rea-agents 6.4.0 → 6.7.0

package/dist/application/javascript/JavaScriptArtifactGraphContext.js

@@ -1,8 +1,17 @@
 import { compositeKey } from "../../domain/unicodeCodePointOrder.js";
-import { completeApplicationCoverage, partialApplicationCoverage, } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
+import { completeApplicationCoverage, partialApplicationCoverage, truncatedApplicationCoverage, } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
+import { HTML_INLINE_SCRIPT_LOCATION_LIMIT } from "../../domain/javascript/htmlArtifactReferences.js";
 import { JavaScriptArtifactGraphAccumulator } from "./JavaScriptArtifactGraphAccumulator.js";
-import { artifactObservationEvidence, astObservationEvidence, staticInferenceEvidence, unavailableAstEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
-import { resolveArtifactPathByContext, } from "./JavaScriptArtifactPathResolution.js";
+import { artifactObservationEvidence, astObservationEvidence, staticInferenceEvidence, unavailableStaticEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
+import { artifactPathResolutionProperties, resolveArtifactPathByContext, } from "./JavaScriptArtifactPathResolution.js";
+/** The per-file bound on retained inline HTML script locations. */
+export const HTML_INLINE_SCRIPT_LOCATION_COVERAGE_LIMIT = {
+    name: "html_inline_script_locations_per_file",
+    value: HTML_INLINE_SCRIPT_LOCATION_LIMIT,
+    unit: "items",
+};
+/** Count inline HTML script locations dropped by the per-file bound. */
+export const omittedHtmlInlineScriptLocations = (files) => files.reduce((omitted, { script_count, scripts }) => omitted + script_count - scripts.length, 0);
 /** Add a direct artifact-containment edge. */
 export const addArtifactContainsEdge = (context, input) => {
     context.accumulator.addEdge({
@@ -49,6 +58,12 @@ export const addStaticInferenceEdge = (context, input) => {
             range: input.range,
             operation: "map-static-relationship",
             coverage: input.coverage,
+            ...(input.confidence === undefined
+                ? {}
+                : { confidence: input.confidence }),
+            ...(input.limitations === undefined
+                ? {}
+                : { limitations: input.limitations }),
         }),
     });
 };
@@ -61,6 +76,8 @@ export const addUnavailableStaticParseScope = (context, input) => {
             {
                 label: `${input.file.path} parse scope`,
                 properties: {
+                    // Details come first so they cannot replace the gap's own fields.
+                    ...input.details,
                     path: input.file.path,
                     operation: input.operation,
                     limitation: input.limitation,
@@ -68,11 +85,14 @@ export const addUnavailableStaticParseScope = (context, input) => {
                         ? {}
                         : { analysis_failure: input.failure }),
                 },
-                evidence: unavailableAstEvidence({
+                evidence: unavailableStaticEvidence({
+                    authority: input.authority,
                     sha256: input.file.sha256,
                     path: input.file.path,
                     operation: input.operation,
-                    coverage: partialApplicationCoverage(input.limits ?? [], null),
+                    coverage: input.omittedCount !== undefined && input.omittedCount > 0
+                        ? truncatedApplicationCoverage(input.limits ?? [], input.omittedCount)
+                        : partialApplicationCoverage(input.limits ?? [], null),
                     limitation: input.limitation,
                 }),
             },
@@ -119,6 +139,7 @@ export const createElectronRoleNode = (context, input) => context.accumulator.ad
         {
             label: input.resolution.resolved_path ?? input.resolution.declared_path,
             properties: {
+                ...artifactPathResolutionProperties(input.resolution),
                 declared_path: input.resolution.declared_path,
                 resolution_context: input.resolution.resolution_context,
                 resolved_path: input.resolution.resolved_path,
@@ -179,11 +200,12 @@ export const moduleLookupKey = (path, runtime, moduleKey) => compositeKey([path,
 /** Deterministic key for one recovered bundler chunk inside a bundle asset. */
 export const chunkLookupKey = (path, runtime, chunkKey) => compositeKey([path, runtime, chunkKey]);
 /** Resolve a relative static specifier without escaping the artifact root. */
-export const resolveArtifactPath = (specifier, sourcePath, files, moduleKind) => resolveArtifactPathByContext({
+export const resolveArtifactPath = (specifier, sourcePath, files, moduleKind, directoryPaths) => resolveArtifactPathByContext({
     declaredPath: specifier,
     sourcePath,
     context: "module-specifier",
     files,
+    ...(directoryPaths === undefined ? {} : { directoryPaths }),
     ...(moduleKind === undefined ? {} : { moduleKind }),
 }).resolved_path;
 /** Locate the recovered module that owns a static finding. */

package/dist/application/javascript/JavaScriptArtifactGraphDocuments.js

@@ -1,4 +1,4 @@
-import { addArtifactContainsEdge, addStaticInferenceEdge, createElectronRoleNode, linkElectronRoleToAsset, } from "./JavaScriptArtifactGraphContext.js";
+import { addArtifactContainsEdge, addStaticInferenceEdge, artifactLocalIdentity, createElectronRoleNode, linkElectronRoleToAsset, } from "./JavaScriptArtifactGraphContext.js";
 import { artifactObservationEvidence, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
 import { completeApplicationCoverage } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
 import { resolveArtifactPathByContext } from "./JavaScriptArtifactPathResolution.js";
@@ -43,6 +43,8 @@ export const addJavaScriptHtmlRoles = (context) => {
                 sourcePath: html.path,
                 context: "html-reference",
                 files: context.filesByPath,
+                directoryPaths: context.directoryPaths,
+                unanalyzedFiles: context.unanalyzedFiles,
                 htmlBaseHref: script.base_href,
             });
             const resolvedPath = resolution.resolved_path;
@@ -103,22 +105,29 @@ export const addJavaScriptSourceMapOriginals = (context) => {
             continue;
         const coverage = completeApplicationCoverage();
         for (const original of sourceMap.sources) {
+            const reference = original.reference;
             const node = context.accumulator.addNode({
-                kind: "source-module",
-                identity: {
-                    strategy: "source-map-original",
-                    stability: "source-map-exact",
-                    source_map_sha256: mapFile.sha256,
-                    original_source: original.reference.source_name,
-                    source_root: original.reference.source_root,
-                    source_sha256: original.content_sha256,
-                },
+                kind: reference === null ? "unknown" : "source-module",
+                identity: reference === null
+                    ? artifactLocalIdentity(mapFile.sha256, "source-map-unnamed-declaration", String(original.declaration_index))
+                    : {
+                        strategy: "source-map-original",
+                        stability: "source-map-exact",
+                        source_map_sha256: mapFile.sha256,
+                        original_source: reference.source_name,
+                        source_root: reference.source_root,
+                        source_sha256: original.content_sha256,
+                    },
                 observations: [
                     {
-                        label: original.reference.source_name || null,
-                        source_map_reference: original.reference,
+                        label: reference?.source_name || null,
+                        source_map_reference: reference,
                         properties: {
+                            source_index: original.source_index,
+                            declaration_index: original.declaration_index,
+                            source_name_available: reference !== null,
                             content_available: original.content !== null,
+                            content_sha256: original.content_sha256,
                         },
                         evidence: artifactObservationEvidence({
                             sha256: mapFile.sha256,
@@ -135,8 +144,10 @@ export const addJavaScriptSourceMapOriginals = (context) => {
                 target_node_id: node.node_id,
                 relation: "contains",
                 properties: {
-                    original_source: original.reference.source_name,
-                    source_root: original.reference.source_root,
+                    source_index: original.source_index,
+                    declaration_index: original.declaration_index,
+                    original_source: reference?.source_name ?? null,
+                    source_root: reference?.source_root ?? null,
                 },
                 evidence: artifactObservationEvidence({
                     sha256: mapFile.sha256,

package/dist/application/javascript/JavaScriptArtifactGraphEvidence.js

@@ -63,9 +63,9 @@ export const staticInferenceEvidence = (input) => ({
     ],
     evidence_ids: [],
 });
-/** Unavailable AST fact that preserves a parse, approval, or limit gap. */
-export const unavailableAstEvidence = (input) => ({
-    authority: "ast-static-analysis",
+/** Unavailable static fact with the authority of its applicable processing phase. */
+export const unavailableStaticEvidence = (input) => ({
+    authority: input.authority,
     state: "unavailable",
     confidence: "unknown",
     artifact: artifactReference(input.sha256),

package/dist/application/javascript/JavaScriptArtifactGraphFindings.js

@@ -1,8 +1,9 @@
 import { createHash } from "node:crypto";
 import { compactStringIdentityKey } from "../../domain/compactStringIdentity.js";
-import { addStaticInferenceEdge, artifactLocalIdentity, chunkLookupKey, createElectronRoleNode, javascriptAnalysisCoverage, linkElectronRoleToAsset, moduleLookupKey, resolveArtifactPath, selfReferenceOmissions, sourceNodeFor, } from "./JavaScriptArtifactGraphContext.js";
+import { addStaticInferenceEdge, artifactLocalIdentity, chunkLookupKey, createElectronRoleNode, javascriptAnalysisCoverage, linkElectronRoleToAsset, moduleLookupKey, selfReferenceOmissions, sourceNodeFor, } from "./JavaScriptArtifactGraphContext.js";
 import { astObservationEvidence, staticInferenceEvidence, } from "./JavaScriptArtifactGraphEvidence.js";
-import { resolveArtifactPathByContext } from "./JavaScriptArtifactPathResolution.js";
+import { artifactPathResolutionProperties, resolveArtifactPathByContext, } from "./JavaScriptArtifactPathResolution.js";
+import { moduleResolutionModeForJavaScriptReference } from "../../domain/javascript/javascriptModuleResolutionMode.js";
 /** Project imports, workers, roles, endpoints, storage, and source-map links. */
 export function* addJavaScriptStaticFindingsSteps(context) {
     const omissions = { selfReferences: 0 };
@@ -30,7 +31,7 @@ const addReference = (context, input, omissions) => {
     const source = sourceNodeFor(context, input.file.path, input.value.module_key, input.value.module_runtime) ?? input.asset;
     const resolved = input.value.specifier === null
         ? null
-        : resolveReference(context, input.file.path, input.value);
+        : resolveReference(context, input.file.path, input.value, input.coverage);
     if (input.value.kind === "worker" || input.value.kind === "service-worker") {
         const worker = context.accumulator.addNode({
             kind: input.value.kind === "worker" ? "worker" : "service-worker",
@@ -42,6 +43,8 @@ const addReference = (context, input, omissions) => {
                         declared_specifier: input.value.specifier,
                         expression: input.value.expression,
                         resolved_path: resolved?.path ?? null,
+                        resolution_status: resolved?.resolutionStatus ?? null,
+                        ...artifactPathResolutionProperties(resolved?.resolution),
                     },
                     evidence: staticInferenceEvidence({
                         sha256: input.file.sha256,
@@ -49,6 +52,7 @@ const addReference = (context, input, omissions) => {
                         range: input.value.location,
                         operation: "discover-worker",
                         coverage: input.coverage,
+                        limitations: resolved?.limitations ?? [],
                     }),
                 },
             ],
@@ -60,9 +64,14 @@ const addReference = (context, input, omissions) => {
             range: input.value.location,
             coverage: input.coverage,
             relation: "loads",
-            properties: { kind: input.value.kind },
+            properties: {
+                kind: input.value.kind,
+                resolution_status: resolved?.resolutionStatus ?? null,
+                ...artifactPathResolutionProperties(resolved?.resolution),
+            },
+            limitations: resolved?.limitations ?? [],
         });
-        if (resolved !== null)
+        if (resolved !== null && resolved.path !== null && resolved.node !== null)
             addStaticInferenceEdge(context, {
                 source: worker,
                 target: resolved.node,
@@ -71,13 +80,14 @@ const addReference = (context, input, omissions) => {
                 coverage: input.coverage,
                 relation: "maps_to",
                 properties: { resolved_path: resolved.path },
+                limitations: resolved.limitations,
             });
         return;
     }
     // A reference that resolves to its own source, such as a bundled module
     // requiring its own key, cannot become an edge: the application graph
     // forbids self-referential edges and one would fail the whole analysis.
-    if (resolved?.node.node_id === source.node_id) {
+    if (resolved?.node?.node_id === source.node_id) {
         omissions.selfReferences += 1;
         return;
     }
@@ -89,22 +99,38 @@ const addReference = (context, input, omissions) => {
         file: input.file,
         range: input.value.location,
         coverage: input.coverage,
-        relation: resolved?.file.kind === "native-addon" ? "loads" : "imports",
+        relation: resolved?.file?.kind === "native-addon" ? "loads" : "imports",
         properties: {
             kind: input.value.kind,
             specifier: input.value.specifier,
             expression: input.value.expression,
+            resolution_mode: input.value.kind === "static-import" ||
+                input.value.kind === "dynamic-import" ||
+                input.value.kind === "require"
+                ? moduleResolutionModeForJavaScriptReference(input.file.path, input.value.kind)
+                : null,
             resolved_path: resolved?.path ?? null,
+            resolution_status: resolved?.resolutionStatus ?? null,
+            ...artifactPathResolutionProperties(resolved?.resolution),
         },
+        ...(resolved === null ? {} : { limitations: resolved.limitations }),
     });
 };
 const addEndpoint = (context, input) => {
     const source = sourceNodeFor(context, input.file.path, input.value.module_key, input.value.module_runtime) ?? input.asset;
     const key = compactStringIdentityKey(input.value.value);
-    const label = `${input.value.kind} endpoint`;
+    const candidate = input.value.interpretation === "candidate";
+    const partial = input.value.resolution === "partial";
+    const candidateLimitation = "The unbound method-like argument is only a candidate; its receiver does not establish a network call.";
+    const partialLimitation = "The request target is not an exact literal; the endpoint value retains the unresolved source expression.";
+    const label = `${input.value.kind} ${candidate ? "endpoint candidate" : "endpoint"}`;
     const node = context.accumulator.addNode({
         kind: "endpoint",
-        identity: artifactLocalIdentity(input.file.sha256, input.value.kind, key),
+        identity: artifactLocalIdentity(input.file.sha256, input.value.kind, JSON.stringify([
+            input.value.interpretation ?? "literal",
+            ...(partial ? ["partial", input.value.location] : []),
+            key,
+        ])),
         observations: [
             {
                 label: input.value.value.length <= label.length ? input.value.value : label,
@@ -112,14 +138,27 @@ const addEndpoint = (context, input) => {
                     endpoint_kind: input.value.kind,
                     value: input.value.value,
                     mechanism: input.value.mechanism,
+                    ...(candidate ? { interpretation: input.value.interpretation } : {}),
+                    ...(partial ? { resolution: input.value.resolution } : {}),
                 },
-                evidence: astObservationEvidence({
-                    sha256: input.file.sha256,
-                    path: input.file.path,
-                    range: input.value.location,
-                    operation: "discover-static-endpoint",
-                    coverage: input.coverage,
-                }),
+                evidence: candidate
+                    ? staticInferenceEvidence({
+                        sha256: input.file.sha256,
+                        path: input.file.path,
+                        range: input.value.location,
+                        operation: "classify-static-endpoint-candidate",
+                        coverage: input.coverage,
+                        confidence: "low",
+                        limitations: [candidateLimitation],
+                    })
+                    : astObservationEvidence({
+                        sha256: input.file.sha256,
+                        path: input.file.path,
+                        range: input.value.location,
+                        operation: "discover-static-endpoint",
+                        coverage: input.coverage,
+                        ...(partial ? { limitations: [partialLimitation] } : {}),
+                    }),
             },
         ],
     });
@@ -130,14 +169,28 @@ const addEndpoint = (context, input) => {
         range: input.value.location,
         coverage: input.coverage,
         relation: input.value.kind === "route" ? "exposes" : "calls",
-        properties: { mechanism: input.value.mechanism },
+        properties: {
+            mechanism: input.value.mechanism,
+            ...(candidate ? { interpretation: input.value.interpretation } : {}),
+            ...(partial ? { resolution: input.value.resolution } : {}),
+        },
+        ...(candidate
+            ? {
+                confidence: "low",
+                limitations: [candidateLimitation],
+            }
+            : partial
+                ? { limitations: [partialLimitation] }
+                : {}),
     });
 };
 const addStorage = (context, input) => {
+    const candidate = input.value.interpretation === "candidate";
+    const limitation = "The constructor name is only a candidate; an unchanged SQLite module API origin is unproven.";
     const source = sourceNodeFor(context, input.file.path, input.value.module_key, input.value.module_runtime) ?? input.asset;
     const node = context.accumulator.addNode({
         kind: "storage",
-        identity: artifactLocalIdentity(input.file.sha256, input.value.kind, input.value.name ?? input.value.mechanism),
+        identity: artifactLocalIdentity(input.file.sha256, candidate ? `${input.value.kind}:candidate` : input.value.kind, input.value.name ?? input.value.mechanism),
         observations: [
             {
                 label: input.value.name ?? input.value.kind,
@@ -145,14 +198,25 @@ const addStorage = (context, input) => {
                     storage_kind: input.value.kind,
                     name: input.value.name,
                     mechanism: input.value.mechanism,
+                    ...(candidate ? { interpretation: "candidate" } : {}),
                 },
-                evidence: astObservationEvidence({
-                    sha256: input.file.sha256,
-                    path: input.file.path,
-                    range: input.value.location,
-                    operation: "discover-static-storage",
-                    coverage: input.coverage,
-                }),
+                evidence: candidate
+                    ? staticInferenceEvidence({
+                        sha256: input.file.sha256,
+                        path: input.file.path,
+                        range: input.value.location,
+                        operation: "classify-static-storage-candidate",
+                        coverage: input.coverage,
+                        confidence: "low",
+                        limitations: [limitation],
+                    })
+                    : astObservationEvidence({
+                        sha256: input.file.sha256,
+                        path: input.file.path,
+                        range: input.value.location,
+                        operation: "discover-static-storage",
+                        coverage: input.coverage,
+                    }),
             },
         ],
     });
@@ -163,7 +227,13 @@ const addStorage = (context, input) => {
         range: input.value.location,
         coverage: input.coverage,
         relation: "persists_to",
-        properties: { mechanism: input.value.mechanism },
+        properties: {
+            mechanism: input.value.mechanism,
+            ...(candidate ? { interpretation: "candidate" } : {}),
+        },
+        ...(candidate
+            ? { confidence: "low", limitations: [limitation] }
+            : {}),
     });
 };
 const addDiscoveredRole = (context, input) => {
@@ -172,6 +242,16 @@ const addDiscoveredRole = (context, input) => {
         sourcePath: input.file.path,
         context: input.value.resolution_context,
         files: context.filesByPath,
+        directoryPaths: context.directoryPaths,
+        unanalyzedFiles: context.unanalyzedFiles,
+        ...(input.value.role === "preload" ||
+            (input.value.role === "renderer" &&
+                input.value.resolution_context === "filesystem-expression")
+            ? { runtimePathKind: "exact-file" }
+            : input.value.role === "renderer" &&
+                input.value.resolution_context === "module-specifier"
+                ? { runtimePathKind: "url-resource" }
+                : {}),
     });
     const role = createElectronRoleNode(context, {
         kind: input.value.role === "preload" ? "electron-preload" : "electron-renderer",
@@ -203,15 +283,23 @@ const addSourceMapEdge = (context, input) => {
     const declaredUrlSha256 = createHash("sha256")
         .update(input.value.declared_url)
         .digest("hex");
-    const resolvedPath = resolveArtifactPathByContext({
+    const resolution = resolveArtifactPathByContext({
         declaredPath: input.value.declared_url,
         sourcePath: input.file.path,
         context: "url-reference",
         files: context.filesByPath,
-    }).resolved_path;
+        directoryPaths: context.directoryPaths,
+        unanalyzedFiles: context.unanalyzedFiles,
+    });
+    const resolvedPath = resolution.resolved_path;
     const resolvedFile = resolvedPath === null ? undefined : context.filesByPath.get(resolvedPath);
     const resolvedNode = resolvedPath === null ? undefined : context.fileNodes.get(resolvedPath);
     const isAvailable = resolvedFile?.kind === "source-map" && resolvedNode !== undefined;
+    const limitations = isAvailable || resolution.limitations.length > 0
+        ? resolution.limitations
+        : [
+            "The declared reference does not identify an available source-map projection.",
+        ];
     const target = context.accumulator.addNode({
         kind: "source-map",
         identity: isAvailable && resolvedNode !== undefined
@@ -224,6 +312,8 @@ const addSourceMapEdge = (context, input) => {
                     declared_url: input.value.declared_url,
                     declared_url_sha256: declaredUrlSha256,
                     resolved_path: resolvedPath,
+                    resolution_status: resolution.resolution_status,
+                    ...artifactPathResolutionProperties(resolution),
                     available: isAvailable,
                 },
                 evidence: staticInferenceEvidence({
@@ -233,11 +323,7 @@ const addSourceMapEdge = (context, input) => {
                     operation: "discover-source-map",
                     coverage: input.coverage,
                     confidence: "medium",
-                    limitations: isAvailable
-                        ? []
-                        : [
-                            "The declared source map was not present in the inventoried artifact.",
-                        ],
+                    limitations,
                 }),
             },
         ],
@@ -249,47 +335,92 @@ const addSourceMapEdge = (context, input) => {
         range: input.value.location,
         coverage: input.coverage,
         relation: "maps_to",
+        limitations,
         properties: {
             declared_url_sha256: declaredUrlSha256,
             resolved_path: resolvedPath,
+            resolution_status: resolution.resolution_status,
+            ...artifactPathResolutionProperties(resolution),
         },
     });
 };
-const resolveReference = (context, sourcePath, reference) => {
+const resolveReference = (context, sourcePath, reference, coverage) => {
     const specifier = reference.specifier;
     if (specifier === null)
         return null;
-    const chunk = resolveBundlerChunkReference(context, sourcePath, reference);
+    const isWorker = reference.kind === "worker" || reference.kind === "service-worker";
+    const chunk = isWorker
+        ? null
+        : resolveBundlerChunkReference(context, sourcePath, reference);
     if (chunk !== null)
         return chunk;
-    const module = reference.module_runtime === undefined
+    const module = isWorker || reference.module_runtime === undefined
         ? undefined
         : context.moduleNodes.get(moduleLookupKey(sourcePath, reference.module_runtime, specifier));
     if (module !== undefined) {
         const file = context.filesByPath.get(sourcePath);
         return file === undefined
             ? null
-            : { path: `${sourcePath}#module:${specifier}`, file, node: module };
+            : {
+                path: `${sourcePath}#module:${specifier}`,
+                file,
+                node: module,
+                limitations: [],
+            };
     }
     // Worker scripts are URLs relative to the script, not module specifiers.
-    const path = reference.kind === "worker" || reference.kind === "service-worker"
+    const resolution = isWorker
         ? resolveArtifactPathByContext({
             declaredPath: specifier,
             sourcePath,
             context: "url-reference",
             files: context.filesByPath,
-        }).resolved_path
-        : resolveArtifactPath(specifier, sourcePath, context.filesByPath, reference.kind === "require"
-            ? "require"
-            : reference.kind === "static-import" ||
-                reference.kind === "dynamic-import"
-                ? "import"
-                : undefined);
-    if (path === null)
-        return null;
+            directoryPaths: context.directoryPaths,
+            unanalyzedFiles: context.unanalyzedFiles,
+        })
+        : resolveArtifactPathByContext({
+            declaredPath: specifier,
+            sourcePath,
+            context: "module-specifier",
+            files: context.filesByPath,
+            directoryPaths: context.directoryPaths,
+            unanalyzedFiles: context.unanalyzedFiles,
+            ...("require" === reference.kind ||
+                "static-import" === reference.kind ||
+                "dynamic-import" === reference.kind
+                ? {
+                    moduleKind: moduleResolutionModeForJavaScriptReference(sourcePath, reference.kind),
+                }
+                : {}),
+        });
+    const path = resolution.resolved_path;
+    if (path === null) {
+        const source = context.filesByPath.get(sourcePath);
+        return source === undefined
+            ? null
+            : {
+                path: null,
+                file: null,
+                node: isWorker
+                    ? null
+                    : unresolvedReferenceNode(context, source, reference, coverage, resolution),
+                limitations: resolution.limitations,
+                resolutionStatus: resolution.resolution_status,
+                resolution,
+            };
+    }
     const file = context.filesByPath.get(path);
     const node = context.fileNodes.get(path);
-    return file === undefined || node === undefined ? null : { path, file, node };
+    return file === undefined || node === undefined
+        ? null
+        : {
+            path,
+            file,
+            node,
+            limitations: resolution.limitations,
+            resolutionStatus: resolution.resolution_status,
+            resolution,
+        };
 };
 const resolveBundlerChunkReference = (context, sourcePath, reference) => {
     const key = reference.specifier?.startsWith("chunk:")
@@ -320,9 +451,9 @@ const resolveBundlerChunkReference = (context, sourcePath, reference) => {
     const node = unique[0];
     return node === undefined
         ? null
-        : { path: `${sourcePath}#chunk:${key}`, file, node };
+        : { path: `${sourcePath}#chunk:${key}`, file, node, limitations: [] };
 };
-const unresolvedReferenceNode = (context, file, reference, coverage) => context.accumulator.addNode({
+const unresolvedReferenceNode = (context, file, reference, coverage, resolution) => context.accumulator.addNode({
     kind: "javascript-module",
     identity: artifactLocalIdentity(file.sha256, "unresolved-reference", `${reference.kind}:${reference.specifier ?? reference.expression}`),
     observations: [
@@ -333,6 +464,10 @@ const unresolvedReferenceNode = (context, file, reference, coverage) => context.
                 specifier: reference.specifier,
                 expression: reference.expression,
                 resolution: "unresolved",
+                ...(resolution === undefined
+                    ? {}
+                    : { resolution_status: resolution.resolution_status }),
+                ...artifactPathResolutionProperties(resolution),
             },
             evidence: staticInferenceEvidence({
                 sha256: file.sha256,
@@ -343,6 +478,7 @@ const unresolvedReferenceNode = (context, file, reference, coverage) => context.
                 confidence: "low",
                 limitations: [
                     "The static reference could not be resolved within the inventoried artifact.",
+                    ...(resolution?.limitations ?? []),
                 ],
             }),
         },