rea-agents 6.4.0 → 6.7.0

package/dist/application/javascript/JavaScriptApplicationService.js

@@ -9,7 +9,7 @@ import { err, ok } from "../../domain/result.js";
 import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
 import { createOwnedJavaScriptApplicationEvidenceCooperatively } from "./JavaScriptApplicationEvidence.js";
 import { assertJavaScriptAnalysisActive, checkpointJavaScriptAnalysis, completeJavaScriptAnalysisSteps, } from "./JavaScriptAnalysisControl.js";
-import { reconstructJavaScriptArtifact } from "./JavaScriptArtifactReconstruction.js";
+import { reconstructJavaScriptArtifact, } from "./JavaScriptArtifactReconstruction.js";
 import { JAVASCRIPT_APPLICATION_PROVIDER } from "../InvestigationProviders.js";
 const OPERATION = "analyze_javascript_application";
 /** Statically analyze one local JavaScript/Electron application. */
@@ -21,6 +21,9 @@ export const analyzeJavaScriptApplication = async (rawInput, scope, options = {}
 };
 /** Analyze input already parsed by a trusted adapter boundary. */
 export const analyzeJavaScriptApplicationValidated = async (input, scope, options = {}) => {
+    let reconstructed;
+    let result;
+    let evidence;
     try {
         assertJavaScriptAnalysisActive(options.signal);
         await options.progress?.report({
@@ -30,17 +33,7 @@ export const analyzeJavaScriptApplicationValidated = async (input, scope, option
             message: "Inventorying and parsing application artifacts",
         });
         await checkpointJavaScriptAnalysis(options.signal);
-        const reconstructed = await reconstructJavaScriptArtifact({
-            input_path: input.input_path,
-            format: input.format,
-            integrity_policy: input.integrity_policy,
-            ...(input.max_heap_mb === undefined
-                ? {}
-                : { max_heap_mb: input.max_heap_mb }),
-            ...(input.analysis_timeout_ms === undefined
-                ? {}
-                : { analysis_timeout_ms: input.analysis_timeout_ms }),
-        }, scope, options.signal, options.progress);
+        reconstructed = await reconstructJavaScriptArtifact(input, scope, options.signal, options.progress);
         const { electron_summary: summary, ...application } = reconstructed;
         await options.progress?.report({
             phase: "validate_javascript_application_result",
@@ -49,7 +42,7 @@ export const analyzeJavaScriptApplicationValidated = async (input, scope, option
             message: "Validating result metadata and cross-graph bindings",
         });
         await checkpointJavaScriptAnalysis(options.signal);
-        const result = await completeJavaScriptAnalysisSteps(parseOwnedJavaScriptApplicationAnalysisSteps({
+        result = await completeJavaScriptAnalysisSteps(parseOwnedJavaScriptApplicationAnalysisSteps({
             ...application,
             summary,
             limitations: reconstructed.graph.limitations,
@@ -61,7 +54,7 @@ export const analyzeJavaScriptApplicationValidated = async (input, scope, option
             message: "Creating and hashing application analysis Evidence",
         });
         await checkpointJavaScriptAnalysis(options.signal);
-        const evidence = await createOwnedJavaScriptApplicationEvidenceCooperatively(input, result, options.signal, options.progress);
+        evidence = await createOwnedJavaScriptApplicationEvidenceCooperatively(input, result, options.signal, options.progress);
         await checkpointJavaScriptAnalysis(options.signal);
         await options.progress?.report({
             phase: "analyze_javascript_application",
@@ -74,6 +67,28 @@ export const analyzeJavaScriptApplicationValidated = async (input, scope, option
         return ok(evidence);
     }
     catch (cause) {
+        if (cause instanceof ArtifactReaderFailure &&
+            cause.reason === "cancelled" &&
+            reconstructed !== undefined) {
+            try {
+                if (result === undefined) {
+                    const { electron_summary: summary, ...application } = reconstructed;
+                    result = await completeJavaScriptAnalysisSteps(parseOwnedJavaScriptApplicationAnalysisSteps({
+                        ...application,
+                        summary,
+                        limitations: reconstructed.graph.limitations,
+                    }));
+                }
+                evidence ??=
+                    await createOwnedJavaScriptApplicationEvidenceCooperatively(input, result);
+                return err(artifactFailureToOperationError(cause).retainPartialObservation(evidence));
+            }
+            catch (completionCause) {
+                // A validation or Evidence failure while finishing the partial result
+                // remains the primary failure instead of being hidden by cancellation.
+                cause = completionCause;
+            }
+        }
         // Preserve execution constraints and their completed partial Evidence.
         if (cause instanceof AnalysisError)
             return err(cause);

package/dist/application/javascript/JavaScriptApplicationWorkflowService.js

@@ -1,6 +1,5 @@
 import { z } from "zod";
 import { AnalysisProtocolError } from "../../domain/analysisErrorCore.js";
-import {} from "../../domain/analysisErrorBase.js";
 import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
 import { compareJavaScriptApplicationVersions } from "../../domain/javascript/javascriptApplicationVersionComparison.js";
 import { compareApplicationVersionsInputSchema, applicationVersionIdentitiesSchema, } from "../../domain/javascript/javascriptApplicationVersionComparisonSchemas.js";

package/dist/application/javascript/JavaScriptArtifactAnalysis.js

@@ -1,13 +1,15 @@
 import { createHash } from "node:crypto";
+import { moduleResolutionModeForJavaScriptReference } from "../../domain/javascript/javascriptModuleResolutionMode.js";
 import { setImmediate } from "node:timers/promises";
-import { resolveJavaScriptSourceMapReference } from "../../domain/javascript/javascriptSourceMapPaths.js";
+import { resolveJavaScriptSourceMapReferences } from "../../domain/javascript/javascriptSourceMapPaths.js";
 import { analyzeParsedJavaScriptStaticSourceSteps } from "../../domain/javascript/javascriptStaticAnalysis.js";
-import { analyzeParsedJavaScriptSemanticsSteps, classifyParsedJavaScriptOpenReceiversSteps, } from "../../domain/javascript/javascriptSemanticAnalysis.js";
+import { analyzeParsedJavaScriptSemanticsSteps } from "../../domain/javascript/javascriptSemanticAnalysis.js";
 import { projectJavaScriptModuleSemantics } from "../../domain/javascript/javascriptModuleSemanticIr.js";
 import { parseJavaScriptSource } from "../../domain/javascript/javascriptSourceParser.js";
 import { hasValidSourceMapContents } from "../../domain/sourceMapContents.js";
-import { flattenSourceMapLeaves } from "../../domain/sourceMapEnvelope.js";
+import { flattenSourceMapLeaves, sourceMapJsonText, } from "../../domain/sourceMapEnvelope.js";
 import { failedJavaScriptStaticAnalysis } from "../../domain/javascript/javascriptStaticAnalysisHelpers.js";
+import { javascriptArtifactAnalysisScopes } from "./JavaScriptArtifactAnalysisTypes.js";
 import { analyzeJavaScriptJsonModule } from "./JavaScriptJsonModules.js";
 import { completeJavaScriptAnalysisSteps } from "./JavaScriptAnalysisControl.js";
 import { htmlArtifactReferences } from "../../domain/javascript/htmlArtifactReferences.js";
@@ -47,12 +49,23 @@ export const analyzeAndProjectJavaScriptArtifactFiles = async (fileSet, projectS
 export const analyzeAndAdoptJavaScriptArtifactFiles = async (fileSet, worker, projection, beforeFile, signal) => {
     const state = emptyArtifactAnalysis();
     let interruption = null;
-    for (const [index, file] of fileSet.files.entries()) {
+    const selectedFileCount = fileSet.files.length - (fileSet.source_selection?.unselected_files ?? 0);
+    let selectedFileIndex = 0;
+    for (const file of fileSet.files) {
+        let analysisStarted = false;
         try {
             await setImmediate();
-            await beforeFile(file, index, fileSet.files.length);
+            if (classifyOutsideAnalysisScope(file, state, projection)) {
+                if (signal?.aborted === true) {
+                    interruption = new AnalysisCancelledError("analyze_javascript_application");
+                    break;
+                }
+                continue;
+            }
             if (signal?.aborted === true)
                 throw new AnalysisCancelledError("analyze_javascript_application");
+            await beforeFile(file, selectedFileIndex++, selectedFileCount);
+            analysisStarted = true;
             if (file.kind !== "javascript" || !file.text.included) {
                 const steps = analyzeArtifactFileSteps(file, {
                     state,
@@ -64,7 +77,7 @@ export const analyzeAndAdoptJavaScriptArtifactFiles = async (fileSet, worker, pr
                 await completeJavaScriptAnalysisSteps(steps, signal);
                 continue;
             }
-            const result = await worker.analyze(file, projection.remainingFileNodeBudget(), signal);
+            const result = await worker.analyze(file, projection.remainingFileCapacity(), signal);
             const facts = result.ok ? result.value : result.error;
             const applicationProjectionFailure = facts.applicationProjectionFailure;
             if (facts.projection !== null)
@@ -78,6 +91,8 @@ export const analyzeAndAdoptJavaScriptArtifactFiles = async (fileSet, worker, pr
             const failure = error === null
                 ? undefined
                 : {
+                    scope: javascriptArtifactAnalysisScopes.javascript,
+                    status: "interrupted",
                     reason: `${file.path}: ${error.message}`,
                     error: projectAnalysisError(error),
                     limits,
@@ -128,15 +143,22 @@ export const analyzeAndAdoptJavaScriptArtifactFiles = async (fileSet, worker, pr
                         ? cause
                         : null;
             if (interruption !== null) {
+                const scope = javascriptArtifactAnalysisScopes[file.kind];
                 state.files.push({
                     file,
                     javascript: null,
                     semantic: null,
-                    analysis_failure: {
-                        reason: `${file.path}: ${interruption.message}`,
-                        error: projectAnalysisError(interruption),
-                        limits: null,
-                    },
+                    ...(scope === null
+                        ? {}
+                        : {
+                            analysis_failure: {
+                                scope,
+                                status: analysisStarted ? "interrupted" : "not-started",
+                                reason: `${file.path}: ${interruption.message}`,
+                                error: projectAnalysisError(interruption),
+                                limits: null,
+                            },
+                        }),
                 });
                 projection.recordUnavailableFile(file, interruption.message, null, "incomplete-module");
             }
@@ -154,20 +176,30 @@ export const analyzeAndAdoptJavaScriptArtifactFiles = async (fileSet, worker, pr
                     ? { worker_timeout_ms: interruption.timeoutMs }
                     : null,
         };
+        // This interruption has one cause. Share its immutable failure per phase
+        // rather than copying it for every unvisited source in a large bundle.
+        const failures = new Map();
         for (const file of fileSet.files) {
             if (analyzedPaths.has(file.path))
                 continue;
+            if (classifyOutsideAnalysisScope(file, state, projection))
+                continue;
+            const scope = javascriptArtifactAnalysisScopes[file.kind];
+            let unavailable = scope === null ? undefined : failures.get(scope);
+            if (scope !== null && unavailable === undefined) {
+                unavailable = { ...failure, scope, status: "not-started" };
+                failures.set(scope, unavailable);
+            }
             state.files.push({
                 file,
                 javascript: null,
                 semantic: null,
-                analysis_failure: failure,
+                ...(unavailable === undefined ? {} : { analysis_failure: unavailable }),
             });
-            if (file.kind === "javascript")
-                projection.recordUnavailableFile(file, failure.reason, failure.limits, interruption instanceof AnalysisResourceConstraintError ||
-                    interruption instanceof AnalysisTimeoutError
-                    ? "resource-limit"
-                    : "incomplete-module");
+            projection.recordUnavailableFile(file, failure.reason, failure.limits, interruption instanceof AnalysisResourceConstraintError ||
+                interruption instanceof AnalysisTimeoutError
+                ? "resource-limit"
+                : "incomplete-module");
         }
     }
     return { analysis: finalizeArtifactAnalysis(state), interruption };
@@ -188,23 +220,35 @@ const finalizeArtifactAnalysis = (state) => {
         packages: state.packages,
         json_modules: state.jsonModules,
         html_scripts: state.htmlScripts,
+        html_inline_scripts: state.htmlInlineScripts,
         source_maps: state.sourceMaps,
         visited_ast_nodes: state.visitedNodes,
-        findings: state.findings + state.htmlScripts.length,
+        findings: state.findings +
+            state.htmlScripts.length +
+            state.htmlInlineScripts.reduce((count, { script_count }) => count + script_count, 0),
         modules: state.modules,
         parse_failures: state.parseFailures,
         limitations: [
             "JavaScript and HTML were parsed as inert text; bundle bootstrap code was never executed.",
             "Static paths and relationships may remain unresolved when expressions are dynamic or obfuscated.",
+            ...state.htmlInlineScripts.map(htmlInlineScriptLimitation),
             ...state.files.flatMap(({ analysis_failure, application_projection_failure }) => [analysis_failure, application_projection_failure].flatMap((failure) => (failure === undefined ? [] : [failure.reason]))),
         ],
     };
 };
 function* analyzeArtifactFileSteps(file, context) {
     const { state } = context;
+    if (classifyOutsideAnalysisScope(file, state))
+        return;
     addStructuredObservations(file, state);
-    if (file.kind === "html" && file.text.included)
-        state.htmlScripts.push(...parseHtmlScripts(file.path, file.text.value));
+    if (file.kind === "html" && file.text.included) {
+        const html = parseHtmlScripts(file.path, file.text.value);
+        // Append without spreading: argument count is bounded by the engine.
+        for (const script of html.scripts)
+            state.htmlScripts.push(script);
+        if (html.inlineScripts !== null)
+            state.htmlInlineScripts.push(html.inlineScripts);
+    }
     if (file.kind === "source-map")
         addSourceMap(file, context);
     if (file.kind !== "javascript" || !file.text.included) {
@@ -219,12 +263,11 @@ function* analyzeArtifactFileSteps(file, context) {
         state.parseFailures += 1;
         return;
     }
-    const openReceiverFacts = yield* classifyParsedJavaScriptOpenReceiversSteps(parsed);
-    const analysis = yield* analyzeParsedJavaScriptStaticSourceSteps(file.text.value, parsed, openReceiverFacts);
+    const analysis = yield* analyzeParsedJavaScriptStaticSourceSteps(file.text.value, parsed);
     const staticFindings = findingCount(analysis);
     yield;
     const semantics = analysis.parse_status === "complete" || analysis.parse_status === "partial"
-        ? yield* analyzeParsedJavaScriptSemanticsSteps(parsed)
+        ? yield* analyzeParsedJavaScriptSemanticsSteps(parsed, moduleResolutionModeForJavaScriptReference(file.path, "static-import"))
         : null;
     const projected = semantics === null
         ? null
@@ -240,6 +283,13 @@ function* analyzeArtifactFileSteps(file, context) {
     if (analysis.parse_status === "failed")
         state.parseFailures += 1;
 }
+const classifyOutsideAnalysisScope = (file, state, projection) => {
+    if (file.text.included || file.text.reason !== "outside-analysis-scope")
+        return false;
+    state.files.push({ file, javascript: null, semantic: null });
+    projection?.recordUnavailableFile(file, "Source was not analyzed because it is outside the caller-selected source_paths.", null, "incomplete-module");
+    return true;
+};
 const addSourceMap = (file, context) => {
     const sourceMap = parseSourceMap(file);
     context.state.sourceMaps.push(sourceMap);
@@ -249,6 +299,7 @@ const emptyArtifactAnalysis = () => ({
     packages: [],
     jsonModules: [],
     htmlScripts: [],
+    htmlInlineScripts: [],
     sourceMaps: [],
     visitedNodes: 0,
     findings: 0,
@@ -306,49 +357,69 @@ const unavailablePackage = (file, limitation) => ({
     limitation,
 });
 const parseHtmlScripts = (path, text) => {
-    const { scripts, baseHref } = htmlArtifactReferences(text);
-    return scripts.map(({ scriptPath, startOffset, endOffset }) => ({
-        html_path: path,
-        script_path: scriptPath,
-        base_href: baseHref,
-        location: rangeForOffsets(text, startOffset, endOffset),
-    }));
+    const { scripts, inlineScripts, inlineScriptCount, baseHref } = htmlArtifactReferences(text);
+    return {
+        scripts: scripts.map(({ scriptPath, location }) => ({
+            html_path: path,
+            script_path: scriptPath,
+            base_href: baseHref,
+            location,
+        })),
+        inlineScripts: inlineScriptCount === 0
+            ? null
+            : {
+                path,
+                script_count: inlineScriptCount,
+                scripts: inlineScripts.map(({ scriptType, location }) => ({
+                    script_type: scriptType,
+                    location,
+                })),
+            },
+    };
 };
 const parseSourceMap = (file) => {
     if (!file.text.included)
         return unavailableSourceMap(file);
     let value;
     try {
-        value = JSON.parse(file.text.value);
+        value = JSON.parse(sourceMapJsonText(file.text.value));
     }
     catch (cause) {
         void cause;
         return invalidSourceMap(file, "Source map is not valid JSON.");
     }
-    const maps = flattenSourceMaps(value);
+    const maps = flattenSourceMapLeaves(value);
     if (maps === undefined)
         return invalidSourceMap(file, "Source map is not a version 3 map.");
     return collectSourceMapOriginals(file, maps);
 };
 const collectSourceMapOriginals = (file, maps) => {
     const sources = [];
+    let declarationIndex = 0;
     for (const map of maps) {
         const names = map.sources;
         if (!Array.isArray(names))
             return invalidSourceMap(file, "Source map has no sources array.");
         const contents = map.sourcesContent;
-        if (!hasValidSourceMapContents(names.length, contents))
-            return invalidSourceMap(file, "Source map sourcesContent must contain one string or null entry per source.");
+        if (!hasValidSourceMapContents(contents))
+            return invalidSourceMap(file, "Source map sourcesContent must be an array of strings or null entries.");
         if (map.sourceRoot != null && typeof map.sourceRoot !== "string")
             return invalidSourceMap(file, "Source map sourceRoot must be a string or null.");
         const root = typeof map.sourceRoot === "string" ? map.sourceRoot : null;
-        for (const [index, raw] of names.entries()) {
-            if (typeof raw !== "string")
+        const sourceNames = [];
+        for (const raw of names) {
+            if (raw !== null && typeof raw !== "string")
                 return invalidSourceMap(file, "Source map contains a non-string source name.");
+            sourceNames.push(raw);
+        }
+        const references = resolveJavaScriptSourceMapReferences(sourceNames, root, file.path);
+        for (const [index, reference] of references.entries()) {
             const rawContent = Array.isArray(contents) ? contents[index] : undefined;
             const content = typeof rawContent === "string" ? rawContent : null;
             sources.push({
-                reference: resolveJavaScriptSourceMapReference(raw, root, file.path),
+                source_index: index,
+                declaration_index: declarationIndex++,
+                reference,
                 content,
                 content_sha256: content === null ? null : sha256(content),
             });
@@ -362,6 +433,17 @@ const collectSourceMapOriginals = (file, maps) => {
         limitation: null,
     };
 };
+/** Name the HTML file and lines whose inline JavaScript was not analyzed. */
+export const htmlInlineScriptLimitation = ({ path, script_count: count, scripts, }) => {
+    const lines = scripts
+        .slice(0, HTML_INLINE_SCRIPT_LIMITATION_LINES)
+        .map(({ location }) => String(location.start.line));
+    const unnamed = count - lines.length;
+    const one = count === 1;
+    return `${path} has ${String(count)} inline JavaScript ${one ? "body" : "bodies"} starting at line${one ? "" : "s"} ${lines.join(", ")}${unnamed > 0 ? ` and ${String(unnamed)} more` : ""} that ${one ? "was" : "were"} not analyzed; endpoints, storage, imports and other facts in ${one ? "it" : "them"} are absent from the evidence.`;
+};
+// Keep the agent-facing limitation short; the unknown scope keeps the ranges.
+const HTML_INLINE_SCRIPT_LIMITATION_LINES = 10;
 const unavailableSourceMap = (file) => {
     if (file.text.included)
         throw new TypeError("Expected unavailable source-map text");
@@ -373,10 +455,6 @@ const unavailableSourceMap = (file) => {
         limitation: "Source-map text could not be decoded as UTF-8.",
     };
 };
-const flattenSourceMaps = (root) => {
-    const leaves = flattenSourceMapLeaves(root);
-    return leaves === undefined ? undefined : [...leaves];
-};
 const invalidSourceMap = (file, limitation) => ({
     path: file.path,
     sha256: file.sha256,
@@ -396,14 +474,6 @@ const findingCount = (analysis) => analysis.references.length +
     analysis.electron.sender_validations.length +
     analysis.electron.utility_processes.length +
     analysis.electron.native_addon_bindings.length;
-const rangeForOffsets = (text, start, end) => ({
-    start: pointForOffset(text, start),
-    end: pointForOffset(text, end),
-});
-const pointForOffset = (text, offset) => {
-    const lines = text.slice(0, offset).split(/\r\n|\r|\n/u);
-    return { line: lines.length, column: lines.at(-1)?.length ?? 0 };
-};
 const optionalString = (value) => typeof value === "string" && value.length > 0 ? value : null;
 const sha256 = (value) => createHash("sha256").update(value).digest("hex");
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);

package/dist/application/javascript/JavaScriptArtifactAnalysisTypes.js

@@ -1 +1,30 @@
-export {};
+/** Applicable processing of inventoried files; native bytes remain metadata-only. */
+export const javascriptArtifactAnalysisScopes = {
+    javascript: {
+        operation: "analyze-javascript-source",
+        authority: "ast-static-analysis",
+    },
+    "package-json": {
+        operation: "parse-package-json",
+        authority: "artifact-bytes",
+    },
+    json: { operation: "parse-json-module", authority: "artifact-bytes" },
+    html: {
+        operation: "parse-html-script-references",
+        authority: "artifact-bytes",
+    },
+    "source-map": {
+        operation: "parse-local-source-map",
+        authority: "artifact-bytes",
+    },
+    "native-addon": null,
+};
+/**
+ * A JavaScript source selected for analysis whose worker produced no facts.
+ * The analysis failure carries the reason; the null parse status alone reads
+ * as "nothing there" instead of "not analyzed".
+ */
+export const isSkippedJavaScriptAnalysis = (entry) => entry.file.kind === "javascript" &&
+    entry.file.text.included &&
+    entry.javascript === null &&
+    entry.analysis_failure !== undefined;

package/dist/application/javascript/JavaScriptArtifactGraphAccumulator.js

@@ -1,32 +1,53 @@
 import { createJavaScriptApplicationEdge, createJavaScriptApplicationNode, } from "../../domain/javascript/javascriptApplicationGraph.js";
-/** Deduplicate graph entities while retaining distinct evidence observations. */
+import { compareUnicodeCodePoints } from "../../domain/unicodeCodePointOrder.js";
+/**
+ * Own live construction nodes and deduplicate their evidence observations.
+ * Consumers retain references but must not mutate the owned observations;
+ * nodes() finalizes their canonical order before graph validation/output.
+ */
 export class JavaScriptArtifactGraphAccumulator {
     #nodes = new Map();
     #edges = new Map();
-    /** Create or merge one canonical node, retaining a stable live construction reference. */
+    /** Merge observations into a stable live node; order is finalized by nodes(). */
     addNode(input) {
         const created = createJavaScriptApplicationNode(displayableNode(input));
         const existing = this.#nodes.get(created.node_id);
         if (existing === undefined) {
-            this.#nodes.set(created.node_id, created);
+            this.#nodes.set(created.node_id, {
+                node: created,
+                observationIndices: new Map(created.observations.map((observation, index) => [
+                    observation.observation_id,
+                    index,
+                ])),
+                dirty: false,
+            });
             return created;
         }
-        const bySemanticId = new Map([...existing.observations, ...created.observations].map((observation) => [
-            observation.observation_id,
-            observation,
-        ]));
-        const observations = [...bySemanticId.values()].sort((left, right) => left.observation_id < right.observation_id
-            ? -1
-            : left.observation_id > right.observation_id
-                ? 1
-                : 0);
-        // Both factories already validated and identified these observations.
-        // Replacing the node retained every previous observation array through
-        // path/chunk/IPC indexes when multiple paths shared an entity identity.
-        existing.observations.length = 0;
-        for (const observation of observations)
-            existing.observations.push(observation);
-        return existing;
+        const observations = existing.node.observations;
+        // The first factory input can contain duplicate IDs. As before, a later
+        // merge retains only their last occurrences without replacing the array.
+        if (existing.observationIndices.size !== observations.length) {
+            let retained = 0;
+            for (const [index, observation] of observations.entries()) {
+                if (existing.observationIndices.get(observation.observation_id) !== index)
+                    continue;
+                observations[retained] = observation;
+                existing.observationIndices.set(observation.observation_id, retained);
+                retained += 1;
+            }
+            observations.length = retained;
+        }
+        for (const observation of created.observations) {
+            const index = existing.observationIndices.get(observation.observation_id);
+            if (index === undefined) {
+                existing.observationIndices.set(observation.observation_id, observations.length);
+                observations.push(observation);
+                existing.dirty = true;
+            }
+            else
+                observations[index] = observation;
+        }
+        return existing.node;
     }
     /** Create or replace one canonical edge by semantic identifier. */
     addEdge(input) {
@@ -34,9 +55,18 @@ export class JavaScriptArtifactGraphAccumulator {
         this.#edges.set(edge.edge_id, edge);
         return edge;
     }
-    /** Return all accumulated canonical nodes. */
+    /** Finalize observation order in place and return all canonical nodes. */
     nodes() {
-        return [...this.#nodes.values()];
+        return [...this.#nodes.values()].map((entry) => {
+            if (entry.dirty) {
+                entry.node.observations.sort((left, right) => compareUnicodeCodePoints(left.observation_id, right.observation_id));
+                entry.observationIndices.clear();
+                for (const [index, observation] of entry.node.observations.entries())
+                    entry.observationIndices.set(observation.observation_id, index);
+                entry.dirty = false;
+            }
+            return entry.node;
+        });
     }
     /** Return all accumulated canonical edges. */
     edges() {

package/dist/application/javascript/JavaScriptArtifactGraphBuilder.js

@@ -1,11 +1,11 @@
 import { ELECTRON_IDENTITY_LIMITATION } from "../../domain/javascript/javascriptElectronMemberWrites.js";
 import { createJavaScriptApplicationGraph, sealTransferredJavaScriptApplicationGraphSteps, } from "../../domain/javascript/javascriptApplicationGraph.js";
 import { JavaScriptArtifactGraphAccumulator } from "./JavaScriptArtifactGraphAccumulator.js";
-import { selfReferenceOmissions, } from "./JavaScriptArtifactGraphContext.js";
+import { HTML_INLINE_SCRIPT_LOCATION_COVERAGE_LIMIT, omittedHtmlInlineScriptLocations, selfReferenceOmissions, } from "./JavaScriptArtifactGraphContext.js";
 import { addJavaScriptHtmlRoles, addJavaScriptSourceMapOriginals, } from "./JavaScriptArtifactGraphDocuments.js";
 import { addJavaScriptStaticFindingsSteps } from "./JavaScriptArtifactGraphFindings.js";
 import { addJavaScriptModuleRelationshipsSteps, addJavaScriptSourceModules, } from "./JavaScriptModuleRelationships.js";
-import { completeApplicationCoverage, partialApplicationCoverage, } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
+import { completeApplicationCoverage, partialApplicationCoverage, truncatedApplicationCoverage, } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
 import { semanticCoverageResourceLimits, semanticResourceLimitCoverage, } from "../../domain/javascript/javascriptSemanticCoverage.js";
 import { semanticResourceLimitReason } from "../../domain/javascript/javascriptSemanticResourceLimits.js";
 import { addJavaScriptArtifactContainers, addJavaScriptArtifactFiles, addJavaScriptPackageNodes, createJavaScriptArtifactRootNode, } from "./JavaScriptArtifactGraphStructure.js";
@@ -39,8 +39,12 @@ function* buildJavaScriptArtifactGraphInputSteps(snapshot, fileSet, analysis) {
         snapshot,
         fileSet,
         analysis,
+        directoryPaths: new Set(snapshot.occurrences
+            .filter(({ entry_kind }) => entry_kind === "directory")
+            .map(({ logical_path }) => logical_path)),
         root,
         filesByPath: new Map(fileSet.files.map((file) => [file.path, file])),
+        unanalyzedFiles: fileSet.unanalyzed_files,
         fileNodes: new Map(),
         assetNodes: new Map(),
         sourceModuleNodes: new Map(),
@@ -99,23 +103,38 @@ const graphCoverage = (context) => {
         context.analysis.json_modules.some(({ status }) => status !== "included") ||
         context.analysis.source_maps.some(({ status }) => status === "invalid");
     const partialJavaScript = context.analysis.files.some(({ javascript }) => javascript !== null && javascript.parse_status === "partial");
-    const unknownGap = context.analysis.files.some(({ analysis_failure, application_projection_failure }) => analysis_failure !== undefined ||
-        application_projection_failure !== undefined) ||
+    const unknownGap = (context.fileSet.source_selection?.unselected_files ?? 0) > 0 ||
+        context.fileSet.unavailable_relevant_files.length > 0 ||
+        context.analysis.files.some(({ analysis_failure, application_projection_failure }) => analysis_failure !== undefined ||
+            application_projection_failure !== undefined) ||
         context.analysis.parse_failures > 0 ||
         context.fileSet.invalid_utf8_files > 0 ||
+        context.analysis.html_inline_scripts.length > 0 ||
         sourceMapPolicyGap ||
         malformedStructuredData ||
         partialJavaScript;
     const executionLimits = context.analysis.files.flatMap(({ analysis_failure, application_projection_failure }) => [analysis_failure, application_projection_failure].flatMap((failure) => failure === undefined
         ? []
         : javaScriptAnalysisCoverageLimits(failure.limits)));
-    if (resourceLimits.length > 0 || executionLimits.length > 0)
-        return partialApplicationCoverage([
+    // Capped inline script locations truncate the result. The total omission
+    // stays unknown because the unanalyzed bodies hide an unknown fact count.
+    const inlineScriptsTruncated = omittedHtmlInlineScriptLocations(context.analysis.html_inline_scripts) > 0;
+    if (resourceLimits.length > 0 ||
+        executionLimits.length > 0 ||
+        inlineScriptsTruncated) {
+        const limits = [
             ...new Map([
                 ...semanticResourceLimitCoverage(resourceLimits),
                 ...executionLimits,
+                ...(inlineScriptsTruncated
+                    ? [HTML_INLINE_SCRIPT_LOCATION_COVERAGE_LIMIT]
+                    : []),
             ].map((limit) => [JSON.stringify(limit), limit])).values(),
-        ], null);
+        ];
+        return inlineScriptsTruncated
+            ? truncatedApplicationCoverage(limits, null)
+            : partialApplicationCoverage(limits, null);
+    }
     if (unknownGap)
         return partialApplicationCoverage([], null);
     if (context.snapshot.integrity_contradictions.length > 0) {
@@ -143,6 +162,11 @@ const graphLimitations = (context, coverage, relationshipOmissions) => {
                 javascript.electron.native_addon_bindings.length), 0);
     return [
         ...context.analysis.limitations,
+        ...(context.fileSet.source_selection === undefined
+            ? []
+            : [
+                `Caller-selected source analysis leaves ${String(context.fileSet.source_selection.unselected_files)} inventoried files outside analysis scope. Inventory identity covers the complete artifact; relationships through unselected sources remain unknown.`,
+            ]),
         ...context.snapshot.integrity_contradictions.map(({ logical_path: path }) => `Artifact integrity metadata contradicts observed bytes at ${path}; the observed bytes are untrusted.`),
         ...selfReferenceOmissions(relationshipOmissions.selfImports, ["import specifier", "import specifiers"], "the importing module"),
         "CommonJS and ESM binding relationships were recovered from inert syntax and resolved only within the inventoried artifact container.",