourceMapDeadlineError)
             throw cause;
-        return emptySourceMapItem(request, "invalid", "Source-map JSON mappings could not be decoded safely.");
+        return emptySourceMapItem(request, "invalid", "Source-map JSON mappings could not be decoded safely.", fetchedUrl);
     }
 };
 const originalModuleEdges = (sources, check, beforeEdge) => {
@@ -433,16 +494,21 @@ const originalModuleEdges = (sources, check, beforeEdge) => {
         check();
         if (source.artifact === null)
             continue;
-        const parsed = parseJavaScriptSource(source.artifact.text);
+        const sourceName = source.source;
+        if (sourceName === null) {
+            incomplete.push(`unnamed source at declaration ${String(source.declaration_index)}`);
+            continue;
+        }
+        const parsed = parseJavaScriptSource(source.artifact.text, sourceParserPath(sourceName));
         check();
         if (parsed === null) {
-            incomplete.push(source.source);
+            incomplete.push(sourceName);
             continue;
         }
         // A recovered program still yields the imports it did parse, but nodes
         // after an unrecoverable point are missing, so the edges are a subset.
         if (parsed.errors.length > 0)
-            incomplete.push(source.source);
+            incomplete.push(sourceName);
         let unboundRequires;
         traverseJavaScriptAst(parsed, {
             enter: (node) => {
@@ -450,25 +516,25 @@ const originalModuleEdges = (sources, check, beforeEdge) => {
                 const dependency = originalDependency(node);
                 if (dependency === null)
                     return;
-                const { kind, specifier } = dependency;
-                if (kind === "require" && t.isCallExpression(node)) {
+                const { kind, specifier, requireCallee } = dependency;
+                if (requireCallee !== undefined) {
                     unboundRequires ??= new Set(analyzeParsedJavaScriptReferences(parsed, "require")
                         .filter(({ role, resolution }) => role === "read" && resolution === "unbound")
                         .map(({ location }) => `${String(location.start.line)}:${String(location.start.column)}`));
-                    const location = node.callee.loc?.start;
+                    const location = requireCallee.loc?.start;
                     if (location === undefined ||
                         !unboundRequires.has(`${String(location.line)}:${String(location.column)}`))
                         return;
                 }
-                const key = `${source.source}\0${kind}\0${specifier}`;
+                const key = `${sourceName}\0${kind}\0${specifier}`;
                 if (seen.has(key))
                     return;
                 seen.add(key);
                 const edge = {
-                    from_source: source.source,
+                    from_source: sourceName,
                     kind,
                     specifier,
-                    resolved_source: resolveOriginalSource(specifier, source.source),
+                    resolved_source: resolveOriginalSource(specifier, sourceName),
                 };
                 beforeEdge(edge);
                 edges.push(edge);
@@ -477,12 +543,23 @@ const originalModuleEdges = (sources, check, beforeEdge) => {
     }
     return { edges, incomplete };
 };
+/** Select parser semantics from the source URL path, excluding query/fragment. */
+const sourceParserPath = (source) => {
+    try {
+        return new URL(source).pathname;
+    }
+    catch (cause) {
+        // Unresolved source identities can still carry a useful relative path.
+        void cause;
+        return source;
+    }
+};
 const checkOperation = (callerSignal, operationSignal, deadlineAt) => {
     if (callerSignal?.aborted === true)
         throw callerSignal.reason;
     if (operationSignal?.aborted === true)
         throw operationSignal.reason;
-    if (Date.now() >= deadlineAt)
+    if (performance.now() >= deadlineAt)
         throw new SourceMapDeadlineError();
 };
 const approvedUrl = (value, allowedOrigins) => {
@@ -499,12 +576,13 @@ const approvedUrl = (value, allowedOrigins) => {
         return false;
     }
 };
-const sourceMapContext = (request) => ({
+const sourceMapContext = (request, effectiveUrl = null) => ({
     script_key: request.scriptKey,
     declared_url: request.declaredUrl,
+    effective_url: effectiveUrl,
 });
-const emptySourceMapItem = (request, status, limitation) => ({
-    ...sourceMapContext(request),
+const emptySourceMapItem = (request, status, limitation, effectiveUrl = null) => ({
+    ...sourceMapContext(request, effectiveUrl),
     status,
     artifact: null,
     original_sources: [],
@@ -533,10 +611,12 @@ const preflightResolvedSourceBytes = (leaves, mapUrl, budget, resolvedByRoot, sa
         }
         for (const source of map.sources) {
             check();
-            const sourceKey = source ?? "";
+            if (source === null)
+                continue;
+            const sourceKey = source;
             let resolved = sourcesForRoot.get(sourceKey);
             if (resolved === undefined)
-                resolved = resolveSourceMapSource(source, map.sourceRoot, mapUrl);
+                resolved = resolveJavaScriptSourceMapUrl(source, map.sourceRoot, mapUrl);
             const bytes = Buffer.byteLength(resolved, "utf8");
             if (bytes > SOURCE_MAP_RESPONSE_BYTES - resolvedBytes)
                 throw resolvedSourceLimitFailure();
@@ -556,6 +636,7 @@ const consumeExpandedBytes = (budget, bytes) => {
     budget.expandedBytes += bytes;
 };
 const expandedOutputFailure = () => new SourceMapFormatFailure("limit", `Expanded source-map evidence exceeds the ${WEB_SOURCE_MAP_LIMITS.outputBytes / (1024 * 1024)} MiB public representation budget.`);
+const sourceMapOutputError = (cause, options) => new AnalysisResourceConstraintError("analyze_web_bundle", "transport", cause.message, { maximum_source_map_output_bytes: SOURCE_MAP_OUTPUT_BYTES }, { cause, ...options });
 const resolvedSourceLimitFailure = () => new SourceMapFormatFailure("limit", `Resolved source-map identities exceed the ${SOURCE_MAP_RESPONSE_BYTES / (1024 * 1024)} MiB decoder representation budget.`);
 const jsonBytes = (value) => {
     let bytes = 0;
@@ -570,34 +651,25 @@ const artifactMetadataBytes = (mediaType, text) => Buffer.byteLength(JSON.string
     charset: "utf-8",
     text: "",
 })) - 2;
-const sourceMapFailureReservation = (request) => {
-    const envelope = emptySourceMapItem({ ...request, declaredUrl: "", scriptKey: "" }, "fetch_failed", "x".repeat(SOURCE_MAP_FAILURE_LIMITATION_RESERVE));
-    return (Buffer.byteLength(JSON.stringify(envelope)) -
-        4 +
-        jsonBytes(request.declaredUrl) +
-        jsonBytes(request.scriptKey));
-};
-const sourceMapSuccessReservation = (request) => {
-    const context = sourceMapContext({
-        ...request,
-        declaredUrl: "",
-        scriptKey: "",
-    });
-    const envelope = {
-        ...context,
-        status: "included",
-        artifact: null,
-        original_sources: [],
-        original_module_edges: [],
-        mappings: [],
-        limitation: null,
-    };
-    return (Buffer.byteLength(JSON.stringify(envelope)) -
-        4 +
-        jsonBytes(request.declaredUrl) +
-        jsonBytes(request.scriptKey));
-};
-const sourceEntryOverheadBytes = () => Buffer.byteLength('{"source":,"artifact":null}');
+// Price invariant envelopes once using the producer's representation. Dynamic
+// identities keep their own charges when the map's envelope changes.
+const EMPTY_SOURCE_MAP_FAILURE = emptySourceMapItem({ scriptKey: "", declaredUrl: "", fetchUrl: "" }, "fetch_failed", "x".repeat(SOURCE_MAP_FAILURE_LIMITATION_RESERVE));
+const SOURCE_MAP_FAILURE_ENVELOPE_BYTES = Buffer.byteLength(JSON.stringify(EMPTY_SOURCE_MAP_FAILURE)) - 4;
+const SOURCE_MAP_SUCCESS_ENVELOPE_BYTES = Buffer.byteLength(JSON.stringify({
+    ...EMPTY_SOURCE_MAP_FAILURE,
+    status: "included",
+    limitation: null,
+})) - 4;
+const sourceMapFailureReservation = (request, effectiveUrl = null, limitation, status = "fetch_failed") => SOURCE_MAP_FAILURE_ENVELOPE_BYTES +
+    jsonBytes(request.declaredUrl) +
+    jsonBytes(request.scriptKey) +
+    (effectiveUrl === null ? 0 : jsonBytes(effectiveUrl) - 4) +
+    Math.max(0, (limitation === undefined ? 0 : jsonBytes(limitation)) -
+        SOURCE_MAP_FAILURE_LIMITATION_RESERVE -
+        2) +
+    jsonBytes(status) -
+    jsonBytes("fetch_failed");
+const sourceEntryOverheadBytes = (sourceIndex, declarationIndex) => Buffer.byteLength(`{"source_index":${String(sourceIndex)},"declaration_index":${String(declarationIndex)},"source":,"artifact":null}`);
 const cachedJsonBytes = (cache, value) => {
     const cached = cache.get(value);
     if (cached !== undefined)
@@ -614,7 +686,7 @@ const cachedSanitized = (cache, value) => {
     cache.set(value, sanitized);
     return sanitized;
 };
-const mappingRowBytes = (generatedLine, generatedColumn, originalLine, originalColumn) => Buffer.byteLength(`{"generated_line":${String(generatedLine)},"generated_column":${String(generatedColumn)},"source":,"original_line":${String(originalLine)},"original_column":${String(originalColumn)},"name":}`);
+const mappingRowBytes = (sourceIndex, declarationIndex, generatedLine, generatedColumn, originalLine, originalColumn) => Buffer.byteLength(`{"source_index":${String(sourceIndex)},"declaration_index":${String(declarationIndex)},"generated_line":${String(generatedLine)},"generated_column":${String(generatedColumn)},"source":,"original_line":${String(originalLine)},"original_column":${String(originalColumn)},"name":}`);
 const resolveOriginalSource = (specifier, base) => {
     if (!isUrlLikeModuleSpecifier(specifier))
         return null;
@@ -637,15 +709,26 @@ const originalDependency = (node) => {
     if (t.isImportDeclaration(node) ||
         t.isExportAllDeclaration(node) ||
         t.isExportNamedDeclaration(node))
-        return node.source === null || node.source === undefined
+        return node.source === null ||
+            node.source === undefined ||
+            (t.isImportDeclaration(node)
+                ? isTypeOnlyImportDeclaration(node)
+                : isTypeOnlyExportDeclaration(node))
             ? null
             : { kind: "static_import", specifier: node.source.value };
-    if (t.isImportExpression(node) && t.isStringLiteral(node.source))
-        return { kind: "dynamic_import", specifier: node.source.value };
-    if (t.isCallExpression(node) &&
-        t.isIdentifier(node.callee, { name: "require" }) &&
-        t.isStringLiteral(node.arguments[0]))
-        return { kind: "require", specifier: node.arguments[0].value };
+    if (t.isImportExpression(node)) {
+        const specifier = stringValue(node.source);
+        return specifier === undefined
+            ? null
+            : { kind: "dynamic_import", specifier };
+    }
+    if ((t.isCallExpression(node) || t.isOptionalCallExpression(node)) &&
+        t.isIdentifier(node.callee, { name: "require" })) {
+        const specifier = stringValue(node.arguments[0]);
+        return specifier === undefined
+            ? null
+            : { kind: "require", specifier, requireCallee: node.callee };
+    }
     // `import x = require("m")` is only legal at module top level and always
     // refers to the host loader, so it needs no unbound-`require` check. The
     // `moduleReference` is an entity name for a local alias instead, which

package/dist/browser/assets/LocalWebScriptArtifacts.js

@@ -1,6 +1,7 @@
 import { lstat, realpath } from "node:fs/promises";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { ArtifactReaderFailure } from "../../artifacts/ArtifactReader.js";
+import { ArtifactResourceScope } from "../../artifacts/ArtifactResourceScope.js";
 import { readStableArtifact } from "../../artifacts/readStableArtifact.js";
 import { normalizeArtifactPath } from "../../artifacts/ArtifactPaths.js";
 import { AnalysisCapabilityUnavailableError } from "../../domain/analysisErrorCore.js";
@@ -10,16 +11,34 @@ import { decodeWebArtifact, readWebArtifactJson, webArtifactReadError, WebArtifa
 /** Read one digest-verified captured source under the manifest's current location. */
 export class LocalWebScriptArtifacts {
     operation;
-    constructor(operation) {
+    resources;
+    constructor(operation, resources = new ArtifactResourceScope()) {
         this.operation = operation;
+        this.resources = resources;
+    }
+    close() {
+        return this.resources.close();
     }
     /** Read the selected source; relocated exports retain their reported original root. */
     async load(input, options) {
+        try {
+            return await this.resources.run(() => this.#load(input, options));
+        }
+        catch (cause) {
+            return err(webArtifactReadError(cause, {
+                operation: this.operation,
+                field: ["manifest_path"],
+                targetPath: input.manifest_path,
+                callerSelected: true,
+            }, options?.signal));
+        }
+    }
+    async #load(input, options) {
         let field = ["manifest_path"];
         let targetPath = input.manifest_path;
         let callerSelected = true;
         try {
-            const manifestBytes = await readWebArtifactJson(input.manifest_path, 32 * 1024 * 1024, options?.signal);
+            const manifestBytes = await readWebArtifactJson(input.manifest_path, 32 * 1024 * 1024, options?.signal, this.resources);
             const manifest = webScriptExportManifestSchema.parse(manifestBytes.value);
             field = ["script_index"];
             const selected = manifest.scripts[input.script_index];
@@ -32,12 +51,14 @@ export class LocalWebScriptArtifacts {
             const portable = normalizeArtifactPath(selected.content.relative_path);
             if (portable !== selected.content.relative_path)
                 throw new ArtifactReaderFailure("path", `Selected source path changes during normalization: ${selected.content.relative_path}`);
+            if (process.platform === "win32" && portable.includes("\\"))
+                throw new ArtifactReaderFailure("path", `Windows source path cannot contain backslashes as literal name characters: ${JSON.stringify(portable)}`);
             const root = resolve(dirname(input.manifest_path));
             const sourcePath = join(root, "files", portable);
             targetPath = sourcePath;
             callerSelected = false;
             await assertContained(root, sourcePath);
-            const sourceBytes = await readStableArtifact(sourcePath, 16 * 1024 * 1024, options?.signal);
+            const sourceBytes = await readStableArtifact(sourcePath, 16 * 1024 * 1024, options?.signal, undefined, this.resources);
             await assertContained(root, sourcePath);
             if (sourceBytes.sha256 !== selected.content.sha256 ||
                 sourceBytes.bytes.length !== selected.content.bytes)

package/dist/browser/assets/PublishWebScripts.js

@@ -6,6 +6,7 @@ import { ArtifactResourceScope } from "../../artifacts/ArtifactResourceScope.js"
 import { DESTINATION_CASE_COLLISION_PREFIX } from "../../artifacts/ArtifactPaths.js";
 import { SafeOutputTree } from "../../artifacts/SafeOutputTree.js";
 import { SafeOutputTreeCreationFailure } from "../../artifacts/SafeOutputTreeCreationFailure.js";
+import { PLAYWRIGHT_RESPONSE_BODY_PROVENANCE_LIMITATION } from "../../domain/browserNetworkEvidence.js";
 import { webScriptExportManifestSchema, webScriptExportResultSchema, } from "../../domain/webScriptExport.js";
 import { planWebScriptExport, } from "../../domain/webScriptExportPlan.js";
 import { WebScriptExportError } from "../../domain/webScriptExportError.js";
@@ -14,11 +15,20 @@ const LIMITATIONS = [
     "Ordinary unambiguous URL paths preserve relative module layouts by origin, including case-distinct spellings. Query variants, exact path collisions, file/directory prefixes, inline sources, and unrepresentable paths are isolated. A case-distinct pair is isolated only when the destination filesystem cannot store both spellings; the record names that pair. Browser module relationships of isolated paths remain unknown.",
     "Local JavaScript analysis does not implement browser import maps, root-relative URL resolution, remote URL loading, or browser runtime behavior. It may strip import queries and fragments; isolated variants are not canonical targets.",
     "Source-map declarations are retained as metadata. No source maps or missing dependencies are fetched or reconstructed.",
-    "Captured response bytes are browser-decoded bytes; Debugger sources are the exposed text encoded as UTF-8. Redacted bytes are exported exactly as retained, and may no longer parse as JavaScript.",
+    "Scenario response bytes preserve the output of Playwright's Response.body() API; any source-body provenance caveat from the capture is retained in this manifest. Debugger sources are the exposed text encoded as UTF-8. Redacted bytes are exported exactly as retained, and may no longer parse as JavaScript.",
 ];
 /** Exclusively publish verified bytes and a manifest, rolling back partial work. */
 export const publishWebScripts = async (input, capture, captureSha256, options) => options.resources.run(async () => {
     const planned = planWebScriptExport(capture.scripts);
+    const scenarioResponseBodyCaptured = capture.kind === "browser-scenario" &&
+        capture.scripts.some((script) => script.source.kind === "scenario-response" &&
+            script.content.state === "captured" &&
+            (script.content.representation === "playwright-response-body-bytes" ||
+                script.content.representation === "browser-decoded-response-bytes"));
+    const responseBodyProvenanceLimitations = scenarioResponseBodyCaptured &&
+        !capture.limitations.includes(PLAYWRIGHT_RESPONSE_BODY_PROVENANCE_LIMITATION)
+        ? [PLAYWRIGHT_RESPONSE_BODY_PROVENANCE_LIMITATION]
+        : [];
     let tree;
     let result;
     try {
@@ -42,6 +52,7 @@ export const publishWebScripts = async (input, capture, captureSha256, options)
             scripts: records,
             limitations: [
                 ...capture.limitations,
+                ...responseBodyProvenanceLimitations,
                 ...LIMITATIONS,
                 ...(records.some(({ content }) => content.state === "exported")
                     ? []
@@ -62,7 +73,7 @@ export const publishWebScripts = async (input, capture, captureSha256, options)
         });
         await tree.write("manifest.json", Readable.from([bytes]), { sha256: digest, bytes: bytes.byteLength }, options.signal);
         options.signal?.throwIfAborted();
-        await tree.commit();
+        await tree.commit(options.signal);
         return result;
     }
     catch (cause) {

package/dist/browser/assets/ScenarioScriptCapture.js

@@ -52,7 +52,8 @@ const projectBody = (body, ambiguous) => {
         return unavailable(body.reason, body.message);
     if (body.state !== "captured")
         return unavailable(body.state, "No selected, completed script response bytes were retained for this request.");
-    if (body.representation !== "browser-decoded-response-bytes")
+    if (body.representation !== "playwright-response-body-bytes" &&
+        body.representation !== "browser-decoded-response-bytes")
         return unavailable("unsupported-body-representation", `Captured representation ${body.representation} is not script response bytes.`);
     return {
         state: "captured",