fix(javascript): align module lookup and source evidence

Preserve CommonJS literal paths and confined ESM URL semantics, including package main fallback, directory intent, Unicode identity, and present opaque modules. Parse extraction inputs at their AST/source owner, retain skipped HTML and source-map coverage, and distinguish endpoint candidates from proven receiver facts. Version structural fingerprints with computed literal contents and propagate them through worker contracts.

Reviewed fixes include #1810, #1840, #2642, #2700, #2702, #2714, #2803, #2960, #2968, #2986, #3035, and #3036.

Validation: 158 resolver tests passed; public CLI/MCP module lookup controls, package-main/Unicode workflows, and six builtin workflows passed in the current compiled lane. Worker schema/fingerprint regressions passed. Large public pdf.js completion and real Electron analysis remain unverified.

src/domain/javascript/htmlArtifactReferences.test.ts

@@ -1,6 +1,9 @@
 import { expect, it } from "vitest";
 
-import { htmlArtifactReferences } from "./htmlArtifactReferences.js";
+import {
+  HTML_INLINE_SCRIPT_LOCATION_LIMIT,
+  htmlArtifactReferences,
+} from "./htmlArtifactReferences.js";
 
 it.each([
   ['<script data-src="decoy.js"></script>', []],
@@ -35,17 +38,21 @@ it.each([
   ).toEqual(expected);
 });
 
-it("retains exact opening-tag offsets rather than the script body", () => {
+it("retains exact opening-tag coordinates rather than the script body", () => {
   const opening = '<script\n title=">" src=actual.js>';
   const prefix = "<!doctype html>\n\n";
   const text = `${prefix}${opening}ignored body</script>`;
   expect(htmlArtifactReferences(text)).toEqual({
     baseHref: null,
+    inlineScripts: [],
+    inlineScriptCount: 0,
     scripts: [
       {
         scriptPath: "actual.js",
-        startOffset: prefix.length,
-        endOffset: prefix.length + opening.length,
+        location: {
+          start: { line: 3, column: 0 },
+          end: { line: 4, column: ' title=">" src=actual.js>'.length },
+        },
       },
     ],
   });
@@ -68,3 +75,71 @@ it("traverses deep valid document content without recursive stack growth", () =>
     htmlArtifactReferences(text).scripts.map(({ scriptPath }) => scriptPath),
   ).toEqual(["actual.js"]);
 });
+
+it.each([
+  ["<script>run();</script>", ["classic"]],
+  ['<script type="">run();</script>', ["classic"]],
+  ['<script type=" Text/JavaScript ">run();</script>', ["classic"]],
+  ['<script type="application/x-javascript">run();</script>', ["classic"]],
+  ['<script language="javascript">run();</script>', ["classic"]],
+  ['<script language="">run();</script>', ["classic"]],
+  ['<script type="MODULE">import "./x.js";</script>', ["module"]],
+  // Only the JavaScript MIME check strips whitespace; `module` must match.
+  ['<script type=" module ">import "./x.js";</script>', []],
+  ['<script language=" javascript ">run();</script>', []],
+  ["<script nomodule>run();</script>", ["classic"]],
+  // A src attribute, even an empty one, means the browser ignores the body.
+  ['<script src="actual.js">run();</script>', []],
+  ['<script src="">run();</script>', []],
+  ["<script>  \n\t </script>", []],
+  ['<script type="application/json">{"a":1}</script>', []],
+  ['<script type="application/ld+json">{}</script>', []],
+  ['<script type="importmap">{"imports":{}}</script>', []],
+  ['<script type="speculationrules">{}</script>', []],
+  ['<script type="text/template"><p>x</p></script>', []],
+  ['<script language="vbscript">run()</script>', []],
+  ["<!-- <script>run();</script> -->", []],
+  ["<template><script>run();</script></template>", []],
+  ["<svg><script>run();</script></svg>", []],
+])("classifies inline JavaScript in %s", (text, expected) => {
+  expect(
+    htmlArtifactReferences(text).inlineScripts.map(
+      ({ scriptType }) => scriptType,
+    ),
+  ).toEqual(expected);
+});
+
+it("retains exact inline script body coordinates, including unclosed scripts", () => {
+  const prefix = "<!doctype html>\n<script>";
+  const body = "\nfetch('/api');\n";
+  const closed = `${prefix}${body}</script><p>after</p>`;
+  expect(htmlArtifactReferences(closed).inlineScripts).toEqual([
+    {
+      scriptType: "classic",
+      location: { start: { line: 2, column: 8 }, end: { line: 4, column: 0 } },
+    },
+  ]);
+  const unclosed = `${prefix}${body}`;
+  expect(htmlArtifactReferences(unclosed).inlineScripts).toEqual([
+    {
+      scriptType: "classic",
+      location: { start: { line: 2, column: 8 }, end: { line: 4, column: 0 } },
+    },
+  ]);
+});
+
+it("counts every inline body but retains bounded locations", () => {
+  const count = 150_000;
+  const text = "<script>x</script>".repeat(count);
+  const { inlineScripts, inlineScriptCount } = htmlArtifactReferences(text);
+  expect(inlineScriptCount).toBe(count);
+  expect(inlineScripts).toHaveLength(HTML_INLINE_SCRIPT_LOCATION_LIMIT);
+  const column = 18 * (HTML_INLINE_SCRIPT_LOCATION_LIMIT - 1) + 8;
+  expect(inlineScripts.at(-1)).toEqual({
+    scriptType: "classic",
+    location: {
+      start: { line: 1, column },
+      end: { line: 1, column: column + 1 },
+    },
+  });
+});