feat(electron): report V8 cachedData compilation boundaries (#9501)

* feat(electron): report V8 cachedData execution boundaries

analyze-javascript-application treated new vm.Script(source, {cachedData}) and vm.compileFunction(..., {cachedData}) as ordinary source. V8 deserializes previously compiled bytecode for those calls, so an Electron preload wrapper that delegates its whole contextBridge and IPC surface to a .cache/.jsc snapshot appeared to have been fully analyzed with zero exposed APIs.

Record each vm compilation with its inert cache path when the cachedData value traces to a readFileSync/readFile of path syntax, and project a cached-data execution unknown plus a loads edge from the owning source. Compilations without a cache stay recorded as no-cached-data so absence remains distinguishable from an unparsed snapshot. Count cachedData executions in the Electron summary and state the coverage limit in the graph limitations.

* style(cli): wrap the native data type path description

The `inspect-native-data-type` argument description line is 82 columns, over the repository's 80-column `.oxfmtrc.json` limit, so `npm run format:check` fails on main and on every branch merged from it. It came in with #9465 and the following commits to this file did not touch it. Reformat the one call the formatter objects to; no behaviour change.

* style(domain): reformat the pending dynamic-code accumulator field

`npm run format:check` fails on this branch, which is what `Static checks` reports: oxfmt wants the `pendingDynamicCode` union on one line. Applying it is the whole change; no behaviour is touched.

* fix(electron): preserve VM callable and cache source uncertainty

* docs(javascript): specify cached-data compilation boundaries

* fix(electron): exclude disabled caches from recovered boundaries

---------

Co-authored-by: 2SinceJuly <202121119+2SinceJuly@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>

docs/specs/javascript/v8-cached-data/plan.md

@@ -0,0 +1,10 @@
+# Implementation plan
+
+1. Derive VM callable identity and intact option objects from existing semantic
+   owners after mutation indexing; retain unresolved spreads as unknown.
+2. Retain proven cache reads and their parsed bases through the named worker
+   contract. Resolve only source-directory paths against admitted inventory.
+3. Project declarations into explicit graph unknowns and compilation summaries,
+   preserving source ranges, unresolved paths and execution limitations.
+4. Verify negative mutation/spread controls and public filesystem workflows;
+   document runtime qualification separately from static analysis.

docs/specs/javascript/v8-cached-data/spec.md

@@ -0,0 +1,43 @@
+# V8 cached-data compilation boundaries
+
+## Analyst question
+
+Which source-visible Node VM compilation sites declare or may receive cached
+bytes, and which admitted artifact can be associated with those bytes?
+
+## Scope and authority
+
+Static application analysis recognizes member calls to `vm.Script` and
+`vm.compileFunction` when the shared built-in callable owner establishes their
+identity. Analysis reads admitted source and inventory only. It does not invoke
+the target, validate V8 cache bytes, establish cache acceptance, or execute code.
+Node separates compilation, cache rejection and subsequent execution; see the
+[Node VM contract](https://nodejs.org/docs/latest-v24.x/api/vm.html).
+
+## Owning facts
+
+- Resolve complete callable identity after shared mutation facts settle. ESM
+  default/namespace imports and proven CommonJS bindings use the same owner.
+  Replaced methods do not establish VM authority.
+- `cached_data_status` is `declared` for an explicit cachedData property,
+  `absent` for proven omission or a proven undefined cache value, and `unknown` for unresolved options or argument
+  spreads that can supply or shift the options position. Declaration does not
+  prove a valid runtime value or successful cache use.
+- A proven `fs.readFileSync` or awaited `fs/promises.readFile` can identify a
+  cache path. Unawaited promises and unproven readers retain bounded source
+  expressions. A supplied string alone is not proof that a file was read.
+- Preserve the parsed path base through the worker boundary. Only a proven
+  source-directory base permits an application inventory lookup. Relative
+  literal paths depend on the unknown target working directory; source paths
+  and unresolved expressions stay separate from resolved artifact identity.
+- Graph cache boundaries remain explicit unknowns with source provenance.
+  Absent sites do not add cache-boundary uncertainty. Summary counts describe
+  declared compilations, never observed executions.
+
+## Compatibility and verification
+
+Existing source declarations and inventory remain available. Optional path-base
+facts may be absent in historical analyses; omission does not prove a base.
+Public application workflows verify worker serialization, summary and graph
+projection with local files. No test that merely supplies cache-shaped bytes
+establishes real V8 acceptance or target execution.

docs/specs/javascript/v8-cached-data/tasks.md

@@ -0,0 +1,10 @@
+# Tasks
+
+- [x] Model declared, absent and unknown cached-data sites.
+- [x] Reuse built-in callable and option-object ownership.
+- [x] Retain synchronous and awaited promise read provenance and path bases.
+- [x] Carry facts through worker serialization to summary and graph consumers.
+- [x] Exercise malformed authority, argument spreads and unresolved paths.
+- [x] Verify public filesystem application workflows and document limitations.
+
+Real V8 acceptance and execution remain outside this static feature's scope.