fix(javascript): isolate source analysis and retain bounded partial evidence (#1651)

* refactor(javascript): validate transferable file projections

* test(javascript): consume decoded module and static facts

* fix(javascript): isolate source analysis and retain bounded partial evidence

* test(javascript): verify cleanup retention and repeated source paths

src/application/javascript/JavaScriptArtifactGraphStructure.ts

@@ -2,6 +2,9 @@ import type { ArtifactInventorySnapshot } from "../../domain/artifactInventorySn
 import type { ApplicationNode } from "../../domain/javascript/javascriptApplicationGraphSchemas.js";
 import { completeApplicationCoverage } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
 import type { JavaScriptModuleArtifactAnalysis } from "./JavaScriptArtifactAnalysisTypes.js";
+import { jsonValueSchema } from "../../domain/jsonValue.js";
+import { freezeJsonSnapshot } from "../../domain/immutableJson.js";
+import type { JavaScriptSourceRange } from "../../domain/javascript/javascriptStaticAnalysisTypes.js";
 import type {
   JavaScriptArtifactContainer,
   JavaScriptArtifactFile,
@@ -12,12 +15,14 @@ import {
   addUnavailableStaticParseScope,
   artifactFileNodeKind,
   artifactLocalIdentity,
+  javascriptAnalysisCoverage,
   createElectronRoleNode,
   linkElectronRoleToAsset,
   type JavaScriptArtifactGraphContext,
 } from "./JavaScriptArtifactGraphContext.js";
 import {
   artifactObservationEvidence,
+  astObservationEvidence,
   staticInferenceEvidence,
 } from "./JavaScriptArtifactGraphEvidence.js";
 import { resolveArtifactPathByContext } from "./JavaScriptArtifactPathResolution.js";
@@ -127,6 +132,40 @@ export const addJavaScriptArtifactFiles = (
       analyzed.javascript,
       jsonValue,
     );
+    if (
+      analyzed.application_projection_failure !== undefined &&
+      analyzed.javascript !== null
+    )
+      context.accumulator.addNode({
+        kind: target.kind,
+        identity: target.identity,
+        observations: [
+          {
+            label: file.path,
+            properties: {
+              static_analysis: freezeJsonSnapshot(
+                jsonValueSchema.parse(analyzed.javascript),
+              ),
+              semantic_module_analysis:
+                analyzed.semantic === null
+                  ? null
+                  : freezeJsonSnapshot(
+                      jsonValueSchema.parse(analyzed.semantic.ir),
+                    ),
+              application_projection_failure:
+                analyzed.application_projection_failure.error,
+            },
+            evidence: astObservationEvidence({
+              sha256: file.sha256,
+              path: file.path,
+              operation: "retain-unexpanded-static-findings",
+              range: sourceFileRange(file),
+              coverage: javascriptAnalysisCoverage(analyzed.javascript),
+              limitations: [analyzed.application_projection_failure.reason],
+            }),
+          },
+        ],
+      });
     context.fileNodes.set(file.path, target);
     if (file.kind === "javascript") context.assetNodes.set(file.path, target);
     const entry = createAsarEntry(context, file);
@@ -159,7 +198,18 @@ export const addJavaScriptArtifactFiles = (
         }),
       });
     }
-    if (
+    if (analyzed.analysis_failure !== undefined)
+      addUnavailableStaticParseScope(context, {
+        file,
+        asset: target,
+        operation: "analyze-javascript-source",
+        limitation: analyzed.analysis_failure.reason,
+        failure: analyzed.analysis_failure.error,
+        limits: javaScriptAnalysisCoverageLimits(
+          analyzed.analysis_failure.limits,
+        ),
+      });
+    else if (
       file.kind === "javascript" &&
       (analyzed.javascript === null ||
         analyzed.javascript.parse_status === "failed")
@@ -172,6 +222,17 @@ export const addJavaScriptArtifactFiles = (
           ? "JavaScript syntax could not be parsed."
           : `JavaScript text was unavailable: ${file.text.reason}.`,
       });
+    if (analyzed.application_projection_failure !== undefined)
+      addUnavailableStaticParseScope(context, {
+        file,
+        asset: target,
+        operation: "project-javascript-application",
+        limitation: analyzed.application_projection_failure.reason,
+        failure: analyzed.application_projection_failure.error,
+        limits: javaScriptAnalysisCoverageLimits(
+          analyzed.application_projection_failure.limits,
+        ),
+      });
     const packageValue = packagesByPath.get(file.path);
     if (packageValue !== undefined && packageValue.status !== "included")
       addUnavailableStaticParseScope(context, {
@@ -198,6 +259,23 @@ export const addJavaScriptArtifactFiles = (
   }
 };
 
+const sourceFileRange = (
+  file: JavaScriptArtifactFile,
+): JavaScriptSourceRange => {
+  if (!file.text.included)
+    throw new TypeError("Retained static facts require their source text");
+  let line = 1;
+  let lastLineStart = 0;
+  for (const match of file.text.value.matchAll(/\r\n|[\n\r\u2028\u2029]/gu)) {
+    line += 1;
+    lastLineStart = match.index + match[0].length;
+  }
+  return {
+    start: { line: 1, column: 0 },
+    end: { line, column: file.text.value.length - lastLineStart },
+  };
+};
+
 /** Project package metadata and its declared Electron roles. */
 export const addJavaScriptPackageNodes = (
   context: JavaScriptArtifactGraphContext,
@@ -407,3 +485,4 @@ const containerProperties = (container: JavaScriptArtifactContainer) => ({
   bytes: container.bytes,
   inventory_artifact_id: container.inventory_artifact_id,
 });
+import { javaScriptAnalysisCoverageLimits } from "../../domain/javascript/javascriptAnalysisResourceControls.js";